问:
Reconstructing "relative" import functions in IDA
Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed.

I'm reverse engineering a packed win32 executable, so I dumped it with Scylla. My understanding is that typically, one of the first things you do is rebuild the IAT. However, this executable seems to differ in that the majority of the calls don't reference an IAT, example:

I am having trouble with what to do in this scenario to get pretty names for all of these calls. I found something like an IAT with a massive array of import function symbols and wrote a script that prints out a large list of (address, symbol name) pairs, but then I can't figure out how to input this information into IDA (IDAPython set_name fails as it is not an allocated address).

Could I have general advice on what to do here? (some way to tell IDA a DLL loads somewhere and it gets symbols, somehow define my list of symbols despite IDA not knowing about the memory, etc.) I suspect I am missing something really simple since the fact that I'm able to generate my list means I have the information, just not how to input it!


问:
Confusing objdump with data as code
I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get it to do so. I was unable to directly embed inline data into the function (probably because I am missing something) without causing a segmentation fault when run. Obviously, the program should run correctly but screw up the linear disassembler.

For example, if I just dump data bytes directly into the function gcc will not interpret it correctly and cause it to segfault due to a bad assembly:

```<code>#include <stdio.h>

int main(int argc, char **argv)
{
    asm(".intel_syntax noprefix");
    asm(".ascii \"\\x6a\\x20\\x89\\x7d\\xec\\xc7\" \n");

    int x = 1;
    printf("%d\n", x);
}
</code>```

This obvious screws up objdump...

```<code>0000000000001149 <main>:
    1149:   f3 0f 1e fa             endbr64
    114d:   55                      push   rbp
    114e:   48 89 e5                mov    rbp,rsp
    1151:   48 83 ec 20             sub    rsp,0x20
    1155:   89 7d ec                mov    DWORD PTR [rbp-0x14],edi
    1158:   48 89 75 e0             mov    QWORD PTR [rbp-0x20],rsi
    115c:   6a 20                   push   0x20
    115e:   89 7d ec                mov    DWORD PTR [rbp-0x14],edi
    1161:   c7 c7 45 fc 01 00       mov    edi,0x1fc45
    1167:   00 00                   add    BYTE PTR [rax],al
    1169:   8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
    116c:   89 c6                   mov    esi,eax
    116e:   48 8d 3d 8f 0e 00 00    lea    rdi,[rip+0xe8f]        # 2004 <_IO_stdin_used+0x4>
    1175:   b8 00 00 00 00          mov    eax,0x0
    117a:   e8 d1 fe ff ff          call   1050 <printf@plt>
    117f:   b8 00 00 00 00          mov    eax,0x0
    1184:   c9                      leave
    1185:   c3                      ret
    1186:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]
    118d:   00 00 00
</code>```

There are nonsense bytes starting at 155c. But this will seg fault naturally because its clobbering all sorts of stuff.

If I try something more tame it doesn't segfault but it also doesn't force desync:

```<code>#include <stdio.h>

__asm__(".intel_syntax noprefix\n"
        "array: .word 0x20, 0x20, 0x20, 0x20\n");

int main(int argc, char **argv)
{
    int x = 1;
    printf("%d\n", x);
}
</code>```

This will run but as expected array will live in it's own section:

```<code>0000000000001149 <array>:
    1149:   20 00                   and    BYTE PTR [rax],al
    114b:   20 00                   and    BYTE PTR [rax],al
    114d:   20 00                   and    BYTE PTR [rax],al
    114f:   20 00                   and    BYTE PTR [rax],al
</code>```

and while objdump translates this as code it is coincidence and isn't desync'd.

What am I missing to force this? I have been reading assembly directives and documentation for the better part of a day now and don't seem to be arriving at any better conclusions.

EDIT:

I have been able to get it to read data as code using the following:

```<code>#include <stdio.h>

int main(int argc, char **argv)
{
    asm volatile goto ("jmp %l[result]\n"
        :
        :
        :
        : result);
    asm volatile(".ascii \"\\x6a\\x20\\x89\\x7d\\xEC\\x38\\x67\\x20\" \n");

    int x = 1;
    result:
        printf("%d\n", x);
}
</code>```

```<code>0000000000001149 <main>:
    1149:   f3 0f 1e fa             endbr64
    114d:   55                      push   rbp
    114e:   48 89 e5                mov    rbp,rsp
    1151:   48 83 ec 20             sub    rsp,0x20
    1155:   89 7d ec                mov    DWORD PTR [rbp-0x14],edi
    1158:   48 89 75 e0             mov    QWORD PTR [rbp-0x20],rsi
    115c:   eb 0f                   jmp    116d <main+0x24>
    115e:   6a 20                   push   0x20
    1160:   89 7d ec                mov    DWORD PTR [rbp-0x14],edi
    1163:   38 67 20                cmp    BYTE PTR [rdi+0x20],ah
    1166:   c7 45 fc 01 00 00 00    mov    DWORD PTR [rbp-0x4],0x1
    116d:   8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
    1170:   89 c6                   mov    esi,eax
    1172:   48 8d 3d 8b 0e 00 00    lea    rdi,[rip+0xe8b]        # 2004 <_IO_stdin_used+0x4>
    1179:   b8 00 00 00 00          mov    eax,0x0
    117e:   e8 cd fe ff ff          call   1050 <printf@plt>
    1183:   b8 00 00 00 00          mov    eax,0x0
    1188:   c9                      leave
    1189:   c3                      ret
    118a:   66 0f 1f 44 00 00       nop    WORD PTR [rax+rax*1+0x0]
</code>```

But this feels like cheating to me because to any even novice reverse engineer the unconditional jump is completely obvious. Though now the code works and there's garbage data bytes being read as code...

ContentLicense: CC BY-SA 4.0

Title: Confusing objdump with data as code


问:
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:

```<code>jnb     short near ptr loc_1C61B1+3
</code>```

It order to do this I'm running a snippet like this in a script:

```<code>ida_bytes.del_value(loc_1C61B1)
idc.create_insn(loc_1C61B1+3)
</code>```

I've tried many variations on this including trying to auto wait for the analyzer using ida_auto.*_wait() functions, ida_auto.*_plan functions, deleting multiples bytes (ida_bytes.del_items), etc. but no matter what I do I cannot get the same analyzer outcome as if I ran the 2 functions above manually in the command bar. My guess is there's some race conditions happening with the analyzer.

How do I properly achieve the following in a script:

Undefine code at location x.

Give the analyzer enough time to do its things.

Make code at location x + y.

Get the same outcome as if I have done the steps manually.


问:
Passing a pointer to a pointer to a string with IDA Pro's Appcall
I need to call an encryption function in a program with the following signature (the second argument is returned):

```<code>char** __usercall decode(char** input, char** output)
</code>```

As far as I can tell, Appcall should be used for this kind of thing. There's an example given for functions that take pointers to character arrays, but there's no documented way to use functions that take pointers to pointers to character arrays.

How can I do this?


问:
IDA Pro don't understand address extension register in HC16
Source:

```<code>ROM:13A2 006                 ldab    #0Fh            ; Load B
ROM:13A4 006                 ldx     #0FA27h         ; Load IX
ROM:13A8 006                 tbxk                    ; Transfer B to XK
ROM:13AA 006                 ldaa    #55h            ; Load A
ROM:13AC 006                 staa    0, X            ; Store A
</code>```

Every time I see this, I must calculate in my mind, what it is storing to REGISTER_NAME with address 0xFFA27 (and also save all register addresses in my mind). For some reason, IDA ignores the register description in *.cfg with 0xFFA27 address and with 0xFA27 as well (I've tried that).

Can I setup IDA to generate something more human readable? Like

```<code>ROM:13AC 006                 staa    0, X                 ; Store A to 0xFFA27
</code>```

or

```<code>ROM:13AC 006                 staa    0, X ; REGISTER_NAME ; Store A to 0xFFA27
</code>```

Because 90% of my code consists of similar expressions.

PS I'm very new, so be patient please.


问:
Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly
I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login.

I get a prompt for username and I can type it in fine, however, the prompt for the password allows me to enter only the A-D0-9 characters and the space (capitals only).

If I change the kernel boot arguments so that init=/bin/sh, I get a bash shell, but I have the same issue. I can type in only the A-D0-9 characters and the space.

The strange thing is, I can enter the username fine and interact with the CFE Bootloader CLI interface perfectly fine.

It seems to me that the Linux kernel might be doing something weird with maybe the locale? Any ideas what I can check?

I have tried two different USB → UART TTL devices and I have the same issue with both.

Edit: I've also tried resetting the USB → UART TTL Adapter in between entering the username and the password or interacting with the bash shell. So it definitely has something to do with kernel state. Possibly an anti-tamper / protection mechanism??

EDIT: Looks like keymap.xml is completely empty. Could this be the cause?


问:
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage space available. The system is built around BusyBox.

However, to build the software, I need to set up a build environment that matches the CPU architecture, and this is where I come up short, as I am unable to find a kernel that I can use with QEMU. I did find one kernel, but it did not produce a compatible binary.

The only thing I know is what I get from cat /proc/cpuinfo:

```<code>processor   : 0
model name  : ARMv7 Processor rev 1 (v7l)
BogoMIPS    : 1594.16
Features    : swp half thumb fastmult edsp thumbee tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x4
CPU part    : 0xc09
CPU revision    : 1
CPU physical    :0

processor   : 1
model name  : ARMv7 Processor rev 1 (v7l)
BogoMIPS    : 1594.16
Features    : swp half thumb fastmult edsp thumbee tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x4
CPU part    : 0xc09
CPU revision    : 1
CPU physical    :1

Hardware    : Hisilicon A9
Revision    : 0000
Serial      : 0000000000000000
</code>```

I am unable to find the kernel image itself stored anywhere, which would make this a whole lot easier. So, what should be my next step? Anything else I can do to find the details I need to set up a good qemu dev environment?

I do have a setup based around the cortex-a9 and the vexpress-a9 machine, plus some kernel I found somewhere (can't remember where) and it is working to some degree. It's just that dynamically linked binaries won't work, even after patching it with patchelf --set-soname and patchelf --set-soname - I either get segfault or permission denied.

EDIT 1:

I did manage to find the kernel config. It's a bit too long to paste here, but are there any lines I should look for that should lead me on the right track?

EDIT 2:

I've managed to extract the busybox binary from the router. file busybox produces this:

```<code>ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /mnt/jffs2/app/output/ld-linux.so.3, for GNU/Linux 2.6.26, BuildID[sha1]=736041808c34871ed689d38e7cacfe18b1e65736, stripped
</code>```


问:
How to hack fan control speed?
So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a working software that is able to max it out.

So I have IDA on my disposal, I have Win32, C, C++, x86/-64 asm knowledge - Visual Studio 2022 Preview with C++ workload installed - where do I begin?

I tried numeral hacks (involving installing Acer gaming laptop tuning tool Predator control or something with simple WMI spoof), enabling "Cool Boost" in the registry for Quick Access, I tried Fan Control app from GitHub with different configs. Nothing budged though - the best I got is the rpm meter (in the Acer Predator control).

Title: How to hack fan control speed?


问:
Why does Hex-rays thinks that 32bit PE is 16bit?
I'm using IDA 6.1 32-bit version.

I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've looked at the header struct in a hex editor and confirmed that it has the PE header segment. When I dissassemble the file in IDA Pro, it recognizes that it is an x86 PE executable file.

Further, IDA produces the following output after analyzing the header segment:

```<code>; Format      : Portable executable for 80386 (PE)
; Imagebase   : 400000
; Section 1. (virtual address 00001000)
; Virtual size                  : 011DAC9D (18721949.)
; Section size in file          : 011DB000 (18722816.)
; Offset to raw data for section: 00001000
; Flags 60000020: Text Executable Readable
; Alignment     : default
; OS type         :  MS Windows
; Application type:  Executable 32bit
</code>```

However, when I select a function and attempt F5 to open the Pseudocode window, I am greeted with the unhelpful message:

Decompilation failure: FFFFFFFF: 16bit functions are not supported

Please refer to the manual to find appropriate actions

So, I referred to the manual, which is also unhelpful:

The message text says it all. While the decompiler itself can be fine
  tuned to decompile 16-bit code, this is not a priority for now. May be
  in the future it will support 16-bit code.

The thing is that this isn't 16-bit code. What am I doing wrong?

PS If I need to provide more information to help in answering this question, please let me know. I'm very new to IDA/Hex-rays and I'm not sure what else would be useful here.

ContentLicense: CC BY-SA 3.0


问:
There is a course in which they teach you to use WinAFL?
I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.</p>


问:
Unable to find the pci device mentioned in the processor datasheet
I have following intel processor 4th Generation Core Processor (Haswell U/Y).
I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I found that PMBASE is present at B:D:F 0:1:0. Here is the screenshot

The VID and DID of the device are mentioned below (from the same datasheet)

But, now when I am doing lspci from my linux machine, I am not seeing device 0:1:0. I have even checked with chipsec tool. Even there I am not seeing any device with device id 0x0c01.

Any reason why such discrepancy is there?


问:
Modify framework.dex which is in boot.oat?
I pulled down boot.oat from an API22 Android phone. It's Android 5.1 Lollipop which brought the change from Dalvik to ART and is a bit mistified.

As far as I understand, modifying boot.oat is not easy, and permanent, as this file is regenerated whenever a package installation is happening.

Now, I have a class which I need to modify (just a very tiny bit of it), which resides in framework.dex which was the part of boot.oat.

I have two questions:

How can I repack boot.oat? Taking into account that I haven't touch boot.art?

How can I make my change in boot.oat permanent? It's very well possible that I will install some new packages onto this system later, which will (might?) ruin my modification.

Thanks!


问:
Cannot load pdb in IDA Free 7.6
I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach.

I have just installed the last version of free IDA (7.6) on my Kali linux.
A have an .exe and .pdb. The exe is correctly loaded.

If I ask to load the pdb file, I have an error just after clicking on the button:

And in the output console:

Can someone help me please ?

I have tested with "root" user, same problem. Apparently the plugin is integrated to IDA now so no download is available.

Thanks

Title: Cannot load pdb in IDA Free 7.6


问:
Send file or non-printable character in Immunity Debugger arguments
I am a beginner in Reverse Engineering.

I am on Windows and using Immunity Debugger.
I would like to send my payload on the .exe file.
The payload contains non-printable characters.

How I can launch the process in Immunity Debugger with this kind of payload ?

I cannot attach the process separately: it crashes instantly with the payload and I want to know why in Immunity Debugger.

I am OK with other solutions if any.

Thanks!


问:
Unknown filesystem in GoPro Hero 9 firmware
I'm trying to extract the GoPro Hero 9's firmware to tweak some of the parameters. This is my first time doing any sort of reverse engineering but I'm hoping that by finding the filesystem I can update the constant and rebuild the firmware. Unfortunately, I haven't been able to identify the firmware's filesystem correctly. The firmware can be downloaded here: https://bit.ly/35JJlcc or here: https://community.gopro.com/t5/en/Introducing-GoPro-Labs/ta-p/603173 by clicking HERO9 Black at the bottom.

binwalk -e doesn't seem to result in any useful information, very similar to this post. Entropy analysis and browsing the hex dump seems to indicate the firmware isn't encrypted but I haven't been able to find any pointers to the underlying filesystem.

In the extracted binwalk -e files I did notice that it seems to find a romfs file, but I suspect this is a false positive based on the file size? I'm not sure where to go from here, would appreciate any tips to figure out the underlying fs.


问:
How to get symbol in IDA like done in BN code
I am converting BN code into IDA Pro and stuck at this point,
following are lines in the code which gives the symbol call

```<code>#####Get call symbol (if it exists)
dr.get_symbol(inst.tokens)
</code>```

and

```<code>####### NOTE: Might contain FPs. E.g., "call [ebx + 0x4]"
#####Extract call symbol if it exists
def get_symbol(self, token):
    token = [str(t) for t in token]
    if '[' not in token:
         return

start = token.index('[')
end = token.index(']')
symbol = ' '.join(token[start+1:end])
self.api.append(symbol)
</code>```

I want to convert the above code and want the following output in TXT file, but I am getting only strings and not in the register format like below.

Sample output:

```<code>---------------**

 ++++++ API Features ++++++
    APIs: ebp + 0x8  { arg2 };eax;ecx;ecx + esi;ebp - 0x18  { var_1c }

++++++ API Features ++++++
    APIs: ebp + 0x8  { arg1 };edi
</code>```


问:
Forcing Ghidra's decompiler to show unused stack variables
I'm reversing an ARM64 bootloader using Ghidra. The bootloader doesn't use the MMU and so works exclusively with physical addresses, which on this particular chip all fit in 32 bits (the memory map is only 4GB). As such, some peripherals' DMA address registers are only 32 bits wide even though the core is ARM64.

I've found that the decompiler omits important instructions for one particular function that deals with these registers. The function sets up some data structures on its stack and then loads a (32-bit) pointer to them into a DMA address register. Because the pointer gets truncated to fit in the register, though, Ghidra doesn't appear to recognize that the stack variables are ever referenced and so the decompiler output completely omits them!

Here's a demo in C with similar code flow (plus an extra hack to make it run successfully for pointers that don't fit in 32 bits). Compiling it with GCC exhibits the issue for me both on ARM64 (either with or without optimization) and on x86 (without optimization):

```<code>#include <stdio.h>
#include <stdint.h>

void print_stack_data(uint32_t addr_low) {
    uint32_t *ptr;

    // Infer the top half of the address from our own stack's location. This
    // is purely to make this demo work; in my real binary, the addresses in
    // question are physical addresses that are known to always have a top
    // half of zero.
    ptr = (uint32_t *)(((uint64_t)&ptr & 0xffffffff00000000) | addr_low);

    printf("%08x, %08x, %08x, %08x\n", ptr[0], ptr[1], ptr[2], ptr[3]);
}

int main() {
    // Some arbitrary data.
    uint32_t numbers[4] = {0x1234, 0x5678, 0x99999999, 0};

    // More operations, yay!
    numbers[3] = (numbers[0] << 16) + numbers[1];

    // Put the parameter into a new variable so that the compiler doesn't
    // just put the entire pointer into the argument register, which Ghidra
    // does understand.
    uint32_t numbers_low = (uint64_t)numbers;

    // Ghidra doesn't realize we're giving out a stack address here, so the
    // decompiler doesn't show all the previous operations on numbers.
    print_stack_data(numbers_low);
}
</code>```

Here's what Ghidra's decompilation for the optimized ARM64 binary looks like. Note that numbers isn't present at all:

Is there a way around this issue that doesn't involve patching the binary (which is what I'm currently doing)? Can I force the decompiler to treat a range of stack addresses as used, even if it can't see where they're used?


问:
use BinDiff to compare two chosen functions
Is it possible to use BinDiff to get the comparison score between two specific functions from the databases? By default BinDiff will automagically match functions, and then only output the comparison score between the function matches that it finds.

I have an a priora candidate function match [func_i from database A, func_j from database B] and I want to get the BinDiff comparison score of this pair.

Bonus points if this can be batched and run from the command line, where I can provide a list of function pairs and get the BinDiff comparison score for each pair.


问:
Extract smartwatch firmware bin file
I'm trying to extract files from a bin file that's the firmware of a smartwatch.
I tried using

```<code>binwalk -Mre firmware.bin
</code>```

but got no files, this is the result:

How should I extract/modify this bin file ?
This is the file link to check.

Title: Extract smartwatch firmware bin file


问:
Does anyone have any information about the file format of a .jdb2 (Jeb Decompiler's Project file) or how to fix one that is corrupted?
I have a .jdb2 JebDecompiler project file which is corrupted and JebDecompiler can not open it. Any information about .jdb2 file format could be useful for me in order to read data from it and even fix it. If you can share any information about this file format it would be highly appreciated.</p>


问:
How to change how the calculated value is shown for registers in Ghidra
I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly.  This is how the line looks in the listing:

add o3, o0=>DAT_00007d88, o0

and I would like it to look like this:

add o3, o0, o0=>DAT_00007d88

This is because the Sparc disassembly has the destination operand as the last register listed. The Instruction info looks like this, with calculated addresses always binding to the first instance of the register.

I'm currently working from a copy of the language spec, so modifying the pspec or cspec is no problem if that is what is needed to fix the issue.  The instruction here is just an example, but the issue is generic across the entire instruction set.

EDIT Larger code snippet:

```<code>   ram:00004d4c 17 04 b4 14    sethi     %hi(0x12d05000), o3
   ram:00004d50 96 12 e0 e8    or        o3, 0xe8, o3
   ram:00004d54 11 3b 4c 0b    sethi     %hi(0xed302c00), o0
   ram:00004d58 90 12 20 a0    or        o0, 0xa0, o0
   ram:00004d5c 90 02 c0 08    add       o3, o0=>DAT_00007d88, o0
</code>```


问:
is it possible to get code out of chipset through reverse engineering?
for example, encryption/decryption mechanism was inbuilt in a chip, to get the code that performs this mechanisms, is there some ways you can get this code through reverse engineering? what tools and techniques do I need to do this?</p>


问:
How do I view registers at a specific point of a binary's execution?
I have a binary that I'm attempting to reverse engineer to find a flag.  From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through memfrob to compare to the string that the user inputs.

I'm trying to either debug the binary to run until the point after the memfrob was called and the value is stored in a register to view its value or take the value from the assembly that I found and run that through memfrob in my own C script.

I'm having trouble finding an explanation on how to do it the first way and when I try to run memfrob on my own in C it tells me "implicit declaration of function 'memfrob'" but I am including string.h.

```<code>#include <string.h>
int main(void)
{

    char check[20] = {0x5f,
    0x40,
    0x5a,
    0x15,
    0x75,
    0x45,
    0x62,
    0x53,
    0x75,
    0x46,
    0x52,
    0x43,
    0x5f,
    0x75,
    0x50,
    0x52,
    0x75,
    0x5f,
    0x5c,
    0x4f};

    for (int i = 0; i < 20; i++)
    {
        printf("%x",check);
    }

    memfrob(&check,0x14);

    return 0;
}

</code>```

I'm not sure what the correct way to go about this is, but so far I've had no success with either.

I have also tried running it through things like CyberChef to decrypt the XOR42 from memfrob but that also ended up giving me nothing useful


问:
IDAPython: error executing init.py:
When I open Ida Pro 7.3 I see an error message

```<code>IDAPython: error executing init.py:
nothing to repeat

Refer to the message window to see the full error log.
</code>```

How can I understand what is the problem? in message windows I not see any problem.

I have python in PATH .and only 1 installation of python

Title: IDAPython: error executing init.py:


问:
I have a dos file/database that i need to extract into MS Excel or My Sql
I have a dos file/database(decades old) that I need to extract into MS Excel or My SQL.
I am using a MacBook.

The file appears to have no extension.

The file type I can see when I do "get info" after a right-click is, "kind: Unix Executable File".

when I hit the "file" command on my terminal, this is what I get, "Atari 68xxx CPX file (version 4143)."

I need to filter some data through this file/database, for example, print files with the title "XYZ".

Currently, I am using DOSBOX to do it. But it is manual, and I am only able to filter my files one at a time.

It would save hundreds of hours of misery if I could automate this process. I can code in java and javascript. I can also use MySQL. But I have no idea how to start on this problem.

It would be great if I could convert this dos database into excel or MySQL database. Or I could also write some java programs to do the filtering.

But I have little clue on how to approach this problem.


问:
dnSpy - change software value during run
Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy.

When I step-in dnSpy, the program get license information from another dll file. and the dll class are only have get; methods, when I want to set the value (write code in dnSpy) the main program give me an error.

Also when I step-in and the dnSpy get license information from dll file, I can see and change the value of license in Locals section, I can set activated flag value to true and run the program as activated. is there any way to save the changes during run? because as I said, I can't write code in dnSpy, I just want patch the exe file, not DLL. (as I found the activated program on internet, they only changes the .exe file, not dll's)

Note: The activated version of the software available on internet for free. The question is only for further study and research.


问:
How to print a manually defined struct in IDA pro while debugging?
Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members.

Now if i have the variables's address, how to tell IDA to print every member of the struct on that variable in the output window? I am using windbg to debug kernel using IDA.


问:
Need help with patching .plt function
I want to patch a .plt function but my friend told me I should use "xref" to find the real caller.

I found it and patched it, Will the .plt function execute?

The function start with PUSH {R4-R7,LR}

Title: Need help with patching .plt function


问:
Decrypting my router config backup file
so I have this ONT router/mode (ZTE F660) provided to me by the ISP, it's interface contains very little settings and I wanted to see if I can get anything useful from it's config backup file. The file generated has a '.cfg' extension and it is encrypted. Is there anyway for me to decrypt it? I tried RouterPassView but I the file wasn't even detected. Is there anything else I can try?</p>

Title: Decrypting my router config backup file


问:
Ida pro doesn't demangle all function names
I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are  symbols in the firmware and I know function names but Ida didn't manage to demangle all function names. I saw in the firmware ASCII string gcc2. Likely the binary was compiled using gcc2 compiler. There are a lot of important funcitons in the mangled form.

Help me out please. How Can I resolve this problem???

I tried to use idc.Demangle() func but unfortunately It can't demangle correctly.

P.S.
I found that c++filt utility works correctly


问:
Radare2 cannot open bin for writing
Im on Kali and im using Radare2 but it says

```<code>r2 -d bin
Killing child process 16151 due to an error
Killing child process 16152 due to an error
[w] Cannot open 'dbg://./bin' for writing.
</code>```

I tried chmod +x bin and I still get the same result, can someone help me, im still a beginnner

Title: Radare2 cannot open bin for writing


问:
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,

now its type is char[25] due to inclusion of hexademical string length. How can I force IDA to perceive Pascal-strings properly during their depiction in Hex-Rays pane? I want to see for all Pascal-string in corresponding window something like

```<code>LODWORD(v90) = ConcatenateStrings_R8_R9_to_RCX(v140, 255i64, "Could not access file \"", v158);
</code>```

I tried to change types via "Set item type..." as showed below.

Unfortunately, these options didn't help.


问:
Reversing Brother Sewing Machine Firmware
Context: Taking my first stab at reverse engineering, I am trying to install firmware intended for a machine sold in a different region (EAS) to my machine (US). I believe Brother sells the same machine (hardware) but firmware differs by region. Apparently there are some sort of verification mechanisms that prevents me from installing firmware not intended for this machine, and I want to figure out how to overcome this.

Now looking at the firmwares, I have believe that byte 0x38 0x39 0x3a 0x3b is denoting which machine can install this firmware, as these 4 bytes remained the same in an older version firmware. And byte 0x00 to 0x03 seems to be some sort of checksum, and 0x04 to 0x07 is the same sequence stored in reverse order, but I cannot figure out what that checksum is, how it is generated, or why it is stored again in reverse order.

EAS Firmware MCBNE0A107.upf (https://support.brother.com/g/b/downloadtop.aspx?c=as_ot&lang=en&prod=hf_inovnv180eas)

```<code>00000000: b495 7116 1671 95b4 436f 7079 7269 6768  ..q..q..Copyrigh
00000010: 7420 6279 2062 726f 7468 6572 2069 6e64  t by brother ind
00000020: 7573 7472 6965 7320 4c54 442e 0000 0000  ustries LTD.....
00000030: 0000 0000 0000 0000 2b02 0507 0000 0000  ........+.......
00000040: 0000 0000 0000 0000 0000 6b00 6600 ffff  ..........k.f...
00000050: 0000 0b00 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
</code>```

US Firmware MCBNM0A107.upf (https://support.brother.com/g/b/downloadtop.aspx?c=us&lang=en&prod=hf_lb5000eus)

```<code>00000000: a941 51d6 d651 41a9 436f 7079 7269 6768  .AQ..QA.Copyrigh
00000010: 7420 6279 2062 726f 7468 6572 2069 6e64  t by brother ind
00000020: 7573 7472 6965 7320 4c54 442e 0000 0000  ustries LTD.....
00000030: 0000 0000 0000 0000 2b01 0900 0000 0000  ........+.......
00000040: 0000 0000 0000 0000 0000 6b00 6600 ffff  ..........k.f...
00000050: 0000 0b00 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
</code>```

US Firmware (Old Version) MCBNM0A106.upf

```<code>00000000: 1a61 ab83 83ab 611a 436f 7079 7269 6768  .a....a.Copyrigh
00000010: 7420 6279 2062 726f 7468 6572 2069 6e64  t by brother ind
00000020: 7573 7472 6965 7320 4c54 442e 0000 0000  ustries LTD.....
00000030: 0000 0000 0000 0000 2b01 0900 0000 0000  ........+.......
00000040: 0000 0000 0000 0000 0000 6a00 6500 ffff  ..........j.e...
00000050: 0000 0b00 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
</code>```

I tried setting the first 8 bytes to 00 and doing CRC32 on the entire firmware, but it didn't seem to match. Again I am clueless on how a firmware is generally written or how a checksum is generated. Any hints would be appreciated!

And I don't know if I need to temper with the remaining sections of the firmware.

```<code>//content list?
00000100: 626f 6f74 5f52 656c 6561 7365 2e62 6c00  boot_Release.bl.
00000110: 0100 0000 87b4 49f9 0000 0084 0000 0200  ......I.........
00000120: 7570 6730 2e70 7267 0000 0000 0000 0000  upg0.prg........
00000130: 0200 0000 65c9 ad0f 0000 0684 0000 0800  ....e...........
00000140: 7570 6730 2e64 6174 0000 0000 0000 0000  upg0.dat........
00000150: 0300 0000 9659 c760 0000 0e84 f842 0100  .....Y.`.....B..
00000160: 7570 6731 2e70 7267 0000 0000 0000 0000  upg1.prg........
00000170: 0200 0000 4919 e011 0000 1084 0000 0800  ....I...........
00000180: 7570 6731 2e64 6174 0000 0000 0000 0000  upg1.dat........
00000190: 0300 0000 9659 c760 0000 1884 f842 0100  .....Y.`.....B..
000001a0: 6d61 696e 2e70 7267 0000 0000 0000 0000  main.prg........
000001b0: 0700 0000 2e84 1dab 0000 0000 00c2 0200  ................
000001c0: 7061 6e65 6c2e 7072 6700 0000 0000 0000  panel.prg.......
000001d0: 0600 0000 d26e 5bd4 0000 1a84 e4bc 2200  .....n[.......".
000001e0: 4d32 436f 6d44 6174 612e 6461 7400 0000  M2ComData.dat...
000001f0: 0800 0000 06ab 8518 0000 8084 ac56 5300  .............VS.
00000200: 666f 6e74 4461 7461 4352 4f4d 2e64 6100  fontDataCROM.da.
00000210: 0500 0000 1094 9227 0000 a085 0000 4400  .......'......D.
00000220: 416c 6c5f 4461 7461 5f43 4d42 5f4e 4500  All_Data_CMB_NE.
00000230: 0900 0000 2182 1978 0000 fe84 0001 0000  ....!..x........
00000240: 7044 6174 5f43 4e45 4d30 2e64 6174 0000  pDat_CNEM0.dat..
00000250: 0a00 0000 fe65 727b 0000 0085 58a2 2d00  .....er{....X.-.
00000260: 1000 ffff 0000 0000 0000 0000 0000 0000  ................
00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
...
// start of executable?
00000750: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000760: 0000 0011 0000 0013 0000 d025 0000 d825  ...........%...%
00000770: 0000 f025 3c08 3141 4088 6000 0000 0000  ...%<.1A@.`.....
00000780: 0000 0000 4080 6800 0000 0000 0000 0000  ....@.h.........
00000790: 4008 8000 3c09 7000 0109 4024 3c09 00c0  @...<.p...@$<...
000007a0: 3529 8003 0109 4025 4088 8000 0000 0000  5)....@%@.......
000007b0: 0000 0000 0000 0000 3c0a bd51 8d4a 0000  ........<..Q.J..
000007c0: 3c0b 0010 014b 5024 3c0b 0010 114b 0007  <....KP$<....K..
</code>```

From a teardown video on Youtube the machine has a ETON ET866 E213441 motherboard if that means anything.


问:
I attempted to read from an Intel 87C54 microcontroller and it came up all FF's. Any way to read from this?
I'm using the popular TL866II Plus programmer to read from the chip. I see in the datasheet that it has lock bits which can disable the verify (read) function, but I'm not sure if that causes an attempted verify to yield all FF's, or if it would give an error of some kind.

In the situation where the lock bits are in fact set, is there any known way to bypass them and dump the firmware from the chip? Keep in mind, this chip came from a very rare board, and that chip is the only copy I have of the program, so I don't want to risk erasing it.


问:
How I can interface the MCU without soldering?
My router has the following pin layout between flash memory and MCU:

The big chip is the MCU from a Sercomm H300s router.

What I want is to analyze the signaling between 2 chips using the most accessible pins in the MCU. But I also want to avoid soldering.

How I can interface the big chip without soldering?
Would clamps such as these ones or this ones do the job?

Also, how I can record any binary data exchanged between MCU and Flash memory chip in my computer, do I need a bus pirate or a logic analyzer?


问:
Trying to decrypt the output from a BLE scale
I'm trying to decrypt the readings from a BLE scale, which seems to be transmitting readings in the manufacturer data.

Here are a few readings using python bleak library to scan device advertisements:

#no weight on scale:

b'\x0f\x05\x02\x00\x00\x00Z\x00\x02\x00P\xfb\x19\x87\xd1Q\xf5'

#scale reads "19.90g":

b'\x0f\x05\x02\x00\x07\xc6Z\x00\x02\x00P\xfb\x19\x87\xd1Q4'

#scale reads "53.92g":

b'\x0f\x05\x02\x00\x15\x10Z\x00\x02\x00P\xfb\x19\x87\xd1Q\xf0'

#scale reads "21.18g":

b'\x0f\x05\x02\x00\x08FZ\x00\x02\x00P\xfb\x19\x87\xd1Q\xbb'


问:
Procyon vs CFR for Java Decompiler
I'm trying to find the best Java class decompiler thats the most reliable. What's the difference between Procyon and CFR as far as decompiling the most classes sucessfully?</p>

Title: Procyon vs CFR for Java Decompiler


问:
How do relocations work for imported functions in SH4 ELF?
I build very simple hello world code with sh4 gcc compiler as shared library:

```<code>#include <stdio.h>
void hello()
{
    printf("Hello world!\n");
}
</code>```

But when I load .so file into the disassembler(IDA or Ghidra), I can't actually find where puts is being called. Even though hello() function exists:

But at the point where it should actually call printf/puts there's some address load operation which points to non existing address:

I can see puts in the import section, but there's no code that references besides some data reference from .LOAD section.

Nevertheless case I build the code as the executable, not the shared library. puts thunk becomes visible among the functions:

As if import thunks are not propagated for shared libraries, but propagated for the executables.

I've tried to find the issue myself so I ran readelf on both binaries. And it appears that it depends on relocation data. Here's executable file dump:

```<code>'PLT' relocation section at offset 0x4002d0 contains 48 bytes:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
0041103c  000002a4 R_SH_JMP_SLOT     00400380   puts@GLIBC_2.2 + 0
00411040  000001a4 R_SH_JMP_SLOT     00000000   __gmon_start__ + 0
00411044  000005a4 R_SH_JMP_SLOT     004003b8   __libc_start_main@GLIBC_2.2 + 0
00411048  000003a4 R_SH_JMP_SLOT     004003d4   abort@GLIBC_2.2 + 0
</code>```

And here's how it looks for shared module:

```<code>'PLT' relocation section at offset 0x364 contains 36 bytes:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
00011010  000001a4 R_SH_JMP_SLOT     00000000   __cxa_finalize@GLIBC_2.2 + 0
00011014  000003a4 R_SH_JMP_SLOT     00000000   puts@GLIBC_2.2 + 0
00011018  000004a4 R_SH_JMP_SLOT     00000000   __gmon_start__ + 0
</code>```

Sym.Value is zero, and both Ghidra and IDA fails to determine where the thunks point. So the question are:

What is so special about shared modules, that Sym.Value is zero?

How do the import thunks are propagated when the OS load so file?

Is there any way to map the imported functions into such thunks to make them have appropriate names in IDA or Ghidra?

The way the shared library was built:

```<code>sh4-linux-gnu-gcc -c -g -fPIC hello.c -o hello.o
sh4-linux-gnu-gcc hello.o -shared -o libhello.so
</code>```


问:
parallel NAND flash dumped with dd mtd0-12
Hi hope some one can help i have tried dumping nand on a system in u-boot with the dd command so i have mtd0-12 but have now messed up bootloader now i have non booting device/brick. i have tried jtag but was a no go atm. i am new to Linux so is there any way of converting mtd0-12 to one bin file so i can flash nand off of the pcb or will i have ecc problems any input is welcome thank you.</p>


问:
Decoding Game data
I am very new to this whole business so please bear with me.

Goal: Am trying to decode data from a post request from game to server starting with Q0.
Most of the game data is encoded in Base64, but the data i'm looking for seems to have another layer of encryption/decoding

So far i've played around with Burp Suite, various online decoders, but no luck yet.
if anyone recognises this format, please advise how to decrypt/decode it.
Thank you very much!

Example:
Q0NaIQAAAAIAAAAAAAADBXicbVE9SwNBFNzNfiWBcM2hGFJbKFhpk8ITC0Es/AZjI9YpLAQVYqNFAvkFYiAJdmIKUTBYWFmIgsHGKhYqBCxsg1Zq5jbvuGAWFvbNvJmdt7vO7Ip3tlOaPTSSR2JaxdXKfat8kTqrLXlyvNicPtnM/FaT1dw773KowaEHvOW4AAc86JcWQx+wx+HtOldK4gxsJJ1KgA/j0PfgXju9ZyRjiktXtX92m2B3no5vyaWVaSS4riznjWBMCsEjXuHzAexHazTPuzUUVMMBStTMnC80TAdUQkaDZOhGgvAUlM5ijnKu51779k9NFJ+RJaqVq9ABBh30XpcV95TmDXMW5wJ4D9a9DRj9CXTZ8swiXoWSUArM53Md L9IFmFed3EA6zW7mj2o4xaLa+lMWmiq3/zbG1dA/f9zvc9L601z+f2k38CINOP9u7fR4kc5mdftmsLq4yjbXvsM45vEzaKW+kqtZ+NCc4P0sg4WrAxNhTLCtl1IdJ8kGxF3NcGD++gNkSTkw

Title: Decoding Game data


问:
How to reverse android native libraries? Best resources?
I want to improve myself in Android penetration testing. For this task i need to learn reversing the native libraries of an APK file to detect vulnerabilities. What is the best way and resources for my task?</p>

OwnerDisplayName: Commodus


问:
What is .pb file format?
TL;DR: What file format is this  (if it's not a private file format) and how do I parse it?

Before I say anything, I want to say that I am new to reverse engineering and StackExchange.

I am trying to reverse-engineer the Yandex iOS app's call blocking function. I know how the iOS call blocking API works and I know that, in summary, the app gives the system a list of numbers and the action to do with them — there is no code ran by the app when a call comes in, and it never even gets to see incoming phone numbers. My end goal is to then write a privacy-conscious version of this for my Android phone (yes there is an Android version of the app, but it requires you to set it as the device's assistant, allowing it to see the phone's screen, notifications, calls, etc.)

I have put the app in a MITM proxy and found this URL it was downloading the phone database from: https://storage.mds.yandex.net/get-cid-offline/1995371/cid.full.large.ru.1.1633994274.pb.gz After extracting, I get a .pb file. If I look at it in a text editor, I can see the messages for the phone numbers, like scam likely, delivery driver, company names, etc. But the actual phone numbers are encoded in a binary format.

It's not SQLite, and it's not encrypted, 010 Editor incorrectly recognizes this as a "TensorFlow Model" format and shows nothing. file command just says "data" (I assume unknown file format). I'm thinking it's a custom file format, but I am not sure. Can someone please explain to me how to parse this file, or even how to convert this file format into something like JSON or XML? Thank you in advance

Title: What is .pb file format?


问:
How to derive a state diagram from existing source code
to;dr; What tools or smart method can I use to derive a state (transition) overview from source code with 10 binary and three 16-bit input variables, and several output variables, both 16-bit and binary. All input variables can change with every 33ms execution of the source, which has several hidden states.

Background

I have been tasked to write a functional description of a 20+ year old embedded product. The source code is available, but is written in a long forgotten language, resembling basic.

The source itself is written in an extremely naïve way, with hundredst of long if statements, and no function calls at all. All internal variables are global.

Attempts

I quickly lost track of attempting to make sense of the source code, which is running in a never ending 33ms loop, and variables are used and modified anywhere in the 1000+ lines of code.

I decided to try to emulate the entire hardware, and due to the simplicity of the code, it turned out to be very simple to convert to python. I'm now able to predifine some timed changes in the input variables then execute the code for a number of simulated seconds, generating a number of output lines with the end result of each 33ms execution.

The emulated approach is working, but I need to spend a very long time to craft the timed inputs based on the generated output. I've currently identified at lease 16 major states, each treating the other inputs differently.

The question

How can I do this smarter, preferable automated.


问:
Does loading custom PDB help reversing behemoth program?
```<code>What I reverse :
    Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost.
    It(they) has the mixtures of their custom structures, classes and directX sdk classes.

What I did with an IDA:
    Clumsy way - find some functions(subroutines) do some roles in gameplaying.
    Searching - find some structures which helps analyzing their settings.
    Class informer - Helped a lot finding class hierarchy but was no use without knowing size of class member.
</code>```

Question :

I am currently trying new way: compiling old directX sdk examples with old compiler(vc++ 2008) to extract symbols for helping reversing. The RTTI clues say that the game uses directX classes(DxSurface, DxImageBase...) So I think it will help organizing classes from the bottom.

1-1. For acquiring vtable and struct info of compiled directx class, I planned to compile some sample codes with directx library.

1-2. With compiled PDB symbol, I expect to measure the size of some class, and more precise class information(that the class will implemented into struct and struct_vtbl).

1-3. After successive 1-2, I'll apply this result to original project, reversing the old game.

Does this plan valid for reversing the game?

I did the way mentioned above with libjpeg, but the compiled function call was usercall and the one in the actual game use cdecl call. How can I change calling convention in a whole project?


问:
Decompiled VB 6.0 Application Call Statement
I decompiled a VB application using VB Decompiler pro. It contains the following call statements:

```<code>Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98))
</code>```

Can you please explain what does this call do?


问:
Starting out with reverse engineering. What assembly is disassembled code
I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it really differs from what I see in the disassembled code (for example in IDA Free).

What kind of assembly is disassembled code of an exe or DLL?


问:
Bypassing unsupported android TV box!
I have an android TV box called Proximus decoder v4, anyway the android TV box is not supported anymore by the company. When I turn it on I get an update checking, you can't even cancel it, and then I get an error message update has been failed because like I said the decoder v4 it is not supported anymore, then the device restarts and goes into a loop, also the device opens 3 ports one of them is ssh, but all ports are closed! Which means I cannot connect to the device using any of these ports! Anyway, my intention is to bypass the update somehow and access the device menu! Anybody has any idea what can I try?

If you need more information, let me know!

Sorry English not my first language!

Title: Bypassing unsupported android TV box!


问:
How to deobfuscate Java application
Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe

I tried

dumping the classes using a dumper javaagent

deobfuscate the jar with java-deobfuscator

threadtear functions

sample:

Title: How to deobfuscate Java application


问:
Int64 parsing from args in Frida-trace for iOS binaries
I'm using frida-trace to log some methods and I've come across the following.

```<code> onEnter(log, args, state) {
    log(`-[Somefunction somefield64:${args[2]}]`)
 }
</code>```

somefield64 returns what I believe to be an int64 like 0x81008d000101e7.

I'm not sure how to see the value behind this, all read methods (readU64/S64) complain it's not a valid address (access violation), so I assume I need to change the format.

Looking at the method in a disassembler and its references show it just takes a string like

```<code>extern _some_field_constant
</code>```

with the call as

```<code>[Somefunction somefield64:**_some_field_constant]
</code>```

So I know how to get to the constant with

```<code>Module.getExportByName('SomeModule',"_some_field_constant")
</code>```

And I can see the address.

I'm just not seeing the reference to how to retrieve the field from args[2] via frida-trace.

I had a similar method with similar functionality (no int64) returned a __NSCFConstantString and just managed to do

```<code>onEnter(log, args, state) {
    log(`-[SomeOther someField:${args[2]}]`);
    log(ObjC.classes.NSString.stringWithString_(args[2]))
}
</code>```

What do I need to do (or read in terms of technical documentation, excuse my incomplete understanding/explanation for experienced reverse engineering folks out there) to parse the int64 into a NativePointer so I can get the address in memory.


问:
Can't Find hex Value from X64dbg in hex editor
I want to make a simple patcher for exe , so here is the original hex value from the x64dbg before any modify :

I took the hex value and searched for it in the hex editor ,but can't find any .

So why is that ?

Note: the app is vmprotect

Regards


问:
What is the correct argument for the disassembled function / constructor?
I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised just as a particular object type, i.e. Game. But the constructor expects (according to the decompiler) pointer to that object, i.e. Game * this.

So, is there a standard way the constructor is called in situation like this?
And what should be there in this case, the object or a pointer to it?

I am trying to see currently what would make the program run, as it is currently failing. Which might be because the way I have setup the constructor is not right.

Here is the calling function:

```<code>int main(int param_1,char **param_2,char **param_3)

{
  int iVar1;
  Game local_68 [96];

  gladius::Game::Game(local_68);
  iVar1 = gladius::Game::main(local_68,param_1,param_2,param_3);
  gladius::Game::~Game(local_68);
  return iVar1;
}
</code>```

And here is the constructor I am interested in:

```<code>Game * __thiscall gladius::Game::Game(Game *this)

{
  *(undefined8 *)this = 0;
  *(undefined8 *)(this + 8) = 0;
  *(undefined8 *)(this + 0x10) = 0;
  *(undefined8 *)(this + 0x18) = 0;
  *(undefined8 *)(this + 0x20) = 0;
  *(undefined8 *)(this + 0x28) = 0;
  *(undefined8 *)(this + 0x30) = 0;
  *(undefined8 *)(this + 0x38) = 0;
  *(undefined8 *)(this + 0x40) = 0;
  *(undefined8 *)(this + 0x48) = 0;
  *(undefined8 *)(this + 0x50) = 0;
  return this;
}
</code>```


问:
The way to determine how the decompiled constructor is structured
I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I don't know in what exact order those functions were there originally.

So, is my interpretation correct or / and there should be a different approach to disassembling structures like this?

Decompiled Game constructor / class:

```<code>Game * __thiscall gladius::Game::Game(Game *this)

{
  *(undefined8 *)this = 0;
  *(undefined8 *)(this + 8) = 0;
  *(undefined8 *)(this + 0x10) = 0;
  *(undefined8 *)(this + 0x18) = 0;
  *(undefined8 *)(this + 0x20) = 0;
  *(undefined8 *)(this + 0x28) = 0;
  *(undefined8 *)(this + 0x30) = 0;
  *(undefined8 *)(this + 0x38) = 0;
  *(undefined8 *)(this + 0x40) = 0;
  *(undefined8 *)(this + 0x48) = 0;
  *(undefined8 *)(this + 0x50) = 0;
  return this;
}
</code>```

My version, game.h:

```<code>namespace gladius {
    struct Game {
        //virtual int __thiscall main(gladius::Game* thisptr, int param_1, char** param_2, char** param_3);

        using GameConstructor = Game * (__fastcall*) (Game* thisptr);
        GameConstructor gameConstructor;

        using GameMain = __int64(__fastcall*) (gladius::Game* thisptr, int param_1, char** param_2, char** param_3);
        GameMain gamemain;

        using Initialize = void(__fastcall*) (gladius::Game* thisptr, int a2, char** a3, char** a4);
        Initialize initialize;

        using Quit = void(__fastcall*) (gladius::Game* thisptr);
        Quit quit;

        DWORD_PTR* guiObjPtr = 0;

        DWORD_PTR* unknownPtrA = 0;

        DWORD_PTR* unknownPtrB = 0;

        DWORD_PTR* unknownPtrC = 0;

        DWORD_PTR* unknownPtrD = 0;

        DWORD_PTR* unknownPtrE = 0;

        DWORD_PTR* unknownPtrF = 0;
    };
</code>```

The game.cpp looks like this:

```<code>#include "game.h"

namespace gladius {
    static std::array<Game, 1> functions = { {
            // Steam
                Game{

            (Game::GameConstructor)(AddressHelper::getInstance().GetBaseAddress() + 0x331b0 / (2 * sizeof(DWORD))),

            //  (Game::GameMain)0x140039ea0,
            (Game::GameMain)(AddressHelper::getInstance().GetBaseAddress() + 0x39EA0 / (2 * sizeof(DWORD))),

            //(Game::Initialize)0x140033e20,
            (Game::Initialize)(AddressHelper::getInstance().GetBaseAddress() + 0x33E20 / (2 * sizeof(DWORD))),

            //(Game::Quit)0x14003a0e0
            (Game::Quit)(AddressHelper::getInstance().GetBaseAddress() + 0x3A0E0 / (2 * sizeof(DWORD)))
         }

    } };

    Game& get()
    {
        return functions[0];
    }
}
</code>```

As per discussion in comments, how to change the above game.h and game.cpp files to make a proper constructor for my Game structure?

The way I do it now is:

```<code>    gladius::Game gameObj;

    gladius::Game::Game(gameObj);
</code>```

And the element of that object can be accessed this way: gameObj.guiObjPtr

But apparently gladius::Game* thisptr1 = &gameObj;

is not equivalent to gladius::Game* thisptr, which is passed to the hooked function.

I.e. thisptr is initialised properly with all of the addresses and thisptr1 is not accepted by the member functions.

And that is strange considering that the way the hooked function is called is simply this:

```<code>  Game local_68 [96];

  gladius::Game::Game(local_68);
  iVar1 = gladius::Game::main(local_68,param_1,param_2,param_3);
</code>```

Where local_68 is essentially the new gameObj. It is passed to main as a pointer somehow and that part I don't understand.

And the way how the hooked function signature looks like this:

```<code>__int64 __fastcall gamemainHooked(gladius::Game* thisptr, int param_1, char** param_2, char** param_3)

</code>```


问:
How to decrypt/decode the strings found in desktop application with x64dbg?
I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably encoded or something like that.

I'm searching for a string: OK! Expires:

Is there a way to decode them so they became readable ?

Here is what I got so far by search for a string references in All modules:

I tried to start debugging, which was working today, but now suddenly it denies to work. Each time I attach the running app, it gives me an error (I've censored the application name for some reason):


问:
Passing a String into a Function With GDB
So, I have a function with the prototype according to GDB:

```<code>{std::string (std::string)} 0x56027729e545
     <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >)>
</code>```

and I would like to pass a string into it using GDB. To attempt this, I've used the following GDB commands to create a new string on the heap.

```<code>set $mystr = (std::string*) malloc(sizeof(std::string))
call $mystr->basic_string()
call $mystr->assign("foobar")
call (std::string) function(*$mystr)
</code>```

In the last line, I am getting the error

```<code>Couldn't find method std::string::std::string.
</code>```

Any ideas?

Unfortunately, I can't modify the code to fix this.


问:
Call stack in Windbg address with no modules associated
I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out.  Coming back to this problem, I figured I'd go back and use Windbg to help me with this.  I think I am on the right track.

Using Windbg and showing the call stack, I don't understand a few lines that do not have addresses not associated to any known modules in the lm list.

For example:

```<code>...
2a 0017ce64 61500ad3 cxt+0x3280ad3
2b 0017ce98 61500ad3 cxt+0x32c0d8e
2c 0017d500 0f026cf0 0x168d6f12
2d 0017d56c 168d094f 0xf026cf0
2e 0017d5a8 6154b791 cxt+0x32cb781
...
</code>```

From lm it shows a list of available modules, amongst which cxt is there with base image.  But the address listed in frame 2c and 2d don't belong to any particular module.  There are similar lines further down in the call stack.

I don't have the symbols available. I doubt this is the issue since a module has a base image and a size (and thusly an ending address).  If the two strange addresses don't belong to the range within the module in memory, it isn't part
of the module.  (I would think).

There's a lot of knowledge I'm missing, so I appreciate if someone can enlighten me as to what I'm missing.

Thanks!

Ed


问:
Hopper Disassembler AArch64 assemble instruction syntax error

As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error".

At this moment I can only change it by editing the instruction encoding in hex view as a workaround.

Any idea?


问:
Video Packets via UDP - How to decode or identify video format?
I'm working with a cheap wireless video transmitter and receiver system that uses an Android App to receive the video over WiFi.

We want to be able to identify where the stream is coming from to be able to play it in VLC or some other desktop player from a laptop.

After some digging - I've discovered that there are UDP packets being sent from the wireless transmitter to the connected device after an initial packet is sent.

So a UDP socket opens on port 9000 and the device can start receiving UDP packets which are sent in large volumes (I couldn't find any other kind of activity so I'm presuming that this is the video stream).

Node.js code to receive this below:

```<code>    var server = udp.createSocket('udp4');
    server.on('message',function(msg,info){
      console.log('Data received from client server: ');
      console.log('Received %d bytes from %s:%d\n',msg.length, info.address, info.port);
    });
    server.bind(9000);
</code>```

This will get a list of UDP packets appearing in the Node console. And I can see them in Wireshark.

Things I've already tried:

Various FFMpeg commands on the UDP address.

Playing the UDP address in VLC directly.

Wireshark just identifies them as UDP packets, but the dump of hex + ASCII is below:

```<code>0000   9c da 3e f8 24 51 44 01 bb 62 7b 3f 08 00 45 00   ..>.$QD..b{?..E.
0010   05 7a 57 57 40 00 40 11 44 5e c0 a8 0c 01 c0 a8   .zWW@.@.D^......
0020   0c 6c 23 28 23 28 05 66 c7 1f 80 60 dc eb 30 f6   .l#(#(.f...`..0.
0030   f8 58 00 00 00 0a 1c 00 b6 a4 25 c8 e2 80 c8 ac   .X........%.....
0040   42 35 79 1d 32 28 f3 20 86 0c eb ff fb c9 85 06   B5y.2(. ........
0050   84 e4 cd 82 30 d9 4d bc 20 a1 04 cd bf f6 db ed   ....0.M. .......
0060   91 46 8c c9 82 e9 0c 98 5c 28 3f ff f0 f7 59 09   .F......\(?...Y.
0070   04 cc 35 9c 3c b8 14 24 11 01 e5 a9 f4 fe df b4   ..5.<..$........
0080   a4 84 ce 6c 57 0a f8 20 e0 28 c7 27 e7 c4 30 be   ...lW.. .(.'..0.
0090   fb df c0 3a 41 7e bb 8a cb 92 e6 2d ec 76 9f 76   ...:A~.....-.v.v
00a0   ff 71 fa 5e 22 f7 ae af 04 df fd 80 32 39 5b 20   .q.^".......29[
00b0   00 67 01 af f9 fe 45 d8 12 bc 9c be 14 57 bb a7   .g....E......W..
00c0   c1 fd dc 7e 0b df ff b8 ad 70 97 f3 f0 a9 20 42   ...~.....p.... B
00d0   b2 1f 5b 7a d7 c9 d3 ee 59 95 c7 5f fe 84 65 f4   ..[z....Y.._..e.
00e0   8b 9e d3 dc a9 a9 a8 b4 9b ed 0b 35 b3 6e df 8b   ...........5.n..
00f0   dd dc c4 38 db a1 a4 24 07 73 24 04 2a 4e 49 80   ...8...$.s$.*NI.
0100   6f 28 6a 90 40 90 40 18 3a 34 ff ff fd 9b d8 2c   o(j.@.@.:4.....,
0110   e3 3a ce 0b 68 17 62 30 48 02 b4 4c 0f 43 7e 83   .:..h.b0H..L.C~.
0120   76 d0 71 e1 c3 a9 44 fe 22 b2 08 d1 95 7e 09 2c   v.q...D."....~.,
0130   c5 81 57 d6 b5 b3 80 5a 4d 83 8c 1c 6d 1c 79 be   ..W....ZM...m.y.
0140   ae 9b d2 2e 71 85 15 fe f7 89 50 4b 3c 21 df d7   ....q.....PK<!..
0150   de 15 24 27 6a 97 d6 bf fd 09 92 09 df 5b 49 b6   ..$'j........[I.
0160   f6 ff ff f9 fe 40 50 7c 81 7e ee e9 7d 0a 61 10   .....@P|.~..}.a.
0170   43 bb 5f ff 7b f7 ff 09 3b 84 8a be dd ba 61 45   C._.{...;.....aE
0180   7d ee c8 50 90 10 f4 bb 1f fe 9f ca 14 70 64 d0   }..P.........pd.
0190   7f fd 74 f2 3a 88 72 7a 93 15 91 7f ff f2 02 1f   ..t.:.rz........
01a0   04 8b 5d b6 b5 ac c0 cc 2d 26 86 50 38 50 8a c5   ..].....-&.P8P..
01b0   e5 73 cc 18 e8 15 1c 0c c0 f5 f9 d5 2a 65 69 d2   .s..........*ei.
01c0   0b c4 a9 1a f0 62 7d 9f b8 03 50 f5 d3 6c 39 c5   .....b}...P..l9.
01d0   2b 1f 78 cb 6c f6 f7 8c 2d de e5 c9 c0 b0 91 0d   +.x.l...-.......
01e0   4a cb 97 ad d3 77 77 cf 1d 88 c0 7c 9a 46 3a 74   J....ww....|.F:t
01f0   22 38 a0 c8 e2 1e 47 15 93 88 fd 10 48 4e 08 23   "8....G.....HN.#
0200   cb 49 8f d0 a4 89 48 ae 4e f9 15 c9 8e a1 90 90   .I....H.N.......
0210   36 c9 01 04 81 9f 93 bf 85 3d 02 84 19 6c 65 5b   6........=...le[
0220   ef d3 6f 34 85 3a 25 0f 21 46 73 7e dd bd fa ff   ..o4.:%.!Fs~....
0230   81 8a 57 b0 98 d6 ff 3f 08 61 10 22 ac ff ee fc   ..W....?.a."....
0240   98 60 06 4c 7a 4e 76 86 c4 5a 37 5d fe b4 ba 53   .`.LzNv..Z7]...S
0250   e6 74 d2 d9 9b d2 ba 54 b4 f7 e1 12 1c 11 93 28   .t.....T.......(
0260   b3 ff de ff ff fb 04 16 f7 13 a4 fd 33 9a 6e 2a   ............3.n*
0270   93 42 86 6f 6f 6f 36 7f c7 a7 c8 86 f7 be 19 7a   .B.ooo6........z
0280   ef ad a2 30 c3 23 cb d1 20 28 c8 eb 20 19 a2 4a   ...0.#.. (.. ..J
0290   59 f6 6d dc 2c e5 ed 77 dd e1 f8 a5 0e bb 13 d3   Y.m.,..w........
02a0   77 bc 45 26 55 8c 62 48 76 da 47 0c 52 02 18 01   w.E&U.bHv.G.R...
02b0   d7 96 33 71 f5 d7 fa ac dd b0 a2 80 0b bf a3 21   ..3q...........!
02c0   a0 b6 fd dd cf 41 9f f4 64 cf 7f a6 de fc bd fd   .....A..d.......
02d0   1e 0e b5 77 97 b7 ea 6c cb 7b bd 7f 68 7f 90 46   ...w...l.{..h..F
02e0   7f 36 76 d5 cc 37 1d 42 ac c0 20 3d 65 57 df f7   .6v..7.B.. =eW..
02f0   f5 b5 21 c3 40 00 a3 53 fb d4 d9 df 34 c4 d1 9c   ..!.@..S....4...
0300   f5 37 34 f2 b3 4c 9c aa cf c5 f2 e5 13 a5 48 61   .74..L........Ha
0310   ef fa 3d 1c ac 79 b2 a6 d9 97 08 c6 b6 e8 0d 17   ..=..y..........
0320   1a 43 3f 3d 3e ea d7 a5 d3 6d 32 b0 ba 7f 9f e1   .C?=>....m2.....
0330   76 9d fc 29 0f d0 22 eb 8b 99 fb cd 71 e6 de 78   v..)..".....q..x
0340   2f 7d f4 de ab ac 67 87 2e 93 59 72 fd d1 5e ec   /}....g...Yr..^.
0350   0c ce 78 44 84 00 8c d6 f6 6b 72 2b bc 69 45 7b   ..xD.....kr+.iE{
0360   7b 80 f1 0f d7 29 df 4a ef 97 16 d2 ae db 88 72   {....).J.......r
0370   2f 67 31 3a 77 7f 77 74 da e6 e0 26 08 01 ae 18   /g1:w.wt...&....
0380   3d 6e 4d eb db df 80 47 c6 8d b2 0a 96 a7 2b df   =nM....G......+.
0390   7f d0 a2 80 1a ed 21 fd 1f 97 f6 ff f9 57 c6 1a   ......!......W..
03a0   5a 39 05 5a 5a 56 f5 f3 d7 f0 03 cd 06 75 85 eb   Z9.ZZV.......u..
03b0   5a 8b 16 3f 0f c0 f3 20 27 f4 e9 bf 0f f5 3f 89   Z..?... '.....?.
03c0   bf ee bc 8e 08 8a 1d b0 ae 7e 23 04 25 75 4f 22   .........~#.%uO"
03d0   86 46 42 62 1c 26 06 f6 80 51 c0 31 a1 b5 67 f7   .FBb.&...Q.1..g.
03e0   fb de f9 10 70 f0 0c 12 f4 db 9f 6d 37 f6 d1 8e   ....p......m7...
03f0   aa 7a 4d 82 81 d2 ed 8f 29 b7 29 a4 ee 9d 58 7a   .zM.....).)...Xz
0400   a2 c9 97 a5 07 1a 20 18 76 23 a7 eb d7 4f 26 14   ...... .v#...O&.
0410   06 81 07 2f ff af e1 0c 40 ff ff d6 47 0b 39 13   .../....@...G.9.
0420   0a 0b 21 0e 4b e9 38 8c b4 79 14 19 34 01 0c 50   ..!.K.8..y..4..P
0430   6b ff fc 98 11 db 12 2a 26 3d 99 31 72 61 38 aa   k......*&=.1ra8.
0440   70 87 09 55 5b d4 98 4e 92 93 2e 93 05 3c 68 20   p..U[..N.....<h
0450   48 12 1c 25 ba ad 7f eb 50 a2 88 58 a7 ff fb 44   H..%....P..X...D
0460   28 6d 11 09 64 c1 66 43 ff fe 40 fe 6f ff 66 a5   (m..d.fC..@.o.f.
0470   9a 0c 47 af cd ed ed b6 d8 6c 2a 05 eb fe 1a db   ..G......l*.....
0480   9c 2d 6a 89 38 fc 9d 72 fe 5c 10 ff 5f d8 15 d6   .-j.8..r.\.._...
0490   3f 8c ee 36 64 98 79 ac 48 de e9 4a 2b cb f7 dd   ?..6d.y.H..J+...
04a0   6b fc 15 d8 88 64 4d e0 49 c6 7c 58 5c b9 c6 96   k....dM.I.|X\...
04b0   8d e9 da 57 7d e5 e2 b7 dc c2 0b d7 f7 fe 45 22   ...W}.........E"
04c0   78 f8 7a 3e 2b 77 bd f7 bb c7 18 a1 1d 40 d7 a4   x.z>+w.......@..
04d0   8a 25 4b 7f 88 24 16 68 4f a2 09 2f b5 92 18 65   .%K..$.hO../...e
04e0   82 18 21 36 b2 af fd 17 c2 18 26 1e a9 ff ed fd   ..!6......&.....
04f0   bb 37 8b 40 b1 91 98 6a 47 15 d6 24 9e b1 54 08   .7.@...jG..$..T.
0500   5f d0 fb e0 51 d7 fd 50 70 17 8c b4 cd 80 08 6f   _...Q..Pp......o
0510   25 1a 0c a1 ee e1 e4 9d d7 e4 19 65 cb b8 d5 b8   %..........e....
0520   eb a4 fe f7 bb b8 a5 0c 54 28 b2 eb 08 92 15 1b   ........T(......
0530   9f 7b ff 9c 90 76 df c4 e0 6b 72 0e d0 a3 80 60   .{...v...kr....`
0540   94 3b 16 7c 57 7f bf d1 2a 12 09 9e da 20 90 a3   .;.|W...*.... ..
0550   cf 23 97 88 d2 d4 8e 91 31 95 26 2f fb 5b ca 0f   .#......1.&/.[..
0560   18 33 2a df 08 46 48 1f e4 be 1c 9d 40 09 8a c1   .3*..FH.....@...
0570   22 80 11 53 c9 a1 bf 6f e5 be 07 a1 ac 5b f7 b8   "..S...o.....[..
0580   f9 3c 72 ca 5d c0 91 b3                           .<r.]...
</code>```

I'm now at a complete loss as to how I can actually get this stream to play on any device other than an Android/iOS app that the transmitter normally works with.

Any ideas on what my next steps might be to try and work this one out?


问:
Reverse engineering STM32F303 firmware udpate
I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its extension is .fwu (I would assume that stands for firmware update).

I have no knowledge on what bootloader is used in the STM32. Unfortunately I don't have the peripheral itself. My insights on the .exe are also quite limited, as it will not work if the peripheral is not connected; all I know is that it attaches to the STM32, which provides a virtual COM port.

What I did so far:

Ran binwalk on the firmware update - no hits

Tried to extract .bin file from the firmware update, hoping that it is a plain .dfu file - failed

Ran strings on the firmware update - no hits. Maybe the file is encrypted - here's the entropy analysis result:

```<code>    DECIMAL       HEXADECIMAL     ENTROPY
    --------------------------------------------------------------------------------
    0             0x0             Rising entropy edge (0.974136)
    36864         0x9000          Falling entropy edge (0.838064)
</code>```

Did same on the .exe - it is not encrypted, strings are plain text

My aim here is to see what is the protocol used between the .exe and the STM32; that would have been easier if I had the peripheral, but I have no way of obtaining it at the moment. Initially I thought I would be able to reverse-engineer the firmware update and flash my own device, but the (probably) custom bootloader is stopping me.

I'd like to hear suggestions on how to proceed with the analysis.

Thanks.


问:
Reverse Engineering CHALLENGE
I have a BIN firmware archive file starts with 04 02 which is unknown to me
what makes me sure it is an archive file is the source I got it from

BINWALK and all other known tools failed to identify single information from the file.

Any suggestions?

Title: Reverse Engineering CHALLENGE


问:
IDA does not load PDB file
I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol loaded. What is the matter? I need load PDB file. But if I compile my project with Visual Studio 2005 that PDB file is success loaded.</p>

Title: IDA does not load PDB file


问:
What is happening with this *param_1?
I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far).

I have a function that seems to read like it is a Constructor.
But I am having trouble what it is doing, mainly because I think I don't understand the C language that well.

The code I am confused about is this:

The code as C:

The code as ASM:

Sorry for using screenshots, I couldn't get the ASM to reasonably copy and paste into here.

*param_1, is set to a specific address. What this * in front of the variable means, I can't really find besides people saying "You shouldn't do that in C code!"

What it then starts doing is nulling out some variables in an array or struct that param_1 apparently is now (going by the ASM, param_1 == ECX and so probably _this_?) the rest seems irrelevant for now.

What is at 0x497e68? It is an address, that then points towards another bit of code at 0x438170. And while this 0x497e68 address is references 4 times, all of them do so in a similar manner, and thus I never see a direct "CALL" to this indirect method. The method itself is simply calling _free on ECX. It's not special.

So what is going on here? Is there a reasonable explanation as to why this is happening? And what should I actually be reading here?
And if so, is there then a way I can convince Ghidra to present this in a more sensible way?

Title: What is happening with this *param_1?


问:
Write to file with Frida instead write to console.log
With Frida, I know how to write to console.log like:

```<code>console.log('TARGETED_METHOD_CALLED');
</code>```

But how can I write to a file?


问:
QR-Codes of Temial-Teamachine
I have a tea-machine that reads QR-Codes and brews the tea accordingly. I want to generate my own codes.

I have the following codes (and more):

Copy/Paste of the C-Column

```<code>L7UMQRQCQAZBD
OYXPVAANAB4ZE
K4BCLQEFABBRE
F5IKJLYGABSJE
</code>```

I tried a few different decoding mechanisms, but I didn't get any readings that would make sense to me.

I expect to get numbers for the time and temperature brewing. The name of tee. The number of times the same tee can be used to brew…

Edit:

All the codes as text:

```<code>VORWERK2AE4L7UMQRQCQAZBDERMYRTHWFKD7CM7PKMBOVEAUNE5WNISNWAIZT74WOLVSSHNSRUIHUWGKFUWKTNXXKI
VORWERK2AE4OYXPVAANAB4ZEER3V2QO4WL6DZGBPBIJWY3AOLKJRXNICEWXVGO6CEKNCKJHFPUPTB3R3EG5YTFTQQE
VORWERK2AE4K4BCLQEFABBREESWJ5KYBTINVAZWZ4SQ5AQUWFAZO3UPYAKOLO2HRIJNFNGXENAW3QU5IXRSKO5BFMI
VORWERK2AE4F5IKJLYGABSJEETKQTQVEY73L4SOLWW5P5NLB355G6BVHINON755S6ADUEBXUV3AFW2JQOWGCHT6CME
</code>```

Title: QR-Codes of Temial-Teamachine


问:
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.

I debug an Android application with Frida, how can I put this address in Frida to watch this value?

I know that I need to use Memory.readByteArray(ptr(0xXXXXX), 8), but what will be the correct address?

Should I read /proc/PID/maps to see the first address and then add this address to the address that I want to see? The first address is anon:dalvik-main space (region space)


问:
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.

I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and went through the pairing procedure in the app. I first press "Pair" on the scale, and the display on the scale shows a "Pairing" symbol, I then click "Pair" in the app. Using Wireshark, I see that the following interactions between the phone and the scale while pairing:

```<code>(1) Phone -> Scale: Sent Write request to Handle 0x0011, Value: 0100

(2) Scale -> Phone: Rcvd Write Response, Handle 0x0011

(3) Phone -> Scale: Sent Read Request, Handle 0x0011

(4) Scale -> Scale: Rcvd Read Response, Handle 0x0011

(5) Phone -> Scale: Sent Write Command, Handle 0x0013, Value: 0000000e000c00106a321f3b6a330031140b

(6) Scale -> Phone: Rcvd Handle Value Notification, Handle 0x0010

(7) Phone -> Scale: Sent Write Command, Handle 0x0013, Value 000000060004002000db
</code>```

By this point the scale the display stops showing the pairing symbol and shows me "0.0 kg". If I stand on it, it will notify the measured values through handle 0x0010.

I would now like to replicate the actions of the app using my computer (Arch Linux), such that I am able to be notified on Handle 0x0010. But I am not sure about how to replicate the pairing step. When I try to pair, I am not able to get rid of the pairing logo.

If I connect to the scale via "bluetoothctl", I can see the following characteristics:

```<code>[NEW] Primary Service (Handle 0x8ff1)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0008
        00001801-0000-1000-8000-00805f9b34fb
        Generic Attribute Profile
[NEW] Primary Service (Handle 0x8ff1)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009
        273e5100-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000a
        273e510f-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Descriptor (Handle 0xa280)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000a/desc000c
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000d
        273e5108-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000f
        273e510e-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Descriptor (Handle 0xa320)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char000f/desc0011
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0012
        273e5107-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Characteristic (Handle 0x5ece)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0014
        273e510d-6b90-4779-83b8-b8bf1dadac35
        Vendor specific
[NEW] Descriptor (Handle 0x9e20)
        /org/bluez/hci0/dev_BC_82_5D_0D_7F_E0/service0009/char0014/desc0016
        00002902-0000-1000-8000-00805f9b34fb
        Client Characteristic Configuration
</code>```

None of these characteristics have the handle 0x0011 or 0x0013.

If instead I connect to the scale using btgatt-client, I can see the same services and characteristics, but with different handles:

```<code>service - start: 0x0001, end: 0x0007, type: primary, uuid: 00001800-0000-1000-8000-00805f9b34fb
          charac - start: 0x0002, value: 0x0003, props: 0x02, ext_props: 0x0000, uuid: 00002a00-0000-1000-8000-00805f9b34fb
          charac - start: 0x0004, value: 0x0005, props: 0x02, ext_props: 0x0000, uuid: 00002a01-0000-1000-8000-00805f9b34fb
          charac - start: 0x0006, value: 0x0007, props: 0x02, ext_props: 0x0000, uuid: 00002a04-0000-1000-8000-00805f9b34fb

service - start: 0x0008, end: 0x0008, type: primary, uuid: 00001801-0000-1000-8000-00805f9b34fb

service - start: 0x0009, end: 0xffff, type: primary, uuid: 273e5100-6b90-4779-83b8-b8bf1dadac35
          charac - start: 0x000a, value: 0x000b, props: 0x10, ext_props: 0x0000, uuid: 273e510f-6b90-4779-83b8-b8bf1dadac35
                  descr - handle: 0x000c, uuid: 00002902-0000-1000-8000-00805f9b34fb
          charac - start: 0x000d, value: 0x000e, props: 0x04, ext_props: 0x0000, uuid: 273e5108-6b90-4779-83b8-b8bf1dadac35
          charac - start: 0x000f, value: 0x0010, props: 0x10, ext_props: 0x0000, uuid: 273e510e-6b90-4779-83b8-b8bf1dadac35
                  descr - handle: 0x0011, uuid: 00002902-0000-1000-8000-00805f9b34fb
          charac - start: 0x0012, value: 0x0013, props: 0x04, ext_props: 0x0000, uuid: 273e5107-6b90-4779-83b8-b8bf1dadac35
          charac - start: 0x0014, value: 0x0015, props: 0x10, ext_props: 0x0000, uuid: 273e510d-6b90-4779-83b8-b8bf1dadac35
                  descr - handle: 0x0016, uuid: 00002902-0000-1000-8000-00805f9b34fb
</code>```

Here I can see that the handle 0x0011 is the handle for the descriptor with uuid. 00002902-0000-1000-8000-00805f9b34fb

If I write "write-value 0x0011 01 00", and then "read-value 0x0011", I can see that I have successfully written 01 00 to 0x0011 (step 1).

After this, I am trying to replicate step (5) by sending a write command with the value "000000060004002000db" to handle 0x0013, but I am not able to do this. If I try to send a write command, I get an error:

```<code>write-value -w 0x0013 000000060004002000db

Invalid value byte: 000000060004002000db
</code>```

I am not sure about how to proceed. At this point, I have not been able to get the scale to respond, it continues showing the "Pairing" logo. How can I find out the commands that I have to use?


问:
How can I tell ld to link to a local symbol in a shared object?
Symbols in shared objects can be either local or global.  This is controlled by a flag in the symbol table. If the symbol is local, ld won't resolve to it.

Reverse engineering can often be aided by doing this, by linking a shared object and referencing its symbols (e.g. printf("%p", main_arena).  Since all the information is there, and its only a flag telling ld to ignore this, it should be possible to tell ld to resolve a local symbol as well.  How can I do this?

Note that a simple patch of the flag isn't enough:

```<code>objcopy --globalize-symbol=main_arena libc-2.30.so libc-2.30.global_symbols.so
</code>```

even though the symbol is now listed as global, ld still can't find it, because all global symbols must be before any local (see https://github.com/lief-project/LIEF/issues/112 ) and perhaps for other issues (see https://stackoverflow.com/questions/6527014/making-a-local-symbol-global ).  It might be possible to rebuild the entire symbol table, but this will introduce other changes that we don't want.  What we want is simply to tell ld "Please break the rules and resolve local symbols as well, just like gdb does."


问:
Edit Squashfs filesystem in flash memory
I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs .

When I open this FS I want to add some file into this FS and edit some shell script then pack this squashfs again and put it back into flash system.

The problem is :when I pack again the squashfs it bigger then the original fs. Then I can't put it exactly in the location into flash memory because it's overlap the next partition in FS.

What can I do please?


问:
WinApi of UWΡ Shаdοws
I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ.

What I know:

This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using SetWindowLong&GWL_EXSTYLE and SetLayeredWindowattributes then to set LWA_ALPHA to 0.

In addiction to this, if you know how UWP works at all, the main form is being created not at the main executable's process, but at ApplicationFrameHost.exe. Flyouts (their windows) is being created exactly at the main executable, not at ApplicationFrameHost.exe.

One can turn off 'Shοw trаnsparenсу in Windοws' setting (Settings -> Ease of access -> Display). And I know that this can be performed using registry key, but its system-wide setting and I cant be sure that any other application rather than UWΡ will not ignore this registry key and just draw this shаdοw :(

p.s. How do I inspect the flyout if its being hidden when window is unfocused? One can set WS_EXSTYLE with WS_EX_NOACTIVATE to the main form (ApplicationFrameHost.exe -> ApplicationFrameWindow -> Windows.UI.CoreWindow). Then, if one will cause this flyout to appear and then click somewhere outside the window, flyout will not close so one can inspect it with WinSpy++ or something else.

What I've tried:

I created a testing form on UWΡ, where were two flyouts with all the same properties, where only difference was that the first one has shаdοw, the second one don't. After this, I performed that trick with NOACTIVATE to inspect two flyouts' attributes. And I don't see any difference. Like not class flags or window flags, they are all the same.

Talking about reversing, I tried to use

WinAPIOverride64

API Monitor v2 (Alpha) 64-bit

Injecting DLL, which overrides some chosen functions from WinApi (I know about injection techniques in UWΡ, injection does work, but I can't find exact method, which is drawing this shadow)

As for documentation, I can only see that one can add this kind of shаdοws using XAML attributes, but this doesnt make it clear which WinApi methods is used for this.

What I want to do exactly? I want to remove this shadow from any window during runtime via DLL Injection. But, as I can't find which API method is being used, I can't override it.

I've already spent about a month on this puzzle, but I can't solve it. Maybe somebody can help me :)

Thanks!

Title: WinApi of UWΡ Shаdοws


问:
failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64
I have implemented packer of x86_64 shared library.
Briefly, a loader is injected to a shared library, and
the rela.dyn entry is modified such that it points to the address of the loader. Once the loader is triggered, it decrypts the .text section and finally jump to the address of the .text section.

The mechanism works fine for x86_64 shared library.
But it failed on aarch64 shared library.

Questions:

Did I miss any steps that specifically for the aarch64 ?

Is there any other ways to pack an aarch64 shared library ?

The result of readelf is provided bellow.
libtest.so is the library before packing.
While libtest_packed.so is the library after packing.

here is the result of readelf --relocs libtest.so

```<code>Relocation section '.rela.dyn' at offset 0x550 contains 7 entries:
000000010df0  000000000403 R_AARCH64_RELATIV                    780
000000010df8  000000000403 R_AARCH64_RELATIV                    738
000000011018  000000000403 R_AARCH64_RELATIV                    11018
000000010fc8  000300000401 R_AARCH64_GLOB_DA 0000000000000000 _ITM_deregisterTMClone + 0
000000010fd0  000400000401 R_AARCH64_GLOB_DA 0000000000000000 __cxa_finalize@GLIBC_2.17 + 0
000000010fd8  000500000401 R_AARCH64_GLOB_DA 0000000000000000 __gmon_start__ + 0
000000010fe0  000700000401 R_AARCH64_GLOB_DA 0000000000000000 _ITM_registerTMCloneTa + 0
</code>```

the functions corresponding to the first 3 entries are:

```<code>0000000000000780 t frame_dummy
0000000000000738 t __do_global_dtors_aux
000000000011018 d __dso_handle
</code>```

here is the result of readelf --relocs libtest_packed.so

```<code>Relocation section '.rela.dyn' at offset 0x550 contains 7 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000010df0  000000000403 R_AARCH64_RELATIV                    11028
000000010df8  000000000403 R_AARCH64_RELATIV                    738
000000011018  000000000403 R_AARCH64_RELATIV                    11018
000000010fc8  000300000401 R_AARCH64_GLOB_DA 0000000000000000 _ITM_deregisterTMClone + 0
000000010fd0  000400000401 R_AARCH64_GLOB_DA 0000000000000000 __cxa_finalize@GLIBC_2.17 + 0
000000010fd8  000500000401 R_AARCH64_GLOB_DA 0000000000000000 __gmon_start__ + 0
000000010fe0  000700000401 R_AARCH64_GLOB_DA 0000000000000000 _ITM_registerTMCloneTa + 0
</code>```

As you can see, the first entry is overwritten by the address of the loader.

------------ Update ---------

if I xor-ed the .text section, the xor-loader is bypassed

I got Illegal instruction (core dumped), since the .text section has not been decrypted by the xor-loader. (confirmed by inspecting the .text section by gdb)

I have the loader objdump-ed, the loader is intact.

if I don't xor the .text section, the xor-loader is called and work normally. (But the decryption is wrong, since the .text section has not been xor-ed beforehand).

Since shared library don't have an entry point. I overwrite
the frame_dummy pointer such that the program can jump to the .text
section, base on this project

https://github.com/0xN3utr0n/Noteme/blob/master/injection.c

The mechanism of my loader is inspired by
https://github.com/sebastiencs/Packer_ELF


问:
I need to make a dominance tree using Ghidra headless
I need to make a dominator tree where I need to tell a function(a) dominates function(b). There is an API in GraphAlgorithms which needs GDirected graph and "vertex from" parameters, but I am having trouble figuring out how to make that graph. Can anyone help with this problem?

In the dominance tree, I need to find a particular function or basic blocks is a dominator.(either of them will work)

findDominanceTree(GDirectedGraph<V,E> g, TaskMonitor monitor)

The GdirectedGraph has parameters V and E, I don't know what to put in these parameters.

Any help will be greatly appreciated.

p.s. dominance :
a node 'a' dominates node 'b' if all paths from start to 'b' contain 'a'; a node always dominates itself (except in 'strict dominance', which is all dominators except for itself)


问:
Force IDA to redo SP analysis?
I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original analysis so I can get the orignal values? I already tried undefining the code region and defining it again but it didn't work</p>

Title: Force IDA to redo SP analysis?


问:
Custom Chromium build - find registered extension's JS code
I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for.

Apparently, these are registered as en extension using this function: Chromium.Remote.CfrRuntime.RegisterExtension(System.String,System.String,Chromium.Remote.CfrV8Handler) which I was able to find in the ChromiumFX.dll.

I found this in the definition:

"Register a new V8 extension with the specified JavaScript extension
code and handler. Functions implemented by the handler are prototyped
using the keyword 'native'. The calling of a native function is
restricted to the scope in which the prototype of the native function
is defined. This function may only be called on the render process
main thread."

I'm a total reverse engineering noob so don't really know what I'm doing. I found the function using dnSpy but that's about it.

I tried looking into extracting the function definitions right from Chrome but apparently in the build they're using you can't do that. Or at least I couldn't find a way.

Is there a somewhat easy way of achieving what I want?


问:
Make avaible x64 C++ exceptions on manually mapped module
I am trying to bind Lua on manually mapped module. As you can see clearly on here.

They are using C++ or C exceptions on their API and there is no way to avoid them.
I wonder to know if there are possibilities to enable that exceptions on my module.

I had tried to patch these line as following:

```<code>#define LUAI_THROW(L,c) c->throwed = true
#define LUAI_TRY(L,c,a) \
    __try { a } except(0xDEADBEEF) { if ((c)->status == 0 && ((c)->throwed == true)) (c)->status = -1; }
#define luai_jmpbuf     int  /* dummy variable */

/* chain list of long jump buffers */
struct lua_longjmp {
  struct lua_longjmp *previous;
  luai_jmpbuf b;
  volatile int status;  /* error code */
  bool throwed;
};
</code>```

And compiled my module with /EHa, but it didn't work as expected.


问:
Scraping data from an audio analyzer application
Briefly:

I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start?

Details:

It's a Mac x86 app but probably compiled with cross-platform frameworks, as it is available for Windows as well with the same UI.

I run “strings” on the binary and the name “juce” came up a few times, which is a C++ framework.

The info about the audio files is not displayed on a table, but as scattered points on a 2-D plane, similar sounds get placed together, and sounds of the same category are points of the same color. But still there must be an array in memory with the info I want to get.


问:
Counting how many times a function is called
I want to change context (Rdx, Rax etc.) everytime a specific function gets called.
My solution: I seted up a breakpoint at function event.get_thread().set_context({"Rdx" : "bla bla"})

My problem: The FPS of the game drops to 16
Is there another method to do this without FPS problem ?

```<code>#!/usr/bin/python
# -*- coding: utf-8 -*-
import time
import os,code
import winappdbg
import psutil
pid = None
process_name = "process.exe"
for process in psutil.process_iter():
    if process.name() == process_name:
        pid  = process.pid
def handle(event):
    global count
    count += 1
    os.system("cls")
    print(f"Changed Slot: {count}")
global event2, count, alloc
alloc = None
event2 = None
count = 0
def eventHandler(event):
    code = event.get_event_code()
    if code == winappdbg.win32.LOAD_DLL_DEBUG_EVENT:
        module = event.get_module()
        if module.match_name("user32.dll"):
            print ("Setting breakpoint")
            global event2
            event2 = event
            event.debug.break_at(event.get_pid(), 0x7FF60DA6C47E, handle)
debu = winappdbg.Debug(eventHandler, bKillOnExit=False)
proc = debu.attach(pid)
try:
    debu.loop()
except KeyboardInterrupt:
    event2.debug.dont_break_at(event2.get_pid(), 0x7FF60DA6C47E)
</code>```


问:
Using rbreak without import functions
While debugging  with GDB I want to break for each function and print the PC register.

```<code>rbreak .
define hook-stop
   i r $PC
   c
end
</code>```

The problem is that is stop on functions that imported like printf and memcpy .

How can I stop only on functions in my binary that not imported?

Title: Using rbreak without import functions


问:
IDA tracing not working
I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called.

I have tried to use IDA Tracing, but it doesn't print to file.

Title: IDA tracing not working


问:
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.

How to get it?
Can someone help?

Code Here:

```<code>v57 = sub_10AA66818();
v58 = (void *)objc_retainAutoreleasedReturnValue(v57);
v59 = v58;
v13 = v65;
v60 = objc_msgSend(v58, (const char *)&loc_109CB2ABC + 1, v46, v29, v65);
</code>```

sub_10AA66818() return a OC Singleton Object and Stored in v57:

```<code>__int64 sub_10AA66818()
{
  if ( qword_10DCB7038 != -1 )
    dispatch_once(&qword_10DCB7038, &off_10BE41040);
  return objc_retainAutoreleaseReturnValue(qword_10DCB7030);
}
</code>```

According to the second code box, that Singleton perform a selector to do something.

It's why I try to know what sub_10AA66818() return in debugging.


问:
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application executes without issue when outside a debugger, however, when running the application using the "Local Windows Debugger" in IDA (loaded as a MetaPC project), an "unknown exception code 6A6" is thrown:

This exception occurs shortly after the application execution has begun in the debugger (i.e. without any application user input).

To eliminate a possible issue with IDA, I tested using the x32dbg debugger and the Ollydbg debugger. Both debuggers throw the same raised exception, namely the RPC_S_INVALID_BINDING (0x000006A6) error:

I spent some time thinking about why I am facing issues running the application inside a debugger and I came up with a few possible reasons:

Anti-debugger techniques.

64-bit debuggers are loading the wrong DLLs (i.e. they're loading the 64-bit DLL when it should be loading the 32-bit DLL located in C:\WINDOWS\SysWOW64\).

Reference(s):

IDA Pro 64 bit disassembly error for system DLLs

Do not load dll from System32 directly into IDA

Something else (??)

I am able to disprove that both #1 and #2 are not the issues after setting up a 64-bit  Windows 7 with Service Pack 1 environment. I am able to debug the application in IDA without issue while in this Windows 7 environment (i.e. the 6A6 exception is not thrown).

So, this leads me to #3 - a head scratching moment. I did some research into the RPC_S_INVALID_BINDING (0x000006A6) error and came across this StackOverflow question. Naming, the accepted answer notes the following:

Explaining 'The Binding Handle Is Invalid'

Today I want to try to give more insight into the 'Binding Handle Is Invalid' problem that a number of people have reported with the VS 2005 debugger.

First, if all you care about is how to solve the problem: Enable the 'Terminal Services' service and reboot. If you want to know more, read on.

I tried enabling the Terminal Services (now named Remote Desktop Services on Windows 10 [reference]), however, this doesn't solve the issue and I still get an "unknown exception code 6A6" error. The RPC_S_INVALID_BINDING (0x000006A6) error confuses me quite a bit.

There clearly appears to be something wrong with my environment setup with Windows 10 that isn't allowing me to specifically debug this application. Something changed from Windows 7 that is causing this issue and I'm at a loss here.

Does anyone know what might be the issue here?

Environment Detail(s):

OSes Tested in VMWare Fusion (12.2.1 (18811640)):

[❌ - Issue] Windows 10 (x64) - Build 19042 (20H2 / 20H2)

[❌ - Issue] Windows 10 (x64) - Build 15063 (1703 / Redstone 2)

[❌ - Issue] Windows 10 (x64) - Build 14393 (1607 / Redstone 1)

[✅ - No Issue] Windows 7 Ultimate (x64) - Build 7601 (Service Pack 1)

Tools Used (launched as Administrator):

IDA Home 7.6 (v7.6.210427) (x64)

x32dbg (Release "July 1 2021, 23:09:08") (x64)

Ollydbg (v2.01) (x86)

Update #1:

As requested, here is the call stack (a.k.a. stack trace) when the exception occurs:

The application appears to be checking the DirectX9 environment and whether it is supported or not. Although, this is a guess on my part from the name of the DLL, DX9EnvChk.dll, which is included alongside the application in question. I can't find much information about this DLL through a normal web search, but it appears to be present with other applications of the era. This DLL (nor accompanying header file) was not part of the Microsoft DirectX SDK (June 2010) from what I can see.


问:
ReadProcessMemory from host to Hyper-V Windows Guest VM
Is it possible to use ReadProcessMemory or some other form of it maybe via a library to read memory from a virtual machine running inside Hyper-V?

The host is running Windows 11 the Guest is running Windows 10 through Hyper-V


问:
What does this multi mov instruction do?
I came across the following multi mov instruction:

```<code>mov eax, 1, 2, 3
</code>```

What does this instruction do? Where can I find the correct documentation for this instruction?


问:
How to hide NOPs in IDA?
I am trying to understand a method in IDA Free and I find the NOPs, especially the multibyte NOPs confusing.

Is it possible to hide these? I believe that they are not relevant for my understanding.

Title: How to hide NOPs in IDA?


问:
Decompiling a Node.js application compiled with nexe
Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker.

Judging by folders created in my user directory, multiple references to directory named .nexe I'm pretty sure that it was compiled using nexe, and it does something on GitHub (maybe download config), sends the token via Discord webhook feature (uses an npm package for that), deletes login info, and quits Discord so the user is logged out.

I've tried to view requests that this malware makes with Wireshark, and sevral other programs but it's HTTPS so it's encrypted.

Can anyone help me with decompiling this malware or at least decrypting traffic between it and GitHub/Discord?