问:
can sha1 hash of file converted to sha2 hash?
I have a phone database /data/user/0/com.miui.gallery/databases/gallery.db containing information such as exif data and file name. there is a column sha1 containing value

```<code>e89cfb34fbea51e225ab9e17fa3a15cb171cd2d4
</code>```

I lost the phone and MicroSD Card so the original files are lost. However there is a cache directory /storage/emulated/0/Android/data/com.miui.gallery/files/gallery_disk_cache/full_size containing thumbnails in 750x1000 resolution.

I identified a picture which is the preview for the above entry. However the file name cannot be found in the database. also the mtime is slightly different, although I am sure that is the same picture.

the file name of the thumbnail picture is (I don't know what it is)

```<code>57818493be39acef0f61b5530ead56a244cc9f50672635f49f1c5e31b1f33ad0.0
</code>```

the calculated sha1 and sha2 of the thumbnail picture is

```<code>277a7e182228906ca92dd969d4929a6171da3f8b
1366c580e9f8e6ed28347401942934bc8d3ac7257112033e2a40c49f5973b253
</code>```

assuming the thumbnail file name is the sha2 of the original picture, is there any way to assign the sha2 to sha1 without having the file? maybe with bruteforce or something?


问:
Reverse Engineer Using Class-dump
I have tried to look into the class-dump of a decompiled ipa file, can I assume that only : TtCC29XYZ18JailbreakDetection12RuntimeClass is of remarkable because it has - (long long)runtimeModifiedFunction;

```<code>@interface _TtC29XYZ18JailbreakDetection : _TtCs12_SwiftObject
{
}

@end

@interface _TtCC29XYZ18JailbreakDetection12RuntimeClass : _TtCs12_SwiftObject
{
}

- (long long)runtimeModifiedFunction;

--
@interface _TtC16IOSSecuritySuite16JailbreakChecker : _TtCs12_SwiftObject
{
}

@end

VAPT $ class-dump XYZ_bin | grep -A 5 -i Jail
</code>```

Can I assume that, those without method is nothing remarkable?

ContentLicense: CC BY-SA 4.0

Title: Reverse Engineer Using Class-dump


问:
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting from RAM:0000 till RAM:0001 just like that:

```<code>AX - RAM:0x0000-0x0001
AH - RAM:0x0000
AL - RAM:0x0001
</code>```

Is it possible to create a REG_DEFS for IDA Processor Module and then map it to the RAM segment in a way, that would allow tracking the registers in the correct order throughout the disassembly? The problem is, that commands such as mov could operate on both "a complete" register (AX) as well as its parts (AH and AL) and while creating a RAM mapping, it doesn't allow me to name the same area of RAM twice using this code:

```<code># Creating AX
ida_bytes.create_data(0x0000, FF_WORD, 2, ida_idaapi.BADADDR)
idc.set_name(0x0000, "AX", SN_CHECK)

# This approach would fail, as it would intersect with AX and redefine it
ida_bytes.create_data(0x0000, FF_BYTE, 1, ida_idaapi.BADADDR)
idc.set_name(0x0000, "AH", SN_CHECK)
ida_bytes.create_data(0x0001, FF_BYTE, 1, ida_idaapi.BADADDR)
idc.set_name(0x0001, "AL", SN_CHECK)
</code>```

So, I would either get AX in the disassembly listing or AH and AL, but not both. More than that:

I need to be able to access individual bits within the AH and AL registers, therefore a simple UNION would not work I guess.

IDA needs a way to understand that AH and AL are a part of the AX register and track not only their own values but a value as a part of AX as well. Example:

mov ax, 100h  # AH should be 1h and AL should be 0

Is there a way to overcome it with the memory-mapped registers?


问:
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still preventing me from running it. What am I missing to get this to work?

I disabled it by adding DisableAntiSpyware toHKLM/Software/Policies/Microsoft/Windows Defender and setting it to 1.


问:
How to decrypt PPPoE password of Huawei HG8245W5-6T?
Can someone help me to decrypt the PPPoE password from a Huawei HG8245W5-6T fiber optic ont.
The password has this format: "$2lT_)L2t{NViWZSYEt@"/qwP82OAN)<s+mv~AVu["$"

I tried to decrypt it with the Huawei configuration encryption and decryption tools but no luck.
I need to put the Huawei in bridge mode but the internet provider won't provide the credentials.


问:
Problem while debug with x64dbg
I am debugging with x32dbg a program (x) which at some point opens another program (y). Is it possible to continue debugging also on program (y) when opened by the first one (x)?
Unfortunately, program y must necessarily be opened by x otherwise an error will occur, so it is not possible to debug program y individually.
Thanks for any reply.</p>

Title: Problem while debug with x64dbg


问:
RE internship possibilities
I am currently studying computer science and I have to do a mandatory internship (6 months) soon. I am really enjoying re and I would love to get an internship in that area. My problem is that the number of re internship jobs I found on various job search engines is extremely limited to quite non existing.

Do you have any ideas where I could look for jobs instead? I am living in germany but I also wouldnt mind to move to a nearby country.

Thank you very much!

Title: RE internship possibilities


问:
Is there an MFC Decompiler available?
I want to know if there is already an MFC Decompiler?
So far, you have to decompile by hand - which is very tedious.
I would like a tool like DeDe Decompiler. The C++ code itself is not important. It is important to decompile the project architecture and generate the appropriate header and cpp files.

I really don't want to invent it myself. But, if there is no other choice - apparently - it will be necessary. Because already 3 projects are pending.

Title: Is there an MFC Decompiler available?


问:
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'm wondering if I can tell angr to not split basic blocks when it encounters REP instructions with the API or if I have to do it manually.

This is a snippet of my code:

```<code>p = angr.Project(sys.argv[1], auto_load_libs=False, main_opts={'base_addr': 0} )
cfg = p.analyses.CFGFast()
cfg.normalize()

for func_node in cfg.functions.values():
    for block in func_node.blocks:
        c = block.capstone
        for i in c.insns:
            * operations *

</code>```

This is an example of a basic block that ends with a REP instruction:

Thank you in advance.


问:
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find any info on it) draws data from a 16MB flash that contains about 4.5 hours of audio. This averages somewhere near 8kbit/sec, putting us in speech codec territory. There are 3 differnet "tracks", and I'm looking for help to identify or reverse engineer the specific audio format.

I've extracted the ROM and using a logic analyzer have determined where it gets read and how often - while playing it seems to draw down 6 bytes in rapid succession, 2 bytes after a 20μs pause, 2 more bytes 72μs later, then does a variable amount of 2 bytes reads (around 11-20ish) every 35-110μs. These cycles repeat differently for every track - 39ms for track 1, 19ms for track 2, and 39ms or so for track 3. This seems to imply that we have a variable rate codec and the tracks are of diffrent bitrates, but the same codec across all tracks.

This thing was built to cost in China so I'd be shocked if they didn't just use an off the shelf codec... I was thinking something like MP3 or maybe even G729 as the audio quality isn't exactly stellar, but I haven't been able to tease out anything recognizealbe when I try raw imports to Audacity or VLC... Looking at the data in a hex editor doesn't show any evidence of MPEG frames, but its possible that it's somehow XOR encrypted or otherwise obfuscated... All it seems to do to validate it's found a track after looking at the address table is look at the first 2 bytes, which are always 4B 00. So whatever it is isn't readily recognized on a PC.

Anyone come across this kind of thing before? ROM and logic traces are here, low production values YouTube showing the thing in detail is here - would appreciate any insights peolpe might have to help further this mission!


问:
How can I disable watchdog in U-boot using mw command
So I have DVR with 2*Hi3511RBC CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) and when I enter U-boot (how do I know that I'm in U-boot ? ) well over UART I get following message

```<code>U-Boot 1.1.4 (Nov 17 2008 - 19:48:18)

U-Boot code: E0500000 -> E05174C0  BSS: -> E051E23C
HI_VERSION=U_BOOT_1_1_4-M06C0303B0301 @Hi3511v110_OSDrv_1_0_0_1 2008-11-03 18:27:45
RAM Configuration:
Bank #0: e0000000 256 MB
## Unknown FLASH on Bank 1 - Size = 0x00000000 = 0 MB
Flash:  0 kB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
MAC:   00-00-00-00-00-00
Hit any key to stop autoboot:  1
</code>```

and I press any key and I get following

```<code>hilinux # ?
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftp    - download or upload image via network using TFTP protocol
version - print monitor version
</code>```

the after some time 10-15 sec. device just reboots and I cant dump content of ram with md.b command so one guy suggested me that I can disable watchdog with mw command when I'm in U-boot so I just need to find which register to alter. I have little experience with this stuff can someone take a look at datasheet and figure out command for this ? Datasheet can be accessed at link https://mega.nz/file/9c4CVK6T#P78EU3Yrt2oUr2El_78M7Bp3EjzNiT8HFtr5HOuUrLw

Edit: Add printenv

```<code>hilinux # printenv
bootargs=mem=32M console=ttyAMA0,115200
bootcmd=bootm 0xe1000000 0xe1500000
bootdelay=1
baudrate=115200
ethaddr=00:00:00:00:00:00
ipaddr=192.168.1.10
serverip=192.168.1.1
netmask=255.255.255.0
bootfile="uImage"
stdin=serial
stdout=serial
stderr=serial
verify=n

Environment size: 261/131068 bytes
</code>```


问:
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I tried to track system calls with strace, but I still don't understand what and how it works

Maybe you can help me with something?

This is my first time on the forum and I don't know how to attach files...

Maybe you can tell me how it is more convenient to track all the syscalls and understand what is where

Title: Please help with striped binary reverse


问:
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search the memory now but I am getting 0 results. I have been on Google and Microsoft docs about the range operator trying to get this to work but I cant get it to find anything. I am on a Windows 11 vm.

s -a 0 L?4ffffff "This Program"


问:
problem with LD_PRELOAD

Hell0!!!
I try ld_preload by pwntools and take it...
How can I fix this problem???

Title: problem with LD_PRELOAD


问:
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task reflutter which I used in this case failed because the flutter version built with the apk is not supported by the reflutter. so the author provided  docker image in which one allows to implement his own patches there is manual Flutter code change is supported using specially crafted Docker. but the environment variables passed there, included HASH_PATCH=[Snapshot_Hash] COMMIT=[Engine_commit]. in this case if I know the snapshot Hash from the apk how can I get the matching Engine commit for example in this case this is Engine SnapshotHash: adb4292f3ec25074ca70abcd2d5c7251, so how can I retrieve the matching Engine Commit?

Title: Reverse engineering a flutter built apk


问:
What Are These Four Bytes In My File Doing
I have a file that I'm trying to reverse engineer that is generated by an application.  The file itself is fairly simple, but there are 4 bytes whose purpose I can't determine.  The file consists of a header followed by the mystery bytes, followed by a JPEG image and finally some plain text.

The file looks like this:

```<code>00000000: beca beca cc19 0000 ffd8 ffe0 0010 4a46 ..............JF
...
...
...
...
00000670: 028a 28a0 028a 28a0 0fff d90d 0a63 6f6c  ..(...(......col
00000680: 6f72 2074 6578 7475 7265 2022 6465 6361  or texture "deca
...
...
...
00000870: 2269 6e76 6572 745f 6d61 736b 2220 206f  "invert_mask"  o
00000880: 6666 20                                  ff
</code>```

The header is the first 4 bytes and is always the same in every file.  After the 4 mystery bytes, the JPEG starts at  ffd8 and  continues until ffd9 and then the text content begins.

In the application, you select an image file, and adjust some settings and can then save the results, which creates a file like the one above.

Some experimentation has shown that the JPEG image in the file is always 256x256 pixels.  It is essentially a thumbnail created from the selected image.  The file above was created using an image with a single black pixel, and the generated thumbnail is a 256x256 black square.

The first two bytes are affected by the source image size.  If I try images with more pixels in a single row, the second mystery byte will change, but not in an obvious (to me) fashion.  For example:

```<code>    1 x 1 0x19
    1 x 2 0x11
    1 x 3 0x0f
    1 x 4 0x0d
    1 x 5 0x0d
    1 x 6 0x0c
    1 x 7 0x0c
    1 x 8 0x0b
    1 x 9 0x0b
   1 x 10 0x0b
   1 x 11 0x0b
   1 x 12 0x0b
   1 x 13 0x0b
   1 x 14 0x0b
   1 x 15 0x0b
   1 x 16 0x0a
   1 x 32 0x0a
   1 x 64 0x0a
  1 x 128 0x0a
  1 x 256 0x0a
</code>```

Growing the image in height instead of width yields the same values, so a 2 x 1 image is 0x11, a 3 x 1 image is 0x0F and so on.  Any square image will have the same value as the 1x1 image (0x19) even if the original image is larger than the generated 256x256 thumbnail.  The first mystery byte gets involved sometimes as well.  For a large image (1803 x 1087), the first mystery bytes are 7c 86.  The last two mystery bytes have been 00 00 in every file that I have checked.  I can say that it seems to be an offset of some sort, because if I set the two bytes equal to one byte more than the file length, the application will complain with a seek error.

This kind of thing isn't part of my day job, so I'm hoping than posting here will put some eyes on it that immediately see whatever it is that I'm missing, or will generate some ideas on further tests I can do to try to figure out what these bytes are doing.


问:
How to determine the encryption type/structure used on a .dat file
I have a .dat file that is saved by a Delphi 5 application. It is basically the applications backup file for it's internal database.

I can't seem to find what type of DB it is. The file starts with TPE0& then is followed by a mix of binary.

I have tried to search the name part but also don't have experience with Delphi so not sure if this is from an internal type class or if the dev rolled their own solution form the 90's

The other option I tried was to read the file as a binary into rust and then convert to chars to see if it made sense, but that would give not much details. Trying to just have it as a set of int's worked. But the data should map back to ascii as it is from an internal data store of details.

I'm trying to work out if its possible to make a cli to parse and migrate the data.

<s>(I can't really attach the full file as all the null like bits are cleared out so the data might be even more jumbled when coping)</s>

Edit 2

Below is a hexdump as per masterx244's comment.

```<code>0000000 54 50 45 30 26 20 c3 03 00 00 01 48 63 97 cd 27
0000010 a2 5f 15 0b aa f0 bd 6f 33 c9 bf 77 55 02 a2 4d
0000020 42 b2 da ed 9e 47 48 cd 34 8e 49 1c f8 41 bc 42
0000030 a1 69 41 12 32 7f 7a 80 d2 6e 68 05 92 18 87 e4
0000040 48 00 00 81 29 56 58 ca a3 7f 64 00 5e dd 7e 70
0000050 0c 9b 93 4e ea 23 32 46 35 75 e9 f7 cf e8 59 af
0000060 0c 05 98 84 1f 92 98 01 68 33 d1 68 b8 20 16 86
0000070 21 cb ae 74 a9 78 23 cf d8 40 16 7a e8 e5 96 54
0000080 99 4a 7a 3d 57 04 02 d4 c4 30 c9 3a f7 df 66 6c
0000090 ed b1 93 6a 14 b9 11 29 bb 65 2f 0d b9 4c 4a 59
00000a0 57 72 08 ad 00 05 15 75 d9 6b 8e 19 78 75 e2 20
00000b0 74 ae d8 56 63 ec 46 19 eb c2 76 76 c9 bd d0 9f
00000c0 5c 50 d8 13 50 e5 8e 74 af 66 16 2b c2 75 9e 82
00000d0 a6 75 94 f7 e8 4f 09 a8 61 8d 1b d4 38 b5 f2 ab
00000e0 87 5a f2 4b 26 76 b9 34 e9 3d e5 ba 76 99 91 46
00000f0 f8 7d 55 d3 00 89 5e 2f 3d 2c ea c2 d3 25 da ee
0000100 9e c2 00 b4 d7 5c a5 0b 32 87 0d 1c 7f 2a 14 16
0000110 cc da d9 0f b6 6f 4a 0d 42 1e 75 c0 b9 0a 7c 21
0000120 4f 74 2c fc 61 36 08 1e 03 8f 2c be dd cf b4 07
0000130 1f 22 29 90 fb ae c8 5e 05 af ce 73 26 6d ec e3
0000140 1e 55 7c d8 fd c0 35 f8 d3 3d 05 98 cf 7d 6c ee
0000150 34 f8 9a 7c 0d 46 26 a2 f3 42 01 c1 fe 18 0c 7b
0000160 78 f4 fd ab 9b 21 b3 d1 03 fe f1 35 f2 62 9b ff
0000170 e0
0000171
</code>```

Edit

Here is the data from the file, I converted the bytes to ascii so you can see what it is and hopefully retain the data

```<code>TPE0& Ã\u{3}\0\0\u{1}Hc\u{97}Í'¢_\u{15}\u{b}ªð½o3É¿wU\u{2}¢MB²Úí\u{9e}GHÍ4\u{8e}I\u{1c}øA¼B¡iA\u{12}2\u{7f}z\u{80}Ònh\u{5}\u{92}\u{18}\u{87}äH\0\0\u{81})VXÊ£\u{7f}d\0^Ý~p\u{c}\u{9b}\u{93}Nê#2F5ué÷ÏèY¯\u{c}\u{5}\u{98}\u{84}\u{1f}\u{92}\u{98}\u{1}h3Ñh¸ \u{16}\u{86}!Ë®t©x#ÏØ@\u{16}zèå\u{96}T\u{99}Jz=W\u{4}\u{2}ÔÄ0É:÷ßflí±\u{93}j\u{14}¹\u{11})»e/\r¹LJYWr\u{8}\u{ad}\0\u{5}\u{15}uÙk\u{8e}\u{19}xuâ t®ØVcìF\u{19}ëÂvvÉ½Ð\u{9f}\\PØ\u{13}På\u{8e}t¯f\u{16}+Âu\u{9e}\u{82}¦u\u{94}÷èO\t¨a\u{8d}\u{1b}Ô8µò«\u{87}ZòK&v¹4é=åºv\u{99}\u{91}Fø}UÓ\0\u{89}^/=,êÂÓ%Úî\u{9e}Â\0´×\\¥\u{b}2\u{87}\r\u{1c}\u{7f}*\u{14}\u{16}ÌÚÙ\u{f}¶oJ\rB\u{1e}uÀ¹\n|!Ot,üa6\u{8}\u{1e}\u{3}\u{8f},¾ÝÏ´\u{7}\u{1f}\")\u{90}û®È^\u{5}¯Îs&mìã\u{1e}U|ØýÀ5øÓ=\u{5}\u{98}Ï}lî4ø\u{9a}|\rF&¢óB\u{1}Áþ\u{18}\u{c}{xôý«\u{9b}!³Ñ\u{3}þñ5òb\u{9b}ÿà
</code>```


问:
x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION
Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So one should call the owner of the program to activate it. However, the activation process requires calling the program owner and providing them with the serial key so that they can activate it for you from their database. Unfortunately, I am no longer able to contact1 the owner and am seeking assistance from someone who can help me crack it.

I'm using x32dbg. As a result, I tried to crack the program, but I am receiving an error message: (C0000005, EXCEPTION_ACCESS_VIOLATION).

I would greatly appreciate any suggestions or advice on how to crack this software. Please let me know if any further information is needed.

link to executable : https://www.mediafire.com/file/7lbw6ckfs6szf49/electronics.exe/file

1 I have attempted to contact the owner of the program using the phone number provided, but it appears to be disconnected, and the owner's domain has been shut down.


问:
Reverse engineering a predictive model with lots of example inputs/outputs
I'm working on a project to approximate an existing model that generates prices for an asset given a large number of input variables. The model comes with ~1,000 unique example lines in batches of variations. For example, say the asset has 10 variable qualities (v1, v2... v10) that the model will use to determine three price drivers (d1, d2 and d3) which are used to compute a final price p1. The example data may have 10 lines that all have the same v1-v9 and ten different values for v10, and shows the resultant d1, d2, d3 and p1. Then there is another batch of 20 lines that hold variables v2-v10 constant and show twenty different values for v1 that produce different d1, d2, d3 and p1s for each example.

Is there any type of primer on how you would approach reverse engineering this type of predictive model? If anyone can help guide, I'd be happy to make a reasonable donation to a charity of your choosing!

Thank you!


问:
Decompiling an APK of Unity framework with IL2CPP
Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed?

I tried stuff like https://github.com/Perfare/Il2CppDumper and a few more tools, but it only allows me to see the structure of the project like methods with offset, etc., but nothing about the source code.


问:
Yara Rules 4.3 Warnings
$hex = {CC CC CC CC CC CC CC CC}
Warning : "$hex" may slow down scanning
Do anyone know how to remove this warning</p>

Title: Yara Rules 4.3 Warnings


问:
UART Interface Router (HUAWEI) V724 Typ A
I am trying to identify the UART pins on the board in order to debrick the router. Any help would be appreciate it.


问:
Decoding the Apple vendor tag in the 802.11 beacon

Background

Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a personal hotspot?.

I did some research into both questions, and determined that personal hotspot was communicated as part of the vendor tag / information element in the beacon.

Goal

I want to see if we can decode the Apple vendor tag in the 802.11 beacon to see exactly which elements are what, including what defines if it is a personal hotspot. If we do perhaps we can include it in the Wireshark decoding.

My research

Doing a trace of my iPhone with Wireshark I see:

```<code>  Tag: Vendor Specific: Apple, Inc.
    Tag Number: Vendor Specific (221)
    Tag length: 10
    OUI: 00:17:f2 (Apple, Inc.)
    Vendor Specific OUI Type: 6
    Vendor Specific Data: 06010103030000

Hex:  dd 0a 00 17 f2 06 01 01 03 03 00 00
</code>```

A guide about making OpenWRT appear as a personal hotspot they used  vendor_elements=DD0A0017F206010103010000'  and it worked (ref yichya.dev).

Some additional info that can help. If you run airport -s --xml on MacOS you can see both the IE and what appears to be some parsing of the element:

```<code>      <key>IE</key>
      <data>
      AA9hcF9taXNoYXJlX2NmNjABCIwSmCSwSGBsIAEAOwUAU1R9gTAUAQAAD6wE
      AQAAD6wEAQAAD6wCDAAtGu8AE///AAAAAAAAAAAAAAAAAAAAAAAAAAEAPRaV
      BREAAAAAAAAAAAAAAAAAAAAAAAAA3RgAUPICAQGBAAIyAAAiMgAAQjJeAGIy
      LwC/DLIAgDP6/2ID+v9iA8AFAZsA+v9/CAUACAAAAABA/xYjAAAAAAAAAAAA
      AAAAAAAAAADw//D//wok9H8AD/z/AZsA3QoAF/IGAQEDAQAA
      </data>
      <key>IOS_IE</key>
      <dict>
         <key>IOS_IE_FEATURES</key>
         <data>AQAA</data>
         <key>IOS_IE_FEATURE_VERSION</key>
         <integer>1</integer>
         <key>IOS_IE_FEATURE_WOW_DISALLOWED</key>
         <true />
      </dict>
</code>```

User @hewigovens found a private method determine if it is a personal hotspot based on the IOS_IE (ref):

```<code>char -[CWNetwork(Private) isPersonalHotspot](void * self, void * _cmd) {
    eax = [*(self + 0x4) objectForKey:@"IOS_IE"];
    eax = LOBYTE(eax != 0x0 ? 0x1 : 0x0) & 0xff;
    return eax;
}
</code>```

At minimum I think this should be enough for us to determine which bit(s) encode if it is hotspot.

Unanswered questions

What do IOS_IE_FEATURES / IOS_IE_FEATURE_VERSION / IOS_IE_FEATURE_WOW_DISALLOWED represent? How do they map to the vendor tag?

I had a different vendor tag then yichya.dev 06 01 01 03 03 00 00 vs. 06 01 01 03 01 00 00 but the decoded XML elements were the same.

IOS_IE_FEATURE_WOW_DISALLOWED might represent Woke on Wireless, but not sure if that is configurable to test.

Also can we get more insight from the CoreWLAN implementation?

This same vendor tag might be used for CarPlay networks, what does it look like in a trace?

Was this tag used with AirPort routers? Do we have examples?

For iPhone and personal hotspot are there any settings I can change to see if results in any changes?

Attempting to decode

<s>The first octet is probably the length: 06</s>

Edit: The first octet is the Vendor Specific OUI Type. In this case 06. For the same OUI (00:17:f2) iOS devices also uses OUI Type 10 in the Probe Request and Associate Request (ref)

Decoding IOS_IE_FEATURES value AQAA from base64 gives us 01 00 00 which doesn't directly map the vendor tag for either example, but it might just be the first octet that matters.

One of the octets is probably IOS_IE_FEATURE_VERSION: 01

The next octet matches for both, but unsure the meaning: 03

The final octet is 01 for them and 03 for me.


问:
Santander US - app
I am trying to see the requests of santander us app, but the app in the emulator crashes on open, crashes when using frida, and crashes when I recompile it using apk tool. I also used uber apk signer. I am not trying to hack the app, just studying it and the possible security resourses it uses. Can some one help me please?</p>

Title: Santander US - app


问:
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit the program, patch out this function and replace the binary, and run the program again, it still has the configuration information stored, but this storage does not persist between reboots. I am looking for how this program might be storing the information that it read in. I have already looked for temporary files, but it does not appear to be creating any new files related to the config data that I am looking for.</p>


问:
Why i cant see source code from this dll
// PE file does not contain any managed metadata.


问:
What is the ELF .got section used for?
I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.

When the program tries to call an imported function which is lazy binded, it does so by calling the plt procedure. In case the entry has not yet been resolved, the jump in the plt section jumps to the address pointed by in the .got.plt section, which points back to the .plt section, where arguments are set up for the dlresolve (an index to the JMPREL, among other things, if I'm understanding correctly). The .plt then resolves the address of the function and calls it with the provided arguments. In the next call, when the function has already been resolved, the .plt section jumps again to the address pointed to by the .got.plt section, which now contains the resolved address of the function (so that it doesn't jump back to the .plt section).

It seems that in both cases only the .plt and .got.plt sections are involved, so I'm struggling to understand what's the purpose of the .got section. I read somewhere that it contains the global variables, but that seem to reside in the .data section, so I don't think that's really it.

Thanks!

Title: What is the ELF .got section used for?


问:
How to encode file lua and resource files

I am trying to decrypt luas files it use cocos2dx but its encrypted maybe aes encryption.
With frida i can extract most lua files but not all.
And with ida64 i cant find the key.


问:
How we capture serial data on wirshark
I have capture this data but I am not understanding this data

Title: How we capture serial data on wirshark


问:
Decoding set of byte arrays representing light spectrum
I have a small spectrometer that measures in the spectral range of 740-1070nm. The device is commercial, and used to send the raw data to the manufacturer's server for decoding, but that does not seem to work any more, so I'm hoping to decode the raw data.

I have managed to make the device scan and output bytes, which it returns as follows:

sample: 1800 bytes

sampleDark: 1800 bytes

sampleGradient: 1656 bytes

The server used to return 331 floats between 0 and 1 representing the reflectance spectrum. I expect the calculation to be something along the lines of:

At this point, I'm unable to decode the bytes to any kind of numeric values that make sense and have 331 values. Below, I'm attaching an example as Base64, with the expected reflectance output (From an old scan). Based on a discussion, it appears that the data is encrypted and compressed. Maybe the metadata can help decode it? How do we test encryption methods and compression in order to extract the image data?

Here are a number of example scans with the device, along with some metadata: https://github.com/kebasaa/SCIO-read/tree/master/01_rawdata/scan_json

Here are a some example scans with expected output: https://github.com/kebasaa/SCIO-read/tree/master/01_rawdata/log_extracted

Can someone help and/or point me in a direction that could help me decode this? Thanks!

EDIT: Added multiple example scans and some with expected outputs

EDIT: Made problem description more precise


问:
Editing the name table in the PE file import directory
There are a lot of dll-files compiled using wchar types.
On the other hand - there is an exe file compiled using unsigned char types.
My idea is to rename the mangled names in the exe file's import directory so that it can use those dll files.

as example:

```<code>wchar_t const * __cdecl fun(void)
unsigned short const * __cdecl fun(void)

?fun@@YAPB_WXZ
?fun@@YAPBGXZ
</code>```

Tried CFF Explorer but it seems to be more of a problem than a result. It truncates names to their original length.

I, however, would like to have such a program in which it was possible to rename imported functions without any problems, without worrying about the length of function names.


问:
How to patch instruction with a call to a thunk function?
I started to use ghidra to begin doing some crackmes, and I need to change an instruction to a call to a thunk function. However, when I export the program back, I get a segfault.

Inspecting it with gdb, it looks like the jump address points an area with null bytes (there is one quite near the jump location)

```<code>segfault : 0x555556c700b8  add    BYTE PTR [rax],al
</code>```

Also, as I was typing the new instruction in ghidra, it proposed me several opcodes, with no label to differentiate them, and for example, some of them would display another function afterward if I click on them (with the same function name, different namespace since the program was c++). Also, there was opcodes with 5 bytes, and other with 6...

How to know which one is the right one ?


问:
Bypass SSL pinning for android application
I am trying to analyze the network traffic from an android application for research purpose. I tried few approaches but unable to achieve the results. I am using rooted android emulator.

I tried to setup MITMproxy and the Frida to watch the
network traffic from app. But unfortunately SSL pinning is not
allowing me to do so.

Tried to use Android 5 and 6 ,but the app was incompatible with older versions of
OS. So I decompiled the app using apktool and tried change minsdkversion,
targetsdkversion in manifest file but was not able to build APK again.

I did not found the older version of APK which could have been installed on Android 5.

I came to know about the Exposed installer which can be use to
work around SSL pinning. But unfortunately there portal is not responding to get
required archives.

In first approach,I used MITMproxy and Frida. I followed the following steps:

Did basic setup, installed emulator, ADB, Frida, Mitm-proxy,added CA certificate to device and downloaded frida-script.

setTimeout(function(){
 Java.perform(function (){
     console.log("");
     console.log("[.] Cert Pinning Bypass/Re-Pinning");

     var CertificateFactory = Java.use("java.security.cert.CertificateFactory");
     var FileInputStream = Java.use("java.io.FileInputStream");
     var BufferedInputStream = Java.use("java.io.BufferedInputStream");
     var X509Certificate = Java.use("java.security.cert.X509Certificate");
     var KeyStore = Java.use("java.security.KeyStore");
     var TrustManagerFactory = Java.use("javax.net.ssl.TrustManagerFactory");
     var SSLContext = Java.use("javax.net.ssl.SSLContext");

     // Load CAs from an InputStream
     console.log("[+] Loading our CA...")
     var cf = CertificateFactory.getInstance("X.509");

     try {
         var fileInputStream = FileInputStream.$new("/data/local/tmp/cert-der.crt");
     }
     catch(err) {
         console.log("[o] " + err);
     }

     var bufferedInputStream = BufferedInputStream.$new(fileInputStream);
     var ca = cf.generateCertificate(bufferedInputStream);
     bufferedInputStream.close();

     var certInfo = Java.cast(ca, X509Certificate);
     console.log("[o] Our CA Info: " + certInfo.getSubjectDN());

     // Create a KeyStore containing our trusted CAs
     console.log("[+] Creating a KeyStore for our CA...");
     var keyStoreType = KeyStore.getDefaultType();
     var keyStore = KeyStore.getInstance(keyStoreType);
     keyStore.load(null, null);
     keyStore.setCertificateEntry("ca", ca);

     // Create a TrustManager that trusts the CAs in our KeyStore
     console.log("[+] Creating a TrustManager that trusts the CA in our KeyStore...");
     var tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
     var tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
     tmf.init(keyStore);
     console.log("[+] Our TrustManager is ready...");

     console.log("[+] Hijacking SSLContext methods now...")
     console.log("[-] Waiting for the app to invoke SSLContext.init()...")

     SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").implementation = function(a,b,c) {
         console.log("[o] App invoked javax.net.ssl.SSLContext.init...");
         SSLContext.init.overload("[Ljavax.net.ssl.KeyManager;", "[Ljavax.net.ssl.TrustManager;", "java.security.SecureRandom").call(this, a, tmf.getTrustManagers(), c);
         console.log("[+] SSLContext initialized with our custom TrustManager!");
     }
 });
},0);
```
<ol start="2">
<li>Connected to device using ADB. And found out the arch version of device. To install
correct frida-server.</li>
</ol>
<pre class="lang-sh prettyprint-override"><code> adb shell getprop ro.product.cpu.abi
</code>```

Pushed required files and CA certificate to the emulator with appropriate permissions.

 $ adb push frida-server /data/local/tmp
 $ adb shell chmod 777 /data/local/tmp/frida-server
 $ adb push cacert.der /data/local/tmp/cert-der.crt
 $ adb push fridascript.js /data/local/tmp
```
<ol start="4">
<li>Started Frida on emulator.</li>
</ol>
<pre class="lang-sh prettyprint-override"><code> $ adb shell
 $ su
 $ /data/local/tmp/frida-server &
</code>```

Listed and located the application.

  $ frida-ps -U
  $ frida-ps -aU | grep -i "app-name"
```
<ol start="6">
<li>Hook fridascript.js into target application</li>
</ol>
<pre class="lang-sh prettyprint-override"><code> $ frida -U -f com.app-name.android -l ./fridascript.js
</code>```

Here is output,

 $  frida -U -f <app-name> -l ./fridascript.js
     ____
    / _  |   Frida 16.0.11 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Galaxy S4 (id=192.xxx.xx.xxx:5555)
Spawned `<app-name>`. Resuming main thread!
[Galaxy S4::<app-name> ]->
[.] Cert Pinning Bypass/Re-Pinning
[+] Loading our CA...
[o] Our CA Info: O=mitmproxy, CN=mitmproxy
[+] Creating a KeyStore for our CA...
[+] Creating a TrustManager that trusts the CA in our KeyStore...
[+] Our TrustManager is ready...
[+] Hijacking SSLContext methods now...
[-] Waiting for the app to invoke SSLContext.init()...
```

The Frida keeps waiting for the SSL context. I did clicked buttons on the app to invoke APIs but did not get any response. Could you please help me to watch the network traffic from android application. Really looking forward to hear from you guys.


问:
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.

On the graph view it is only showing the main function, which is different to the screenshot in the tutorial. Also, I get the below errors about signature files:

Could not find signature file 'vc32_14'

Could not find signature file 'vc32ucrt'

Unless I am mistaken, I think it is because I need to use an older version of IDA which includes those signature files, or I need to find the signature files and put them into C:\Program Files\IDA Freeware 8.2\sig\pc where they are currently missing.

A) Where can I download IDA Free version 7.2 because the Hex-Rays website is only showing the newer version 8.2

B) Additionally, is there a place where I could download missing signature files

Edit:

Title: Finding older IDA files


问:
is there any way to find that a firewall is protecting a server and showing all ports closed in nmap?
I am using nmap to scan open ports on a device which uses FTP protocol to transfer firmware for update. But it is showing all 1000 ports are closed.

It comes with a software to update its firmware. When we connect device to computer and use ifconfig to list IP addresses connected with device, it shows new IP address which is used by that device. Using wireshark we can monitor all protocols used by that software and device to communicate with each other. But there is no mention of FTP protocol in wireshark output. only SSDP, LLDP and MDNS protocols are used. I want to know how that software is transferring data to device when all ports are closed (as shown in Nmap output). If ports are protected using firewall, is there any way to bypass that firewall? and how to identify that firewall first. Please help and if I missed some points which I must mention to explain my problem then please comment.

Link to wireshark output - here


问:
Get all names of functions from an iOS-App binary (headless)
Setup:

I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can access the binary file.

What I expect to happen:

When I disassemble the binary, I expect the used function and variable names to be displayed in the resulting disassembled code, so I can create a list of all built-in functions and variables. I am only interested in functions and variables that are apple built-in ones (from apple frameworks), and not in custom functions or functions from third-party frameworks.

What actually happens:

With Ghidra in headless mode, for nearly all functions and variables, the disassembled code doesn't contain their actual names but rather their entry points. For example, the function locationManager:didUpdateLocations: is displayed with its actual name in the assembly, while startUpdatingLocation is not even listed as function but rather as data variable. Other functions implemented in the app have names like FUN_100015d80.

What I tried:

Get the symbol table and get a connection between the entries and the function and variable names in the disassembled code. However, even in the symbol table they are referred to as FUN_100015d80 for example.

I know that FUN_100015d80 is actually the function in which startUpdatingLocation is called because I searched for startUpdatingLocation in the disassembled code (to be precise, I searched within the Ghidra GUI version) and startUpdatingLocation was in the comment of this very function only. However, I need this search to be executed headless.

The ultimate goal would be to get the name of functions who can actually be called. So if the code contains a function which is never called, or just called from within another function, who itself is never called, I want to exclude this function from the list.

Additionally I want to use free software for this, since it is a project for university and it should be integrated into a larger software.

How can I get a list of the actual names of functions and variables used within an iOS-App by using only free software?

PS: I am new to reverse engineering, so please point out if there are any mistakes in my approach.

EDIT

I managed to find somewhat of a workaround. It is not quite what I want but it helps partly at least.

I collect each data variable with its address and with its referenced addresses. The same goes for the symbols. Then I iterate over all functions and store all addresses which are in the functions namespaces. Thereafter, for each data variable and each symbol I check if their addresses or references are within a functions namespace. If that is the case, I parse the respective value of the data variables and the symbols to equal their actual name. This way I get a list of functions and variables used. However, this is a pretty dirty workaround and not exactly what I am looking for.


问:
Means of different call label formats in IDA
What is of different label formats of call instruction means in IDA?

Like:

```<code>call  Cla$ENABEL
call  ds:Cla$PushString
call  ds:GETNAME@Folosososososos
</code>```

Thanks

ContentLicense: CC BY-SA 3.0


问:
Determining power supply needs for a first class, reclining airplane seat
I have a Sicma Majesty 1606 seat pair from a retired Boeing 767-300. My goal is to provide power and get them working as reasonably functional and fun home furniture for a living room. I'm documenting the process on a GitHub repo, and there may be useful background information there.

These seats have motors that control several seat position functions and appear similar to the kind that are used in powered recliners typically sold as home furniture. There is an electronics box under the left seat (labeled "PGA Electronic PN: P78621B470 'ECU Electronic Control Unit (FCBE)'") that appears to take input from two passenger control panels. I would like to provide power to this box so that the power-recliner functions of these seats can be used in the home.

There is a second box under the right seat (also labeled "PGA Electronics") wired to the ECU, which appears to be a power supply for this ECU. A label on the back of this box suggests that it takes 115V 400Hz power as input. However, there is no indication on the outside of the box what power it would provide through a multi-conductor wire that connects to the ECU box. I haven't been able to remove this power box from the seats in order to open it up, and I haven't been able to open it up yet while it's still inside the seat. Home recliners (or, rather, the motors used by these recliners) appear to work on 24-29V DC power, and often have a power adapter that takes mains AC power from a wall source to a DC voltage that the recliner control box can use, so my hypothesis is that this box under the right seat is a power supply that will take the aircraft power (115V 400Hz AC) and convert it to a DC voltage that is used by the ECU.

I can find various DC power supplies for powered recliners for sale online, so if my hypothesis is correct, I think I can simply replace the power supply box under the right seat with something that will take wall power and output the appropriate DC voltage, in order to get the ECU under the left seat to operate as it normally would when installed in the aircraft.

Since I'm unable to provide 115V400Hz AC power at home, however, I need some other way to determine what voltage is output by this power supply box, and which of the output conductors is which--power and ground.

Since I haven't been able to get either of these boxes out of the seat in order to get it open (and perhaps look for markings screen-printed on any PCBs inside), is there any other way to figure out this information?

If I simply try providing wall power at 115V60Hz to the in-seat power supply, is it likely to be able to operate anywhere close to what it would do with 115V400Hz? Would it be enough to figure out what the appropriate voltage is that I would need to replace it with? Would that be likely to cause any harm to the power supply or the ECU?


问:
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours method, how can I overcome this problem? I searched for an exe that uses dynamic loading via pe-bear and the import directory seems to be empty, I guess that's why my hooking process is not working. Is there any way to expose the export directory in applications that use dynamic loading?

Thank you in advance for your help...

//implant.exe the code I mentioned above, which I reviewed with pe-bear
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "helpers.h"
#include<stdio.h>

#pragma comment(linker, "/entry:WinMain")

typedef BOOL (WINAPI * CreateProcessA_t)(
  LPCSTR                lpApplicationName,
  LPSTR                 lpCommandLine,
  LPSECURITY_ATTRIBUTES lpProcessAttributes,
  LPSECURITY_ATTRIBUTES lpThreadAttributes,
  BOOL                  bInheritHandles,
  DWORD                 dwCreationFlags,
  LPVOID                lpEnvironment,
  LPCSTR                lpCurrentDirectory,
  LPSTARTUPINFOA        lpStartupInfo,
  LPPROCESS_INFORMATION lpProcessInformation
);

typedef DWORD (WINAPI * WaitForSingleObject_t)(
  HANDLE hHandle,
  DWORD  dwMilliseconds
);

typedef BOOL (WINAPI * CloseHandle_t)(
  HANDLE hObject
);

//int main(void) {
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    LPSTR lpCmdLine, int nCmdShow) {

    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    ZeroMemory( &si, sizeof(si) );
    si.cb = sizeof(si);
    ZeroMemory( &pi, sizeof(pi) );

    CreateProcessA_t pCreateProcessA = (CreateProcessA_t) hlpGetProcAddress(hlpGetModuleHandle(L"KERNEL32.DLL"), "CreateProcessA");
    WaitForSingleObject_t pWaitForSingleObject = (WaitForSingleObject_t) hlpGetProcAddress(hlpGetModuleHandle(L"KERNEL32.DLL"), "WaitForSingleObject");
    CloseHandle_t pCloseHandle = (CloseHandle_t) hlpGetProcAddress(hlpGetModuleHandle(L"KERNEL32.DLL"), "CloseHandle");

    if (!pCreateProcessA( NULL,   // No module name
                    "c:\\Windows\\System32\\notepad.exe",
                    NULL,           // Process handle not inheritable
                    NULL,           // Thread handle not inheritable
                    FALSE,          // Set handle inheritance to FALSE
                    0,              // No creation flags
                    NULL,           // Use parent's environment block
                    NULL,           // Use parent's starting directory
                    &si,            // Pointer to STARTUPINFO structure
                    &pi )           // Pointer to PROCESS_INFORMATION structure
            ) {
        //printf( "CreateProcess failed (%d).\n", GetLastError() );
        return -1;
    }

    pWaitForSingleObject( pi.hProcess, INFINITE );

    // Close process and thread handles.
    pCloseHandle( pi.hProcess );
    pCloseHandle( pi.hThread );

    return 0;
}
```


问:
How do I make a text field editable when the app is designed to autofill OTP SMS?
Hello fellow rev engineers,

I'm running an app in an emulator and the problem is that for registration it must autofill the OTP sent by SMS, the text field isn't editable/clickable and I can't advance from this stage.

I looked through the activity code and tried to add attributes like android:clickable=true, visibility, input text, etc to no avail. The field remains greyed out and simply wants to autofill.

What's a  trick up your sleeve to get past this?

Here's the code for reference:

```<code><LinearLayout android:orientation="vertical" android:layout_width="fill_parent" android:layout_height="wrap_content">
            <com.app.TextView android:textSize="@dimen/reg_title_size" android:textColor="@color/register_title_color" android:gravity="center" android:layout_gravity="center" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="30.0dip" android:layout_marginTop="20.0dip" android:layout_marginRight="30.0dip" android:text="@string/register_active_service_label" app:text_font="@string/font_bold" />
            <com.app.TextView android:textSize="@dimen/reg_subtitle_size" android:textColor="@color/black" android:gravity="center" android:layout_gravity="center" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="30.0dip" android:layout_marginTop="15.0dip" android:layout_marginRight="30.0dip" android:text="@string/register_insert_info" app:text_font="@string/font_regular" />
    ------> <com.components.edittext.XEditText android:textSize="@dimen/reg_editbox_size" android:textColor="@color/black" android:textColorHint="#ff6d6d6d" android:id="@id/key" android:tag="binding_2" android:background="@color/edittext_bg_color" android:layout_width="fill_parent" android:layout_height="35.0dip" android:layout_marginLeft="40.0dip" android:layout_marginTop="80.0dip" android:layout_marginRight="40.0dip" android:hint="@string/hint_entry" android:textAlignment="center" app:edit_font="@string/font_regular" app:regex="@string/regex_alphanumeric" />
            <com.app.TextView android:textSize="14.0sp" android:textColor="@color/gray" android:gravity="center" android:layout_gravity="center" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="40.0dip" android:layout_marginTop="20.0dip" android:layout_marginRight="40.0dip" android:text="@string/keyconfirmation_helper_msg" app:text_font="@string/font_condensed_italic" />
            <com.app.TextView android:textSize="14.0sp" android:textColor="@color/gray" android:gravity="center" android:layout_gravity="center" android:id="@id/trysLeftlbl" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="40.0dip" android:layout_marginTop="10.0dip" android:layout_marginRight="40.0dip" app:text_font="@string/font_condensed_italic" />
            <com.app.TextView android:textSize="@dimen/reg_subtitle_size" android:textColor="@color/blue_button" android:id="@id/requestNewSmsBtn" android:clickable="true" android:layout_width="fill_parent" android:layout_height="wrap_content" android:layout_marginLeft="30.0dip" android:layout_marginTop="10.0dip" android:layout_marginRight="30.0dip" android:text="@string/request_new_sms" android:textAlignment="center" app:text_font="@string/font_regular" />
</LinearLayout>
</code>```


问:
How to decrypt query string of an url
I need to decrypt the encoded part of query string  i.e.  Q7eM0euncHNyrhJPjN06lw== and sWmYdMUi01BJplzumEaxTw== from the following urls?

https://eregistration.gov.bd/deed-check/view-deed-summary?encApplicationId=Q7eM0euncHNyrhJPjN06lw==

https://eregistration.gov.bd/deed-check/view-deed-summary?encApplicationId=sWmYdMUi01BJplzumEaxTw==

I suspect there is a relation between the content rendered from accessing those urls and above urls.

I have google translated both of the above urls to check if there is any relation.

https://eregistration-gov-bd.translate.goog/deed-check/view-deed-summary?encApplicationId=Q7eM0euncHNyrhJPjN06lw%3D%3D&_x_tr_sl=bn&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

https://eregistration-gov-bd.translate.goog/deed-check/view-deed-summary?encApplicationId=sWmYdMUi01BJplzumEaxTw%3D%3D&_x_tr_sl=bn&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

Thanks in advance.

Title: How to decrypt query string of an url


问:
How do i set these tricky boolean values to true in Smali-Dalvik?
These would allow me to make the input text field clickable and editable but the thing is how to do this.

Instance field

```<code>.field private g:Z
</code>```

1 -

```<code> invoke-virtual {p1, p2, v0}, Landroid/content/res/TypedArray;->getBoolean(IZ)Z

move-result p2

invoke-virtual {p0, p2}, Lcom/google/android/material/textfield/TextInputEditText;->setTextInputLayoutFocusedRectEnabled(Z)V
</code>```

2 - Which call this one:

```<code>.method public setTextInputLayoutFocusedRectEnabled(Z)V
.locals 0

iput-boolean p1, p0, Lcom/google/android/material/textfield/TextInputEditText;->g:Z

return-void
</code>```

.end method


问:
Ghidra not loading classes and types of external library
I'm analyzing a mac OS framework, and while redefining types in the decompilation view,

I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation framework that is in the Imports tree:

I've added this frameworks as a program to the project, analyzed it, and set it as external program in the imports tree for my first framework:

Now after doing all this I still cannot use the classes and types defined from CoreFoundation or any other external library. I even tried to run FixupELFExternalSymbolsScript.java plugin but it only works for ELF and not Mach-O.

What can I do for my first framework which depends on the types and classes defined in other frameworks to be able to access them so I could use them in the decompiler view?

If it matters I'm analyzing these macOS frameworks on a Windows host.


问:
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.

I am going through a malware analysis course and following the debugging process of the trainer in the video, when I am trying to debug the same malware on my system, I am not able to hit the same break points as him.

I am using x32Dbg for debugging.

The following are some examples of the issue -

The API CreateProcessInternalW hits for him but never hits for me in any malware sample.

The API WriteProcessMemory hits for him but never hits for me in any malware sample.

On stepping over VirtualAlloc breakpoint, for him the API is VirtualAllocEx and for me its NtAllocateVirtualMemory

On stepping over VirtualProtect breakpoint, for him the API is VirtualProtectEx and for me its zwprotectvirtualmemory

The following are the things I have tried -

I have made sure that the tutor and me are running the same operating system (Windows 10)

I have tried to use both 64bit and 32bit versions of Windows 10

I have made sure I have the same malware sample as the malware samples are provided by the tutor himself and also I have verified the hash of the malware.

I have made sure the difference is not being caused by a Anti-Analysis mechanism of the malware

I have verified the above point by analysing the malware behaviour and found that the malware is being executed the same way as it is for him

Like for one case for a malware, for the tutor the malware was using the CreateProcessInternalW API to call cmd.exe and drop a file in a directory, for me the API doesn't hit but the file is still dropped.

I am not sure what is causing this difference of API calls and trying to fix this issue.

Help would be appreciated.


问:
Using "map to another variable" in IDA
I am using in IDA. There is a feature which is called "map to another variable".
but it asks from me to map from the variable from a list. How do u know the exact variable to map into ? (I can assume which variable, but it could be a mistake and continuing in reverse engineering the program could lead to mistakes in next). In Ghidra, it figures the correct variable by itself.

Are there any tips for IDA users ?

Is there any automation for IDA like in Ghidra ?

Title: Using "map to another variable" in IDA


问:
How to extract the firmware from the flash chip of the router?
Hi, I've been struggling with a subject since 2 weeks.

I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that OS. So I think they ported OpenWrt for this device so there are no known firmware on the internet for this device.

I extracted the content of the flash chip into firmware.bin, flash is gd25q127c nor flash.

According to U-Boot output of the router, I have this memory mapping:

Creating 11 MTD partitions on "spi0.0":

0x000000000000-0x000000030000 : "u-boot"

0x000000030000-0x000000040000 : "u-boot-env"

0x000000040000-0x000000050000 : "Factory"

0x000000050000-0x000000150000 : "kernel"

0x000000150000-0x000000720000 : "rootfs"

mtd: root_zone=0

mtd: partition "rootfs" set to be root filesystem

0x000000720000-0x000000820000 : "kernel2"

0x000000820000-0x000000df0000 : "rootfs2"

0x000000df0000-0x000000ff0000 : "rootfs_data"

0x000000ff0000-0x000001000000 : "vendor"

0x000000050000-0x000000720000 : "firmware"

0x000000720000-0x000000df0000 : "firmware2"

When I binwalk the .bin file, I get this output:

DECIMAL       HEXADECIMAL     DESCRIPTION

----------------------------------------------------------------------------------------------------------------------------------

73680         0x11FD0         U-Boot version string, "U-Boot 1.1.3 (Sep 18 2018 - 16:47:56)"

327696        0x50010         uImage header, header size: 64 bytes, header CRC: 0x41E8CEF2, created: 2018-10-30 04:57:02, image
size: 965681 bytes, Data Address: 0x88000000, Entry Point: 0x88000000, data CRC: 0x94204675, OS:
Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt
Linux-2.6.32.27"

327760        0x50050         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 2837756
bytes

1376256       0x150000        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3359661 bytes, 1572
inodes, blocksize: 131072 bytes, created: 2018-10-30 04:56:57

7471120       0x720010        uImage header, header size: 64 bytes, header CRC: 0x41E8CEF2, created: 2018-10-30 04:57:02, image
size: 965681 bytes, Data Address: 0x88000000, Entry Point: 0x88000000, data CRC: 0x94204675, OS:
Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt
Linux-2.6.32.27"

7471184       0x720050        LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 2837756
bytes

8519680       0x820000        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3359661 bytes, 1572
inodes, blocksize: 131072 bytes, created: 2018-10-30 04:56:57

14614528      0xDF0000        JFFS2 filesystem, little endian

16711680      0xFF0000        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 17055 bytes, 33 inodes,
blocksize: 131072 bytes, created: 2017-04-25 08:44:25

It seems like there are 2 firmwares installed, I can confirm this by checking the U-boot output:

U-Boot 1.1.3 (Sep 18 2018 - 16:47:56)

Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fb8000

enable ephy clock...done. rf reg 29 = 5

SSC disabled.

spi_wait_nsec: 29

spi device id: c8 40 18 c8 40 (4018c840)

find flash: GD25Q127C

raspi_read: from:30000 len:1000

raspi_read: from:30000 len:1000

============================================

Ralink UBoot Version: 4.2.1.0 r18163

--------------------------------------------

ASIC 7620_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: 16 MBytes NOR Flash

Date:Sep 18 2018  Time:16:47:56

============================================

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768

The CPU freq = 580 MHZ

estimate memory size =64 Mbytes

raspi_read: from:50010 len:40

raspi_read: from:720010 len:40

=================================================

Check image validation:

Image1 Header Magic Number --> OK

Image2 Header Magic Number --> OK

Image1 Header Checksum --> OK

Image2 Header Checksum --> OK

Image1 Data Checksum --> raspi_read: from:50050 len:ebc31

OK

Image2 Data Checksum --> raspi_read: from:720050 len:ebc31

OK

Image1 Stable Flag --> Stable

Image1 Try Counter --> 0

Image2 Stable Flag --> Not stable

Image2 Try Counter --> 0

Image1: OK Image2: OK root_zone: 0

I tried to extract each firmware with dd by taking uImage, LZMA compressed data and Squashfs folder and created .bin files out of them. But to no avail I get "invalid model" error by doing tftp boot, openwrt sysupgrade from root file system or using the web interface to flash the firmware.

Does anybody know how can I extract the firmware out of this flash file system? I need urgent help.


问:
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:

What does it mean the X in the flag column? So, what is a/the flag?

Thanks to all


问:
Why would a packet-based protocol occasionally XOR it's payload?
I'm REing the Bluetooth protocol for the Ecoflow Delta 2 power station, and so far I've had some success. But there's a strange behaviour that, while not hampering my efforts, has me puzzled.

The packets come as a 16 byte header, a variable length payload, and a 2 byte CRC. The header contains the sorts of things you would expect: a magic number, payload length, and message type. But there's a 1-byte field that is used to XOR the payload. Most of the time this field is 0, but there are occasional runs of 0x34, 0x25, and rarely 0x28. I've not observed any other values, but they might occur. The CRC is calculated based on the raw payload, not the cleartext version.

I'm struggling to figure out why the designers should have done such a thing. It can't be for encryption because the field is 0 more often than not. It can't be for error-checking because the CRC is calculated on the "encrypted" array - and there's a CRC anyway.

There doesn't seem to be a pattern in the number of messages that are XORed either.


问:
How can I learn VMP analysis？
I am currently interested in learning reverse engineering, and I have a

foundation in assembly,

PE structure,

and the use of Win32Api.

And also I have some the foundation for writing windows drivers;

I Can use IDA to analyze assembly code without confusion.

How can I learn VMProtect restoration analysis?

I am not a native english speaker,sorry for my pool English!

Title: How can I learn VMP analysis？


问:
BIOS serial number and UUID tampering
what happens if I tampered the serial number in the bios of a laptop? This laptop was issued to us by our company and what happened was we were laid out without any compensation for what happened so I decided to keep this laptop however after installing windows OS it was frozen because it was reported as stolen or lost, Is there a way to bypass this? I successfully made a reset in the BIOS admin password and now this is my current problem. By the way the handset was HP elitebook 840 g8</p>

Title: BIOS serial number and UUID tampering


问:
x32dbg version causes crash on breakpoint
i'm a newbie to this whole shindig, and have started with  https://gamehacking.academy. i'm finding this fun, but am getting stuck here:  when i try to apply a breakpoint using x32dbg, as in https://gamehacking.academy/lesson/2/4, and the execution reaches it; my VM crashes totally?
is this a problem with the x32dbg or something else?  thanks!
FWIW, this does not happen for 64-bit versions on the same program.</p>


问:
How to read the content of these files?
I am looking for a way to read the content of these two files. If that is possible, please let me know.

Google Drive link for the files

Title: How to read the content of these files?


问:
remove the computrace by flashing the bios
Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with absolute computrace persistence and was reported as stolen and was frozen. Is there a way to remove the computrace?</p>


问:
How to edite a compiled Reactive Native file "main.bundle"
I bought I vacuum robot from Dreame and needed to replace the Lidar sensor myself as in my country (Brazil) don't have technical assistance, but now it is not working properly because it says that don't have a calibration file to Lidar sensor and the menu for calibration is hidden in the APP, I need change one line in "main.bundle" file to be enable the hidden menu, but I tried in Notepad, VSCode, NotePad++ and others, most part of code is readable, but in the begning of the file have some info that is not decode corectly, and if I try to edit and save it not work correctly. Is there some way to reverse engenigering this file?

The file is below:

https://1drv.ms/u/s!AkhlsFXbkbX4oIFHQ3gEFl19OTPTEA?e=I0kIrA

And I need remove following code, to enable the hidden menu.

&& data.data.indexOf(_miot.Service.account.ID) >= 0


问:
How does google.com detect I'm in Firefox when already using Chrome's user agent
It's well known that google.com doesn't show the microphone search icon in Firefox, probably to incentivize people to use their web browser. (They give it on youtube.com, which is weird for being inconsistent). I thought that setting the user agent in Firefox to the latest Chrome's user agent (Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36) would be enough, but now, instead of not showing the microphone icon, it weirdly flickers, as in the video here https://youtu.be/UpYh20YVIh4

Why does this happen? I tried to understand what javascript is causing that, but I failed as I have no experience debugging web apps on Firefox.

I don't know what causes this, either Firefox or client side js?


问:
IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?
I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is:

```<code>flag = 0;
for ( i = 0; i < 10; i++ )
{
  if ( flag )
    buff[i - 1] = buff[i];
  if ( buff[i] == 4700 )
    flag = 1;
}
</code>```

But IDA decompiles it as:

```<code>flag = 0;
for ( i = 0; i < cntr; i++ )
{
  if ( flag )
    *(&the_adr_just_before_buff + i) = buff[i];
  if ( buff[i] == 4700)
    flag = 1;
}
</code>```

How can I solve this issue on IDA?


问:
How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?
I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail.

I'm originally a Windows programmer, and I am also a reverse engineer. The way I can see why some API doesn't work (on Windows) is usually by stepping into it with a live debugger/disassembler. This is what I want to do with the NSSavePanel.runModal() call. But I'm kinda new to macOS.

So to test the concept, I built a simple C++ app with the Xcode (natively for ARM64 architecture, with the "release" configuration):

```<code>int main(int argc, const char * argv[])
{
    if(argc > 2)
    {
        int a = atoi(argv[1]);
        int b = atoi(argv[2]);
        int c = a / b;

        printf("v=%d\n", c);
    }

    return 0;
}
</code>```

I then configured Xcode to "Debug -> Debug Workflow -> Always show disassembly" and set a bp at the start. So I get this:

I can somewhat step-over and -into ARM64 assembly instructions with ^F6 and ^F7 keyboard shortcuts, but the Xcode UI is not really showing values of registers (one needs to type p $register into the console) and to see memory one needs to use "Debug -> Debug Workflow -> View memory" option, which is very clunky.

In other words, Xcode is not the best for this type of low-level debugging.

So I'm wondering, if there's another live debugger/disassembler that can be used for this purpose?


问:
Reverse Engineering Technique "Step by Step"
Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game.

By researching these projects - I come to the conclusion that:
people just took the code from the exe and brought it gradually to an external dll - so they gradually tested the code.
In the end, from the main exe - they had only a small launcher and crt, and the rest of the place, of course, was filled with nop instructions.
They took out the code itself via copy / paste to MASM, and then, the resulting COFF obj-files, were added to the project with their new dll. (code reuse?)

I also have a game project in which I found 3 statically linked libraries in the exe.

Thus, I would also like to get acquainted with this technique in more detail and take it into my arsenal.

If any of you are very familiar with this technique, please share your experience.


问:
How to trace with Frida some specific functions in ARM ending with BX LR
I'am trying to trace down with Frida v16.0.11 (frida-trace) all calls to exported functions from "libssl.so" (Android, 32bit). But turns out that Frida is unable to hook some functions. One part of these functions Frida just skips because can't set a hook (asks user to send a bug report). The other part of these functions just crashes Frida everytime. All of them look pretty much the same, e.g:

```<code>.text:0001D862                 LDR             R2, [R0,#0x6C]
.text:0001D864                 ORRS            R1, R2
.text:0001D866                 STR             R1, [R0,#0x6C]
.text:0001D868                 MOV             R0, R1
.text:0001D86A                 BX              LR
</code>```

This is SSL_set_mode function, which is in BoringSSL sources looks like:

```<code>uint32_t SSL_set_mode(SSL *ssl, uint32_t mode) {
  ssl->mode |= mode;
  return ssl->mode;
}
</code>```

"Normal" functions with default prologue etc (e.g SSL_read) hook fine.

Am I missing something in Frida docs or there are some limitations in Frida (if so then where I can read about them)?

If I missing something then what is a proper way (if any) to hook such functions?

Thanks.


问:
Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)
I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app.

Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The solution is simple

use Reflector and

go KeyMe->KeyMe.exe->KeyMe->Form1

now Go to the CloseApp() method.

The source appears to be like this :

```<code>  private void CloseApp()
  {
      string str = "papanyquiL";
      for (int i = 0; i < this.textBox1.Text.Length; i++)
      { etc..
</code>```

I won't ask how to get this function if the name would be different. But there are other problems - All my functions aren't visible in the decompiler, only enter function is available. I can't find an Assembler code and code in the solution.

Is GHIDRA ever available to decompile this type of file? It says that it is .NET CLR Managed Code, and that's all I've found.


问:
How can I generated the function call graph (with API calls) of a .NET executable?
For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which means it calls that API).

But FCG generation of IDA doesn't doesn't generate a useful FCG with .NET executables (at least the FCG that I am looking for).

My question is, is there any tool that can analyze and generate a FCG for a .NET executable? I want this FCG to include API calls as well, so function x of class y will be a node, and if that function calls something like WriteConsole, I want that node to connect to WriteConsole API node (preferably with a distinctive coloring).

Basically I want to generate something similar to the following, but for .NET executables:


问:
Contents of EAX in IDA Free?
I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.

In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is missing. How do I see the full string?

I have found that memory location in the stack view and underlined it in red, but I have no idea what to do next.

Title: Contents of EAX in IDA Free?


问:
Replace a function in a Windows 32-bit binary with a custom C function
I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C function, test the game, and proceed incrementally, one function at a time, rather than attempting to get all the decompiled C code working at once.

Some challenges I'm facing:

The game was compiled with Watcom, so it's using its "non-standard" calling convention.

There are global variables everywhere, so the replaced function must be able to access those in the main executable.

I'm aware of projects like KeeperFX and Syndicate Wars port (http://swars.vexillium.org/), which managed to achieve similar goals (e.g., by converting the executable into a DLL).

What are my options for replacing a function in the original binary with a custom C function while addressing the challenges mentioned above?


问:
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:

I can get disassembler variables-

```<code>def get_function_vars(function) -> list:
    frameId = idc.get_frame_id(function)
    if frameId:
        varStruct = ida_struct.get_struc(frameId)
        if varStruct:
            return [mem for mem in varStruct.members]
    return []
</code>```

And instruction references-

```<code>def get_variable_refs(function, mem) -> ida_frame.xreflist_t():
    xrefs = ida_frame.xreflist_t()
    ida_frame.build_stkvar_xrefs(xrefs, function, mem)
    return [xref.ea for xref in xrefs]
</code>```

This gives me instructions referred by say - "var_38" -> 2017BB and 2017E6.

I found that I can get hex rays variables by doing something like-

```<code>def get_hexrays_vars(ea) -> dict:
    hexrays_types = {}
    try:
        decompiled = ida_hexrays.decompile(ea)
    except ida_hexrays.DecompilationFailure:
        return {}
    if not decompiled:
        return {}
    for var in decompiled.get_lvars():
        print(var.name)
</code>```

This prints -

```<code>a1
a2
a3
v3
v4
v5
v6
</code>```

Which aligns well with the decompiler view -

Now I want to get the instructions referred by these variables for e.g. one instruction reference for variable "V3" could be 2017D0 as "V3" is the register allocated variable in the register ebp.

One way to do this in binary ninja is for e.g.

```<code>for var in ins.vars_read:
    depd = [(func.mlil[i].address, ins.address)
            for i in func.mlil.get_var_definitions(var)
            if func.mlil[i].address != ins.address]
for var in ins.vars_written:
    depd += [(ins.address, func.mlil[i].address)
            for i in func.mlil.get_var_uses(var)
            if func.mlil[i].address != ins.address]
</code>```

My end goal is to do some data flow analysis. And I thought this might be possible as decompiler is doing this anyways.


问:
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:

```<code>local_18 = dm_shmInit(0);
if (local_18 == 0) {
</code>```
```<code>00405570 3c 1c 00 43     lui        gp,
00405574 27 9c 46 e0     addiu      gp,gp,
00405578 27 bd f9 18     addiu      sp,sp,-
0040557c 8f 99 82 c0     lw         t9,-0x7d40(gp)=>-><EXTERNAL>::dm_shmInit
00405580 af bc 00 18     sw         gp=>_gp,local_6d0(sp)
00405584 af bf 06 e4     sw         ra,local_4(sp)
00405588 af b1 06 e0     sw         s1,local_8(sp)
0040558c af b0 06 dc     sw         s0,local_c(sp)
00405590 a7 a0 00 20     sh         zero,local_6c8(sp)
00405594 a7 a0 00 22     sh         zero,local_6c6(sp)
00405598 a7 a0 00 24     sh         zero,local_6c4(sp)
0040559c a7 a0 00 26     sh         zero,local_6c2(sp)
004055a0 a7 a0 00 28     sh         zero,local_6c0(sp)
004055a4 a7 a0 00 2a     sh         zero,local_6be(sp)
004055a8 a7 a0 00 2c     sh         zero,local_6bc(sp)
004055ac 03 20 f8 09     jalr       t9=><EXTERNAL>::dm_shmInit
</code>```

How can I patch the binary so that local_18 is set to 0?

Title: How can I patch out shm in Ghidra?


问:
Windbg multiple memory windows
I have tried to open multiple memory windows but I can't.

I tried to find resolution for this on windbg help and on old version it is possible, however on new version I can't find how to open multiple memory windows. Please help me!

Title: Windbg multiple memory windows


问:
How is the language of a font glyph determined?
A glyph holds data such as its name and contour points. But how do you determine where the characters of one language end and another begins? Is there a written standard that says language X starts at index Y and ends at index Z?

In case it matters, I'm referring to .ttf & .otf font files.

I'm unsure if my question fits in this community and I'm struggling to find another, so if there's one better suited, please let me know.

Any info or documentation on this would be greatly appreciated.
Thanks in advance.


问:
I want to learn how to program by orienting myself to the task of reverse engineering
I have to learn programming from scratch and I want to orient my learning in order to be able to reverse engineer to break obfuscators. It would be helpful if you could recommend me what languages, tools and skills I should learn and provide me with your favorite sources: blogs, books, articles, Wikipedia; whatever you find suitable.
In my search I found procedural reverse engineering material but they were really old (2005; 2014), none should work as I expect nowadays, or so I interpret.</p>


Title: Serialized body (Protobuf?)

Body:
There is an application on iOS that collects data and encrypts it in the future. Data is already serialized at entry to the encryption function, they look like this(I tried to decode, restore the scheme, but nothing comes out, I hope for the help of experienced people):

Or like this:

First HEX:

01 61 11 00 35 32 31 2e 33 34 36 35 32 33 01 62 11 00 31 32 2e 36 35
37 33 34 34 01 63 11 00 31 35 37 2e 35 36 33 34 36 37 01 64 a4 03 4d
56 39 35 6a 68 39 4a 56 4e 01 65 24 00 42 43 32 41 35 39 38 36 2d 34
43 37 45 2d 34 46 35 31 2d 38 46 32 30 2d 30 36 37 45 46 35 44 42 43
32 37 34 01 66 04 00 6f c6 52 64 01 67 00 00 01 68 04 00 bc 60 32 36

Second HEX:

01 61 12 00 37 37 2e 36 37 31 37 37 39 35 34 36 35 36 35 39 31 35 01
62 11 00 39 31 2e 31 36 36 32 31 30 36 32 34 30 38 39 31 35 01 63 05
00 31 35 36 2e 30 01 64 0c 00 d0 a0 d0 be d1 81 d1 81 d0 b8 d1 8f 01
65 1d 00 d0 9a d1 83 d1 80 d1 81 d0 ba d0 b0 d1 8f 20 d0 be d0 b1 d0
bb d0 b0 d1 81 d1 82 d1 8c 01 66 04 00 2d 31 2e 30 01 67 24 00 42 31
32 42 38 36 32 38 2d 38 30 39 41 2d 34 41 35 35 2d 39 30 42 39 2d 39
46 44 46 45 41 34 36 36 30 32 33 01 68 04 00 57 69 46 69 01 6a 04 00
63 0a 53 64 01 6c 01 00 00 01 6d 01 00 00 01 6e a4 03 41 6b 34 41 41
77 41 30 41 41 45 34 45 4e 76 62 37 34 33 56 45 56 36 4e 53 4f 61 6d
4b 64 57 37 4d 2b 30 4e 4b 55 6c 67 4e 6c 67 6b 79 64 51 67 42 55 56
5a 4b 35 31 50 4f 57 53 64 54 2f 51 68 49 49 4c 32 54 4e 64 6a 32 36
42 2b 61 47 2b 55 79 74 63 6a 6d 39 41 65 57 7a 6e 64 67 52 57 4f 77
77 44 44 33 46 51 74 55 47 73 54 75 6e 39 33 38 79 57 71 36 43 34 52
44 46 68 6a 30 44 71 33 6d 4b 35 4d 35 37 64 69 61 43 6d 46 44 61 37
78 53 72 5a 65 78 61 37 49 53 78 7a 32 50 6c 6a 69 38 65 2f 34 64 4c
43 46 7a 37 6a 65 79 32 62 70 58 62 46 2f 6d 79 6f 63 38 4b 75 57 70
32 5a 6f 76 38 47 4b 2b 62 55 72 39 5a 6e 75 68 71 45 42 64 6a 6e 4f
30 79 52 57 4e 2b 70 2b 68 53 4f 45 72 37 77 41 4b 2f 6f 51 2f 41 6e
55 50 75 4b 68 63 47 6b 63 62 4f 30 7a 59 70 53 54 69 6a 52 43 44 76
4f 7a 35 79 49 72 30 71 74 61 32 50 38 41 54 56 69 4d 6b 70 5a 32 45
79 78 59 67 30 67 36 54 55 75 57 51 79 6e 6c 52 33 62 4e 70 6c 7a 53
4f 62 43 69 74 6d 4e 38 69 32 73 66 76 63 68 4d 34 51 65 5a 67 66 76
70 4e 4f 52 56 6f 52 51 51 35 49 70 38 65 50 55 38 35 43 6c 68 62 45
38 62 65 37 75 68 58 46 4b 43 4a 70 47 31 36 41 68 42 63 65 2b 79 67
46 50 36 6d 6e 38 46 47 36 41 42 6e 59 4c 58 4e 64 61 45 6f 4c 64 43
67 49 78 41 52 42 4d 48 49 76 6d 69 45 34 59 58 5a 33 5a 77 52 53 63
33 63 79 53 36 31 54 55 51 4b 36 5a 73 78 57 77 41 76 36 53 36 6a 52
55 76 39 2f 31 31 64 33 72 54 30 48 66 77 4b 7a 35 42 47 41 78 55 56
41 75 76 62 71 67 58 59 7a 35 33 61 38 4b 74 68 67 6b 53 67 2f 66 71
43 54 34 68 48 63 44 33 76 39 53 6c 42 6b 61 37 38 51 4b 68 64 39 4b
6a 5a 64 6b 78 33 7a 57 43 38 6f 4b 77 39 67 54 32 6c 35 51 77 46 47
74 53 66 51 71 30 6a 73 59 75 59 54 6a 38 70 56 43 56 34 39 6e 4c 79
53 52 57 46 53 34 4d 41 4f 47 62 76 73 39 63 73 54 38 39 6c 59 36 50
4b 5a 7a 33 31 7a 34 56 59 38 4f 31 54 32 69 6d 58 6f 74 56 77 45 74
5a 6b 2b 59 78 68 32 6d 76 76 79 5a 68 79 6a 54 54 77 77 37 7a 6f 52
4f 68 56 4c 4e 74 71 6a 49 6e 6f 47 41 33 6e 35 4d 58 4e 4e 45 53 34
49 2b 63 35 47 63 79 5a 6a 6b 76 6d 67 33 78 6f 2b 54 7a 4b 4d 75 50
4b 75 35 73 4d 48 41 5a 4f 37 33 79 7a 70 6d 79 46 71 6d 31 71 44 4e
45 73 54 37 55 39 30 62 74 6c 71 42 64 43 66 50 75 71 33 4d 6b 4c 78
61 51 59 43 63 67 74 45 37 74 31 67 33 73 44 5a 6e 59 41 46 70 68 2b
53 69 6a 6b 6e 41 65 38 33 61 44 31 68 57 41 78 63 4d 66 41 52 75 43
76 6f 36 36 65 34 4b 6c 69 44 6c 49 69 74 55 6b 78 55 4a 42 73 6b 2f
4c 38 69 67 67 52 52 4c 45 5a 53 65 47 6c 63 45 36 56 74 61 2b 6e 4f
5a 47 63 55 6c 52 59 77 51 53 45 45 63 42 32 33 7a 76 58 6f 5a 34 47
75 31 31 55 41 4f 5a 34 4a 70 48 47 61 69 73 37 55 56 64 76 4c 36 6d
50 63 4b 30 75 4f 4d 59 56 55 42 6c 59 6a 53 6a 66 56 61 70 30 6d 39
4c 6b 2b 4e 2b 67 63 32 79 4b 50 4a 35 4b 53 73 32 34 4c 71 69 4d 69
66 56 76 66 49 59 64 38 61 56 77 36 39 59 6e 34 76 53 6d 37 68 4f 6f
53 67 72 48 44 49 3d 01 69 04 00 1a f8 e4 b7 01 6b 01 00 30

I need to know how to serialize data like this for reproduce this requests by myself if its possible. Thank you


问:
Cant find the string "AutoOpen" in a macro enabled Word document
So, I was testing a Yara rule which goes like this:

```<code>rule macro_auto_run

{
    meta:
        description = "Document with macro that auto runs"

    strings:
        $s1 = "AutoOpen"
        $s2 = "Workbook_Open"

    condition:
        ($s1 or $s2)
}
</code>```

I created a Word file, then created a macro in the document with the name, AutoOpen, put some code in it and attempted to test it against this rule.

It did not trigger. Then I ran the utility strings on it. It couldn't find the word "AutoOpen". Used another hex editor like HxD, still nothing. Did a Unicode, Ascii search for the string as well. Nothing! I am wondering why.

Edit: Figured out that I need to unzip the archive and then search within those files.


问:
How to see parameters in stack in x64dbg like in OllyDbg for known API calls?
Based on Detailed API call descriptions not available in x64dbg

When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack:

I've installed both plugins: xAnalyzer & APIInfo

But I can't get x64dbg (in this case x32dbg) to show the parameters like Olly:

I tried to right click in CPU window -> xAnalyzer -> Analyze module but didn't make any difference...

Right now I'm using OllyDbg and x32dbg simoultaneusly only because of this... How can I see in x32dbg the parameters like I can see nicely in Olly?


问:
Just router username & password please
I want to convert my ISP hg8240t5 given router from route WAN to bridge WAN mode and they are using PPPoE connection. I also have a backup of the configuration and its file name is "hw_ctree.xml".

```<code>X_HW_HistoryInstance InstanceID="1" X_HW_Password="$28IfoK9A'3$!0vN-a)p8YW}nS=#w0)Ar~pR<Ff=E<{lN<2h'hFY{kl=#CrlEBTJr>~fLr/AIez7EN#CD:Hbjm3@YVH5u_R%N$mxSA$" X_HW_Time="20230503073204" X_HW_SaltVal="deb2c6c2bf37a81d6b76fb36"/>

X_HW_WebUserInfoInstance InstanceID="2" UserName="telecomadmin" Password="$2"\Av%pGcLW{@fgH4j>!C7.dFUNTFkX9,`t&onT3V_5`\:i"tlOy~.p=$`tTKOt(V:K\%(SGp\)9ncwU<ckMj@Q/Hb3w_mNCl'L8D$" UserLevel="0" Enable="1" ModifyPasswordFlag="1" Salt="2cb56abe6310524971333da9" PassMode="3" Alias="cpe-2">

<X_HW_IteratePassword Password="$2.RDBZK4a`J'iK,DZ(rGI*Cs*0^QD)B)++A1G6:x8tJ,9=ZthM4XNU27}3HLPlA$;BDU=KG`lHW~RMhWP:7vc8=Q}c+tDx++/7GCZ$" Salt="e58a3984802ed2e9abc5c4a4" IterateCount="10000" HashType="0"/>
</code>```

I don't know which is administrator user & pass.
Would someone help me to get full access to my router.

Title: Just router username & password please


问:
How to identify encoding algorithm used
I'm using a calendar application, and each date is encoded. I would like to know which algorithm has been used to do this.

Example:

I have a date: 05-10-2023 ('mm-dd-yyyy') and it's encoded string is f3fgJV/I6y7CXfdp2CgyPKG2qCVrHqVXAP6PVXd/HOs=

This application is written in PHP, so there may be algorithms that I'm not aware of.

Any help is appreciated.

Title: How to identify encoding algorithm used


问:
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a signature for the particular MFC DLL version.

For example, if I load old MFCOGL.EXE 1.0.0.1 that uses MFC42.DLL 6.06.8064.0, IDA shows all MFC DLL entries as MFC_nnnn, where nnnn is an ordinal number of the export. Even if I place MFC42.DLL together with the corresponding MFC42.PDB (downloaded from MS Symbol Store) to the same directory, IDA doesn't load PDB for the DLL, just applying the common signature:

File C:\Tmp\4\mfc42.dll is used for module MFC42...

Plugin "eh_parse" not found

Plan  FLIRT signature: Microsoft VisualC 2-14/net runtime

autoload.cfg: vc32rtf.sig autoloads mssdk_win7.til

Type library 'mssdk_win7' loaded. Applying types...

Types applied to 87 names.

Plan  FLIRT signature: MFC 3.1-14.0 32bit

autoload.cfg: vc32mfc.sig autoloads mssdk_win7.til

If I try to load the PDB explicitly, IDA applies it to the main EXE, not to the DLL referenced by the EXE.

If I load the DLL as an additional binary file, IDA doesn't treat it as a PE module.

Ghidra successfully finds and loads all MFC symbols, but IDA is more familiar to me.

Is there a way to instruct IDA to load the PDB?


问:
Identify unknown TI controller
Can anyone ID this TI chip? Looks like some sort of controller (in a older toy keyboard). there is only one other chip on the PCB (the audio amplifier). Quick googling ended on a dead end since the numbers itself dont give usable results

Title: Identify unknown TI controller


问:
Javascript: Compare Control Flow (to evade anti-debug and anti-tamper traps)
When reverse engineering obfuscated javascript, it may be protected by anti-tamper mechanisms.
I have a script which will work when run untouched, but cause a fatal javascript error when run in node after having been beautified.

How can one log the javascript control flow (e.g. when running it via node) to later compare it with a reference to detect where the anti-reverse-engineering mechanisms (anti-debug/anti-tamper) come into effect?


问:
IDA Pro Exports Table Corrupted!
I've been analyzing a dll file and naming the functions, structs, variables, and so on.
A lot of information has been changed and saved, but after the following message appears, the address column of the Export table is not correct.

```<code>The decompiler assumes that the segment '.rdata' is read-only because of its NAME.
All data references to the segment will be replaced by constant values. This may lead to drastic changes in the decompiler's output.
If the segment is not read-only, please change the segment NAME.
In general, the decompiler checks the segment permissions, class, and name to determine if it is ready-only.
</code>```

The addresses in the 'Address' column don't point to the correct position and mismatch the ones in the Functions window. They all point to addresses in .data section.
I have tried to delete the export table and reanalyze, but I don't know how to do it.
I want to know why this happened and how to recover it.

Title: IDA Pro Exports Table Corrupted!


问:
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).

I have identified a function that seems to print text to the console. The text to be printed is passed into the function as a parameter, however Ghidra doesn't seem to be handling the strings properly.

The function is decompiled as follows:

The assembly for this function is:

So Ghidra picks up on the string, however when I attempt to double-click it (to go to it's relevant location), the following error appears:

This is making identifying where strings are utilised extremely hard, as I cannot search for where a string is utilised within the program's code. I don't understand how Ghidra can pickup part of the name of the string, but won't then let me click through to it?

I also seem to be getting a lot of global variables names like this in the disassembly:

And when I go to rename them, I get the following error:

I have no idea if these two issues are related or not?

Any suggestions?

Thanks,
James.