问:
Obfuscated Config Files: EHI Files for HTTP Injector
So I have an ehi file, which is a configuration file for an Android App called HTTP Injector.
Of course when I try to see it as a simple text, I just get random characters.
What tool could I use to start trying to decrypt it?
I don't even know how to start and if someone could point time what type of encryption or obfuscation method was used I would be hugely grateful.

Here is a ehi file for demonstration: https://transfer.sh/91tbh/1_4999527475131187330.ehi

Thank you so much, and if my question is not accepted, please delete it.


问:
Parse / statically analyzing .NET binaries using python
Which libraries do you use to parse and statically analyze .NET binaries?

Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for it, e.g. using pythonnet?

ContentLicense: CC BY-SA 4.0


问:
write radare2 output to a file
I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a file. It prints on the console but doesn't write to a file even after redirection. 'dtd' is working fine and writing to the file. Here in the below code log2.txt comes up empty.

```<code>import r2pipe

r = r2pipe.open('simpleAES', flags=['-d'])
r.cmd('aei')
r.cmd('dc')
r.cmd('e dbg.trace=1')
r.cmd('des 100')

output1 = r.cmd('dtd')
output2 = r.cmd('dte')

f = open("log1.txt", "w")
f.write(output1)
f.close()

f = open("log2.txt", "w")
f.write(output2)
f.close()
</code>```

I am using a simple C code for analysis and using raise(SIGINT); for setting breakpoint in the C program. Do you have any idea how I can write the 'dte' output to a file.

Code that I am debugging:

```<code>#include <signal.h>
#include<stdio.h>
int main (void)
{
    printf("loop started");
    raise(SIGINT);
    int i = 0;
    for (i = 0; i < 10; ++i) {
      printf("Hello ");
    }
    printf("loop completed");
    return 0;
}
</code>```

Title: write radare2 output to a file


问:
How to virtualize part of a code like VMProtect does?
I am a new student in the field of cybersecurity.

I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to virtualize part of my code in VB.NET. However, I do not understand how they operate, and I find it hard to find resources about it. So, I ask myself the following questions:

What functions do these programs use to achieve this virtualization? How do this work, step by step? Obviously, these are private software, so the source code is not given. The virtualization of a part of a code is difficult for me to conceive. It's obviously not about system virtualization like VMware or VirtualBox, but a part of a code. Is the environment changed?

From this last observation, where are the virtualized files stored?
If my virtualized program wants to write to disk, will the data be
written to a virtualized disk?

It may be difficult to answer every detail of each of my questions; I imagine that the domain is complex. Nevertheless, if some elements of answers could be brought, it would help me a lot to better understand :)


问:
Static analysis
I am working on a class project. I need to find out static features of a program (without executing it).

Backward branches (loops)

Conditional branches (potential threads with load imbalance)

Interrupts (indicates synchronization, or IO, ...)

How can I find this. Any help would be highly appreciated.

Title: Static analysis


问:
Recreated LZMA differs from the original after 332 bytes
Recently I decompressed an LZMA file from a VxWorks filesystem which was recognized and decompressed by the LZMA SDK with parameters lc = lp = 0, pb = 2 and dictionary size 8MB. When I recompressed it (without modification, using the same tools and parameters) the first 332 bytes of the output were identical to that of the the original compressed data, but starting from the 333rd byte I didn't find any nontrivial match.

I could use any information regarding what the first 332 bytes could represent, why they are identical in both files while the rest are not, what parameters are most likely to be the culprit in this case or why my LZMA SDK would recreate a changed file when I used the same parameters for compression and decompression. What I want is to recreate the original LZMA exactly as it is, because I'm concerned that the firmware I got the original LZMA from might not recognize the recreated LZMA when I flash it back.

Some information that may help:

I was able to decompress the new output to get the same file decompressed from the original

The recreated LZMA is one byte smaller than the original

The decompressed file (call it decomp) contains some wide characters and vim recognizes its file format as dos. I compiled the LZMA tools for linux. file decomp outputs: decomp: C source, ISO-8859 text, with CRLF line terminators

Let me know of any other relevant info that I should include.

Thanks.


问:
Bufferoverflow Stack
I want to do a buffer overflow exploit in the stack. For this i read in data via the "gets"-function.

```<code>void ExploitMe()
{
  char buffer[256];
  gets(buffer);
}
</code>```

I compile this file with

```<code>gcc test.c -o vuln -z execstack -fno-stack-protector
</code>```

I want to spawn a shell with my bufferoverflow. For this i implemented a nop-slide and put my opcodes to spawn this shell at the end of the nop-slide. After this, I override my return address to an address in my slide.
 Here is my memory:

0x7fffffffde40: 0x90909090 0x90909090  0x90909090  0x90909090
0x7fffffffde50: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffde60: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffde70: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffde80: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffde90: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdea0: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdeb0: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdec0: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffded0: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdee0: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdef0: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdf00: 0x90909090  0x90909090  0x90909090  0x90909090
0x7fffffffdf10: 0x90909090  0x2fbb4890  0x6e69622f  0x4868732f
0x7fffffffdf20: 0x5308ebc1  0x50e78948  0xe6894857  0x050f3bb0
0x7fffffffdf30: 0x42424242  0x42424242  0x42424242  0x42424242
0x7fffffffdf40: 0x42424242  0x42424242  0xffffdea0  0x00007fff

My return address is 0x00007fffffffdea0, which is an addresss in the middle of the nop-slide.

(I got the opcodes from the following assembler code:

0000000000000000 <__start>:
   0:   48 bb 2f 2f 62 69 6e    movabs rbx,0x68732f6e69622f2f
   7:   2f 73 68
   a:   48 c1 eb 08             shr    rbx,0x8
   e:   53                      push   rbx
   f:   48 89 e7                mov    rdi,rsp
  12:   50                      push   rax
  13:   57                      push   rdi
  14:   48 89 e6                mov    rsi,rsp
  17:   b0 3b                   mov    al,0x3b
  19:   0f 05                   syscall
)

When i assemble, link and execute the assembler code, i get a shell as wanted.

When I step each instruction with gdb, a error occurs after the execution of the code to spawn a shell, but no shell is spawned.

When I execute the vulnerable program with the input like seen above outside of gdb, i get a segmentation fault.

Has anybody an idea, why i can't spawn a shell inside or outside of gdb?

I used the following examples:

Liveoverflow: youtube

Arc Network Security: youtube

I use Ubuntu 16.04 and X86-64.

Title: Bufferoverflow Stack


问:
Breakpoints in InProc COM object .dll?
I have a very simple exe that just uses CoCreateInstance to load a COM dll.  This dll contains 1 function.  I know where it is, I know what it's called etc.  I know where in the exe it calls it.  But I am unable to set a breakpoint that triggers using either IDA 7, or OllyDbg 1.1 or 2.0.  Anyone have any tips for getting a functioning breakpoint inside a COM dll?</p>

Title: Breakpoints in InProc COM object .dll?


问:
Trying to understand linkedin's anti-robot system
I noticed something very odd about Linkedin anti-bot behavior and I am not being able to fully understand it. Basically, there are multiple people who set their profiles to public, allowing search engines such as Google to index them. If you initiate an anonymous browsing session and search for a profile, you will get a page that looks like this:

(example for https://www.linkedin.com/in/parag-agrawal-5a14742a)

If you try repeatedly, however, or if you test an automation software such as selenium for accessing these profiles, you will after a while be redirected to an authwall page, and no more public profiles will be visible to you.

I have already tried to hide all kinds of fingerprintable data, such as IP, user agent, screen resolution (for canvas fingerprinting), but after a few requests, my access limit drops to one single public profile. I guess they make an analysis of the request pattern within their servers, making my section identifiable.

I would like to know which features are observed to determine whether a visitor is human or not, and how could I simulate human behavior.


问:
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture and analysis engine.

Does anyone know whether is technically and legally possible?


问:
How to change operator by GDB?
How can I change je to jne via GDB tooL?

Title: How to change operator by GDB?


问:
How can I emulate Huawei routers HG5xx firmware?
i want to pentest some HG routers  in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .</p>


问:
Debugging arbitrary ARM binary image using IDA and QEMU
i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little endian ARM code.
For now i could disassemble it using IDA Pro, but some things need to be checked at runtime.
Therefore i was looking for a way to execute instructions step-by-step, watching the registers, set breakpoints and such.
My binary has no symbols inside.
Is is possible to let QEMU emulate the CPU using "qemu-sytem-arm" and connect this to IDA Pro debugger?
If so, please help me in that, because i'm new to debugging.</p>


问:
How to execute an import exe/dll from memory
i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how  can i do that?</p>


问:
.NET manifest resource format
Currently I'm writing a parser for .NET files and stuck on manifest resources.

My main resources:

Huge documentation

Short summary

For resource format I have found this project made in 2005, all samples have similar structure as described in that project, but I believe it was based on version=1 resources, but now all samples have version=2 resources, structure somewhat similar but different.

I would like to ask for references into resource format or Windows header files with required C/C++ structures to be used or anything else that migth be useful.

Title: .NET manifest resource format


问:
IDA losses renaming and functions border data when debugger starts: is there any workaround?
I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable.

However, as soon as I attach IDA as debugger to device, it losses any data that I entered during static analysis; it for any reason changes functions borders (so, it reanalyzes the application after rebase, and it does it in a buggy way), and it resets any renames, so I debug code in its initial form where nothing has readable name.

Even more, database becomes corrupted, and after I stopped the debugger, I also can not see any renames I did, and the only way to see them again is to restore database from backup.

Does anyone know workaround for this IDA bug? For example, it is possible to force IDA not to reanalyze library during debugging and use database with existing function borders and names?


问:
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.

I'm in a case where some portions of my code contain this type of anti-disassembly trick:

The fact is that without patching the rogue byte, I can't define this undefined blob as a proper function (P shortcut).

So the script is basically doing this:

Find the following opcode: "90 C3 FE" (for "nop, retn, FE", FE is the rogue-byte).

Patch the "FE" byte and replace it by a NOP (0x90).

Define the new NOP as code.

As all the function having this rogue-bytes in it are undefined, I now need to define them as proper function.

But I don't know how to go back to the address of the beginning of the undefined function. For instance, that's the result after executing my IDAPython script:

The rogue-byte is indeed patch, but now I just need to find the address of "loc_410687".

How can I get this address within my IDAPython script?

(I specify that not all of the function that contains the rogue-byte start by those 3 xors, that's a coincidence. So I can't look for them in order to get the start of the function.)

Any idea?

Thanks!


问:
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.

Here is an example of a line of HTML stored on memory.

```<code><!DOC^YPE H^MN PUNLOC "///W?C//NTN NTOL 4.01//EN" "nt~p>//ww.w?.oro/^R/h~mn4/s~roc~.ntn">
</code>```

What it should be

```<code><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
</code>```

The pattern of error that I see is the last 4 bits of every other byte is replaced with different bits.

So the two bytes CT(43 54) in DOCTYPE become C^ (43 5E). The first 2 bits of the two bytes are always correct but the last 4 are not.

My question is, what is causing this systematic error? Is it a problem with the JTAG configuration or some ECC or something thing else completely?

Title: JTAG Dumped Flash is scrambled


问:
How to find function called by instantaneous event (like mouse press for exemple)
I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me.
I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what function(s) was/were called when a specific event was triggered (like pressing the mouse button for instance)
Because this action wasn't tied to any particluar variable, I couldn't just "listen" for instruction modifying memory. I couldn't just log all the function calls because it would have been impossible to spot the right one from all the other ones.

So it got me thinking of a way of doing it :

1) put the debugger in a 'listen' mode where it logs all the function calls while the process is running. During that time, do not trigger the event you're looking for, just let the program follow its "normal" flow.

2) After a few seconds of "calibration", the debuger now has a list of all the functions that are normally called when the event isn't triggered.

3) Trigger the event. Now any function call that wasn't in the initial calibration list has to be at least correlated to the event.

I'm really new to reverse engineering and I'm pretty sure a tool like that must already exist.
So my question is simple. Does it exists ? If not, why ? Wouldn't that be useful ? Is there's an easier way that I'm missing ?

Thanks in advance (and sorry for broken English, I haven't slept in a while and it's not my native language)


问:
Which API function is responsible for input strings?
I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find the principle behind those calculations I need to know which function is responsible for reading the values which the user enters into the text box, then I think I can trace it further.

What's important seems like this executable uses something like textbox.text.change event because it changes the value in output text box every time we change the value in the input text box.

The .exe file


问:
How to load symbols from Windows DBG file
I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file.  Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be much appreciated.

Things I've tried:

Having both "foo.exe" and "foo.dbg" in the same directory and importing "foo.exe" and auto-analyzing it with defaults.

After importing "foo.exe", using "Add to Program" in the CodeBrowser and added "foo.dbg" explicitly.  That suceeds with no errors, but I still can't find the symbols in the "Symbol Tree".

Background:

Using GHIDRA 9.0.4 installed on Fedora-30 (via ZIP file).

The EXE is a Delphi-7 EXE built under WinXP (32 bit) with a MAP file and full TD32
debug in the EXE itself.  I created the DBG file using map2dbg.  This
is very old, very crusty stuff.  I'm going to create a separate
question on how to load symbols from a custom file (I've seen
references but sadly cannot find those menu action in my IDE).

In case this really is a dead end I added a related question.


问:
How to bring the message box other than error message box
The program asks serial number. I've searched the API call which triggers the wrong password message box and force it into accepting an incorrect serial number in x64dbg’s string references. I found nothing usefull. So I tried to use Call Stack window in order to catch the responsible API function for input strings. I placed a breakpoint on the suspected address. I scrolled up to change the JE instructor to JNZ. When I click the OK button after I enter a serial number, the button doesn't work:

0654C66D    E8 26353D01     CALL 0791FB98
0654C672    85C0            TEST EAX,EAX
0654C674    0F84 37010000   JE 0654C7B1
0654C67A    BE 05000000     MOV ESI,0x5
0654C67F    E9 41010000     JMP 0654C7C5
0654C684    FF75 14         PUSH DWORD PTR SS:[EBP+0x14]
0654C687    FF75 10         PUSH DWORD PTR SS:[EBP+0x10]
0654C68A    FF75 0C         PUSH DWORD PTR SS:[EBP+0xC]
0654C68D    FF75 08         PUSH DWORD PTR SS:[EBP+0x8]
0654C690    8B55 DC         MOV EDX,DWORD PTR SS:[EBP-0x24]
0654C693    8BCB            MOV ECX,EBX
0654C695    E8 B6FED7FD     CALL 042CC550  ' I've placed the breakpoint here.

Any idea would be appreciated.


问:
Obfuscate JSON file that is served client-side
Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm package called bson that creates binaries for a json format. Can you call this obfuscation to a degree? I am also at a dilemma because my .json files serve a WebGL gaming engine via iframe.

Unity developers obfuscates most of their code via third-party obfuscation tools in the Unity Asset store. It is than rendered into WebGL. I was wondering if some similar tools that helps me achieve obfuscation of .json this through webGL frameworks like babylon.js and three.js

My main goal is just to obfuscate when a user inspects the incoming .json file in the network tab.


问:
How to replay a signal on a different frequency with Gnu Radio Companion and Hack RF
I captured the traffic of a remote control for a LED light.
I have multiple of those LED Lights.
The payload seems to be the same for each device but the frequency(channel) differs.

For one LED light I lost my remote control, now I'd like to replay the captured traffic but on a different frequency.

How can I do this with tools like GRC and Hack RF (or other tools) ?


问:
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..

P.S I found this github repository but, I don't know how to install the plugin in the debugger... it seems to be a different kind of plugin.. please help, I need it like air.. thanks!

Title: UTF8, UTF16 encoding string search


问:
Move focus to Immunity Debugger command line
As the title says, I want to know if there is a keyboard shortcut that upon pressing will allow me to write in the Immunity command line?</p>


问:
(Help) APK Decomplied unreadable .pngs
I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I've tried decompiling with Apktool and just changing the extension to .zip but still no luck. Any help would be appreciated.</p>

Title: (Help) APK Decomplied unreadable .pngs


问:
How to find implementation of native method in the library .so (Android)
I need to make reverse engineering of one android app.
In this app I found class with name Im2MessageNative, this class contains a lot of native methods.
For example:

```<code>static native long createMessageWrite(int i);
</code>```

I tried to find an implementation of the method using the Ida Pro. To do this, I opened a tab with strings, then search for phrase "createMessageWrite", next I opened memory address and found this:

```<code>.rodata:00B29B29 aCreatemessagew DCB "createMessageWrite",0
.rodata:00B29B29                                         ; DATA XREF:
.data:00DDC4CC↓o
.rodata:00B29B29                                         ; .data:00DDC4D8↓o
</code>```

I was looking for a "aCreatemessagew", but could not find any function.

How to find the implementation of this native method?


问:
Ida permission error
I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this

Title: Ida permission error


问:
How Can I Clean Up After IDA Decompation with IDAPython or other resource
When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am looking for a way to accomplish this quicker.

EXAMPLE Code before cleanup

```<code>int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v3; // rax
  __int64 v4; // r8
  __int64 v5; // rax
  __int64 v6; // r8
  __int64 v7; // rax
  __int64 v8; // r8
  __int64 v9; // rax
  __int64 v10; // r8
  __int64 v11; // rax
  __int64 v12; // r8
  __int64 v13; // rax
  __int64 v14; // r8
  __int64 v15; // rax
  __int64 v16; // rax
  Books books; // [rsp+20h] [rbp-E8h]

  strcpy(books.title, "Learn C++ Programming");
  strcpy(books.author, "Chand Miyan");
  strcpy(books.subject, "C++ Programming");
  LODWORD(books.id) = 6495407;
  v3 = sub_1400011D0(std::cout, "Book 1 title : ", envp);
  v5 = sub_1400011D0(v3, &books, v4);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v5, sub_1400013A0);
  v7 = sub_1400011D0(std::cout, "Book 1 author : ", v6);
  v9 = sub_1400011D0(v7, books.author, v8);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v9, sub_1400013A0);
  v11 = sub_1400011D0(std::cout, "Book 1 subject : ", v10);
  v13 = sub_1400011D0(v11, books.subject, v12);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v13, sub_1400013A0);
  v15 = sub_1400011D0(std::cout, "Book 1 id : ", v14);
  v16 = std::basic_ostream<char,std::char_traits<char>>::operator<<(v15, LODWORD(books.id));
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v16, sub_1400013A0);
  return 0;
}
</code>```

Looking at the code we can see that std::cout is simply printing the variables . but this code while it makes sense to us humans should be cleaned up more before it becomes useful.

This is AFTER my clean up. By hand...

```<code>typedef struct Books {
    char title[44];
    char author[56];
    char subject[100];
    int id;

} books;

int main(){

    __int64 v3; // rax
    __int64 v4; // r8
    __int64 v5; // rax

    Books books; // [rsp+20h] [rbp-E8h]

    strcpy(books.title, "Learn C++ Programming");
    strcpy(books.author, "Chand Miyan");
    strcpy(books.subject, "C++ Programming");
    LODWORD(books.id) = 6495407;

    std::cout << "Book 1 title   : " << &books.title << std::endl;
    std::cout << "Book 1 author  : " << &books.author << std::endl;
    std::cout << "Book 1 subject : " << books.subject << std::endl;
    std::cout << "Book 1 id : "      << LODWORD(books.id) << std::endl;

    return 0;
}
</code>```

The answer doesn't have to be through IDAPython, but I think it would be a good place to start.

So far what I have , is this and I am not sure if these is even the right step to go.

```<code>c=idaapi.decompile(0x0000000140001000 ) //
for v in c.lvars:
  print v.name
</code>```

This though, just prints off the variable names.

How can I more automate clean up Ida produced code.
Here is a similar question to mine , but I don't think this explores the possiblity of other options or using  IDAPython.

Cleaning HexRays Output


问:
Firewire film scanner
There is firewire photo film scanner Konica-minolta (scanner part of the minilab) that is standard mashine vision firewire linescan camera, connected to controler that deal with motor film fee, light, switches and buttons. Mostly controler is transparent to the camera commands and intercept only controler commands. As usually there are no any documentation - its 10+ years  old (somewhere from 2006).
  Question is how to reverse engineer commands sent from crappy windows xp software to the scanner? How to distinguish camera commands from controler commands? I dont know the camera model and cant imagine how to get it, may be by some command? I suppose that the camera support one of the standards for mashine vision, but which one? I tried to search for free or affordable firewire debbuging solutions, but no success. How to distinguish firewire commands (to/from scanner) from big data (ie image sent from scanner data's)?
Final goal is to make linux standalone driver. Hope to have only useful answers.   </p>

Title: Firewire film scanner


问:
Reverse Engineering GUI programs
I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the application. The problem is, whenever I stop execution using a debugger (x32dbg) execution is in a Win32 DLL file, not in an application function.

Any suggestions on how to tackle this? How do I determine what happens when I click any particular button?

Thank you

Title: Reverse Engineering GUI programs


问:
How to add symbols from open source lib to Ghidra?
I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function names, class names, etc. from the code calling the library.

Other than by manually hunting down and changing signatures in the decompiled code. There must be an easier way.

(If there's a way to do this in IDA, I can switch to that instead, just for this.)


问:
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as downloads and we need to link the MS symbols server in windbg. I tried that route too, but still failed to get rid of this error.

ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll -
ntdll!DbgBreakPoint

Is there a way I can download the symbols for windows xp sp3 on to my local machine and then run the windbg.


问:
removing bios wireless white listing
I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps:

booted with kernel parameter iomem=relaxed

used pawn to dump BIOS

made multiple dumps and compared the md5sum to be sure I have a valid dump

I opened the BIOS dump  with UEFITool

searched for the string "Unauthorized network card...."

I found the PE32 image section and extracted the body. It is an efi file

opened the file with IDA free and searched for the hex to find the function.

This is the produced file from IDA:

I don't know how to get the graph view. I am not sure what to change exactly. But I think this is the relevant part:

```<code>sub_6FC proc near

var_148= qword ptr -148h
var_140= qword ptr -140h
var_138= qword ptr -138h
var_130= qword ptr -130h
var_128= byte ptr -128h
var_F8= byte ptr -0F8h
arg_0= qword ptr  8
arg_8= qword ptr  10h

mov     rax, rsp
mov     [rax+8], rbx
push    rdi
sub     rsp, 160h
lea     r8, [rax+10h]
mov     rax, cs:qword_1040
mov     rbx, rcx
lea     rcx, qword_458+8
xor     edx, edx
call    qword ptr [rax+140h]
xor     edi, edi
cmp     rax, rdi
jl      loc_7FF
mov     edx, [rbx+4]
movzx   r9d, word ptr [rbx]
cmp     edx, 0FFFFFFFFh
jnz     short loc_75D
movzx   eax, word ptr [rbx+2]
lea     r8, a04x04x     ; "%04x/%04x"
lea     edx, [rdi+28h]
lea     rcx, [rsp+168h+var_128]
mov     dword ptr [rsp+168h+var_148], eax
call    sub_F9C
jmp     short loc_78E

loc_75D:
movzx   ecx, word ptr [rbx+2]
movzx   eax, word ptr [rbx+4]
shr     edx, 10h
mov     dword ptr [rsp+168h+var_138], edx
mov     dword ptr [rsp+168h+var_140], eax
mov     dword ptr [rsp+168h+var_148], ecx
lea     rcx, [rsp+168h+var_128]
lea     r8, a04x04x04x04x ; "%04x/%04x/%04x/%04x"
mov     edx, 28h ; '('
mov     di, 1
call    sub_F9C

loc_78E:
mov     r8, cs:off_298
lea     r9, [rsp+168h+var_128]
lea     rcx, [rsp+168h+var_F8]
mov     edx, 0F0h ; 'ð'
call    sub_F9C
mov     rax, cs:qword_2A0
mov     r9d, dword ptr cs:qword_280+0Ch
mov     r8d, dword ptr cs:qword_280+8
mov     ecx, dword ptr cs:qword_280
mov     [rsp+168h+var_130], rax
lea     rax, [rsp+168h+var_F8]
movzx   edx, di
add     edx, dword ptr cs:qword_280+4
mov     [rsp+168h+var_138], rax
mov     rax, cs:off_290
mov     [rsp+168h+var_140], rax
mov     rax, cs:qword_1028
mov     [rsp+168h+var_148], rax
mov     rax, [rsp+168h+arg_8]
call    qword ptr [rax+8]

loc_7FF:
mov     rbx, [rsp+168h+arg_0]
add     rsp, 160h
pop     rdi
retn
sub_6FC endp
</code>```

And I thought of replacing the jl loc_7FF to jmp  loc_7FF. But I am not sure if this is correct.

I don't know how to provide the graph view.

Thanks for the help

Title: removing bios wireless white listing


问:
How large are privileges of linux kernel module?
I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the kernel without segfaults, etc.? I want to use kernel module for unwinding the stack to kernel level to backtrace every function my program calls.</p>


问:
Is there a way to trace the differences of a software in x64dbg?
Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures option (Run trace --> Add entries of all procedures) and saves it to *.txt file (Run trace --> Log to file). I want to know if I can do the same in x64dbg?


问:
Extracting firmware image from binary
I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts?

I used Binwalk to extract content, binwalk -e file:
it extracted two binaries, 8.5MB with 180188.squashfs extension and another binary 3.1MB, and squashfs-root directory with subfolders.

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
392           0x188           uImage header, header size: 64 bytes, header CRC: 0xEF73A583, created: 1969-12-31 23:59:59, image size: 1572736 bytes, Data Address: 0x20008000, Entry Point: 0x20008000, data CRC: 0x3661C6EC, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "SP2Xcybertan_rom_bin"
13596         0x351C          gzip compressed data, maximum compression, from Unix, last modified: 2019-04-03 05:25:36
1573192       0x180148        uImage header, header size: 64 bytes, header CRC: 0x9053B22D, created: 1969-12-31 23:59:59, image size: 8474624 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xFC8655E0, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: "SP2Xcybertan_rom_bin"
1573256       0x180188        Squashfs filesystem, little endian, non-standard signature, version 3.1, size: 8473072 bytes, 1028 inodes, blocksize: 131072 bytes, created: 2019-04-03 05:36:06
</code>```

Download file.

Title: Extracting firmware image from binary


问:
injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`
I've encountered an image validation error while trying to inject dll from
driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the requested dll to load.

NOTICE: this error occurs only in the latest update (1903)

The injection timing is on creation of new thread on an existing process (so that processes that existed before the driver is loaded could be injected as well - assuming new alertable threads will be created on them).

Anyhow, it seems that although the dll is signed, it fails on signing issue (perhaps mismatch between processes executable file and dll signatures)

here's the stack trace from the context of the injected processes after initial injected code tried to call ldrloaddll

```<code>[0x0]   CI!CipReportAndReprieveUMCIFailure + 0x563
[0x1]   CI!CiValidateImageHeader + 0xbdb
[0x2]   nt!SeValidateImageHeader + 0xd6
[0x3]   nt!MiValidateSectionCreate + 0x436
[0x4]   nt!MiValidateSectionSigningPolicy + 0xa6
[0x5]   nt!MiValidateExistingImage + 0x12e
[0x6]   nt!MiShareExistingControlArea + 0xc2
[0x7]   nt!MiCreateImageOrDataSection + 0x1a3
[0x8]   nt!MiCreateSection + 0xf4
[0x9]   nt!MiCreateSectionCommon + 0x1ff
[0xa]   nt!NtCreateSection + 0x60
[0xb]   nt!KiSystemServiceCopyEnd + 0x25
[0xc]   ntdll!NtCreateSection + 0x14
[0xd]   ntdll!LdrpMapDllNtFileName + 0x136
[0xe]   ntdll!LdrpMapDllFullPath + 0xe0
[0xf]   ntdll!LdrpProcessWork + 0x74
[0x10]   ntdll!LdrpLoadDllInternal + 0x13e
[0x11]   ntdll!LdrpLoadDll + 0xa8
[0x12]   ntdll!LdrLoadDll + 0xe4
</code>```

the process is image is spawned from dllhost.exe and it's not revealed as protected using method PsIsProtectedProcess

Any idea what can lead to this error ?

thanks


问:
When virtual table is not the first element of structure?
Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element of structure?</p>


问:
How to trace in x64dbg?
Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?</p>

Title: How to trace in x64dbg?


问:
How to identify the NonPagedPool Start Memory address from a memory dump
I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it.

Is that possible with Volatility ?

Tks


问:
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as

[addr] = value

As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html

And while I could work around my problem as dividing the string into several byte writes, that looks kind of ugly! Every character would be:

byte:[addr] = charactercode

I have not found any way except for manually entering into the memory editor to write a string/unicode string into memory. Am I missing something or is this really basic feature missing from X64dbg ?

In case there is another workaround.
The problem I am trying to solve is I want to set a value for GetEnvironmentVariable() for a variable that does not exist by writing a string into the buffer. I want this to happen when a breakpoint is reached by breakpoint commands.

So basically if there was any way to force setting environment variable or write a string into memory when a breakpoint is hit. I could work with that!


问:
Mimicking a file format that is actually a zip
Backstory: I have been trying to find a way to automatically turn batches of photos into WhatsApp stickers. I was able to do that, but now I am trying to figure out a way to actually import them into WhatsApp. For that, I am trying to piggyback off an app which can import it's own sticker pack files, with extension .wastickers
(example here).  The app can be found here.

Upon inspection with file, the format turns out to be a .zip archive (and indeed it unzips). Binwalk can also see all of the files inside the archive without unzipping it. As such I tried mimicking the contents of the container and zipping it with 0 compression ratio ("storage" mode) and changing the extension, but the app does not see the archive as a legitimate stickerpack. Furthermore binwalk can't see the contents of such an archive off the bat.

What is contained inside an archive: a png called 0, which is the stickerpack icon; A bunch of .webp files numbered from 1 to at most 30, and two text files, title.txt and author.txt which, you guess it, denote the title and the author of the stickerpack.

What is special about their container? How can I mimick it?

OwnerDisplayName: Tanny Sieben


问:
Ghidra: How to display the contents of an array
I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format (e.g. [var0, var1, var3 ...])


问:
How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW
Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW
i tried every combinanated value but without sucess.


问:
CRC Checksum? (Used in can open system)
We want to put our own messages on a can-open system. (So we can program our own functions to the system). We can put our message on the system, but when we do this, the safety relay stops the system. (Controlled by 2 processors). We also filter out the original message with a can bridge.

Channel 1F0 and 1F1 are the the RAW inputs from the controller. (We manipulate).

We think we found the problem.
Channel 1F2 changes a sort of random, if you actuate a function. It combines the input from the other 2 input channels. It looks like this channel is used for crc safety protocol.  (Always the same output, if you combine the same multiple functions, but as there are linear controllers there are infinite combinations possible).

Anyone here who can reverse engineer what system is used for this? So we can simulatie this channel also. (Crc32 orso?).

First byte of all 3 messages is a counter. (0-8 keeps always counting).

3 Examples:

ID           DLC        Data

1F0  -       8     -        03 59 7A 7E 7F 59 7A 7E

1F1  -       8      -       03 7F 59 00 01 20 27 05

1F2   -      8      -       03 0E 8E 70 1A 00 00 00

1F0    -     8       -      03 59 7A 7E 7F 59 7A 7E

1F1   -      8      -       03 7F 59 03 01 20 27 05

1F2   -      8      -       03 FA 3E 43 52 00 00 00

1F0    -     8       -      00 59 7A 7E 7F 59 7A 7E

1F1    -     8        -     00 7F 59 02 01 20 27 05

1F2    -     8        -     00 55 56 C1 C2 00 00 00

Last 3 bytes from 1F2 (crc / checksum?) Always stays 0.

Thanks hope someone can help us.

Title: CRC Checksum? (Used in can open system)


问:
How do I decompile/modify a .dfu file?
I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the printer is with USB. I have been trying to modify the firmware so I could get the wifi running again, running to my computer instead of their website.
I was looking at the firmware with IDA and found the following:

I'm not really sure what is means, but it looks like a directory. Is there A way that I can possibly extract that file and edit it?

Sorry if this was a waste of time. I'm new to this, and all I want is the wifi working again on the darn printer.

Title: How do I decompile/modify a .dfu file?


问:
Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?
The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for all the programming languages used (https://ethervm.io/#opcodes similar to the Java Virtual Machine from Oracle).

There’s no executable format being used as everything runs at bare metal. The primary programming languages for the platform doesn’t even provide a standard library (but only keywords which translate into high level opcodes).

Despite Ethereum being the second most valued cryptocurrency for years, I was unable to find a tool able to draw call graphs for that architecture or rather, I did find one which only treats jumps from addresses if written on the stack through PUSH instructions.

So is there a tool fully supporting the Ethereum Virtual Machine’s bytecode (not half) for drawing call graphs or which instruction at which address calls the address 0x1a95 or the address 0x204a in this program (the blocks are at the top right bottom)?

The full bytecode without any attempt to format it into blocks is here:

```[encoded data, 24882 characters]
```

Both a fully working tool (unlike the current one) for the problem or the answer to it can be the answer.


问:
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed portion of ROM in the ROM image, called the home bank, whereas $4000-$7FFF points to a selectable ROM bank. The loader in question emulates this by mapping the 16-bit address space to a virtual memory space where each memory is in a separate segment.

So far, so good. When code in the home bank is calling code in one of the selectable banks, I press alt-R to choose a segment for the target. This is unavoidable since IDA can't know automatically which segment the target is in. However, since the home bank is fixed, I would like to set up IDA in such a way that it automatically understands that all jumps to the area $0-$3FFF area end up in segment 0, without needing to manually assign addresses. $0-$3FFF in the virtual memory space always unambiguously refers to $0-$3FFF in the linear memory space. Is this possible?


问:
Why is U-Boot changing this bit marked as "DO NOT CHANGE"?
While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) states should not be changed. This is stage bl1 code that executes out of the 4 kilobyte "steppingstone" SRAM area.

Note that the following code can't be directly assembled, it's just the output of Ida pro copied into a text editor, so that I can manipulate it more easily.

```<code>0C000914 init_clocks
0C000914 LDR     R0, dword_C000A80       ;r0 <- 0x7E00F000
0C000918 LDR     R1, [R0,#0x900]         ;r1 <- [0x7E00F900], OTHERS register of system controller
0C00091C MOV     R2, #0x40               ;r2 <- 0x40
0C000920 ORR     R1, R1, R2              ;set bit 6 of r1
0C000924 STR     R1, [R0,#0x900]         ;APLL selected as SYS CLOCK
0C000928 NOP                             ;nop block, probably necessary to wait after changing SYS CLOCK
0C00092C NOP                             ;No Operation
0C000930 NOP                             ;No Operation
0C000934 NOP                             ;No Operation
0C000938 NOP                             ;No Operation
0C00093C MOV     R2, #0x80               ;r2 <- 0x80
0C000940 ORR     R1, R1, R2              ;set bit 7 of r1
0C000944 STR     R1, [R0,#0x900]         ;SYNCMODE bit set to synchronous mode
0C000948 syncack_delay
0C000948 LDR     R1, [R0,#0x900]         ;r1 <- contents of OTHERS register
0C00094C MOV     R2, #0xF00              ;r2 <- 0xf00, SYNCACK mask
0C000950 AND     R1, R1, R2              ;clear all but SYNCACK bits 11:8
0C000954 CMP     R1, #0xF00              ;are all SYNCACK bits set
0C000958 BNE     syncack_delay           ;if not, loop back
0C00095C MOV     R1, #0xFF00             ;r1 <- 0xff00
0C000960 ORR     R1, R1, #0xFF           ;r1 <- 0xffff
0C000964 STR     R1, [R0]                ;[0x7E00F000] <- r1, APLL_LOCK register
                                         ;pll_locktime of APLL_LOCK: 0xffff

0C000968 STR     R1, [R0,#4]             ;pll_locktime of MPLL_LOCK: 0xffff
0C00096C STR     R1, [R0,#8]             ;pll_locktime of EPLL_LOCK: 0xffff
0C000970 LDR     R1, [R0,#0x28]          ;r1 <- [0x7e00f028], CLK_DIV2 register
0C000974 BIC     R1, R1, #0x70000        ;clear bits 18:16
0C000978 ORR     R1, R1, #0x30000        ;set bits 17:16
0C00097C STR     R1, [R0,#0x28]          ;uart clock divider ratio: 3
0C000980 LDR     R1, [R0,#0x20]          ;r1 <- [0x7e00f020], CLK_DIV0 register
0C000984 BIC     R1, R1, #0x30000        ;clear bits 17:16
0C000988 BIC     R1, R1, #0xFF00         ;clear bits 15:8
0C00098C BIC     R1, R1, #0xFF           ;clear bits 7:0
0C000990 LDR     R2, dword_C000A84       ;r2 <- 0x3310
0C000994 ORR     R1, R1, R2              ;set bits 13:12, 8:9, and 4
0C000998 STR     R1, [R0,#0x20]          ;PCLK ratio: 3, HCLKX2 ratio: 1, HCLK ratio: 1, MPLL ratio: 1, ARM ratio: 0
0C00099C LDR     R1, dword_C000A88       ;r1 <- 0x810A0301
0C0009A0 STR     R1, [R0,#0xC]           ;[0x7e00f00c] <- r1, APLL_CON register
                                         ;APLL S divide: 1, APLL P divide: 3, APLL M divide: 266, 0x10a, APLL control enabled

0C0009A4 LDR     R1, dword_C000A88       ;r1 <- 0x810A0301
0C0009A8 STR     R1, [R0,#0x10]          ;[0x7e00f010] <- r1, MPLL_CON register
                                         ;MPLL S divide: 1, MPLL P divide: 3, MPLL M divide: 266, 0x10a, MPLL control enabled

0C0009AC LDR     R1, dword_C000A8C       ;r1 <- 0x80200203
0C0009B0 STR     R1, [R0,#0x14]          ;[0x7e00f014] <- r1, EPLL_CON0 register
                                         ;EPLL S divide: 3, EPLL P divide: 1, EPLL M divide: 32, 0x20, EPLL control enabled

0C0009B4 MOV     R1, #0                  ;r1 <- 0
0C0009B8 STR     R1, [R0,#0x18]          ;[0x7e00f018] <- r1, EPLL_CON1 register, EPLL K divide: 0
0C0009BC LDR     R1, [R0,#0x1C]          ;r1 <- [0x7e00f018], CLK_SRC register
0C0009C0 LDR     R2, dword_C000A90       ;r2 <- 0x2007
0C0009C4 ORR     R1, R1, R2              ;set bits 13, 2:0
0C0009C8 STR     R1, [R0,#0x1C]          ;uart clock source is MPLL, EPLL_SEL: 1, MPLL_SEL: 1, APLL_SEL: 1
0C0009CC MOV     R1, #0x10000            ;r1 <- 65536, loop counter
0C0009D0 dec_64k
0C0009D0 SUBS    R1, R1, #1              ;decrement r1, set flags
0C0009D4 BNE     dec_64k                 ;loop back until r1 = 0
0C0009D4
0C0009D8 LDR     R1, [R0,#0x900]         ;r1 <- OTHERS register
0C0009DC ORR     R1, R1, #0x20           ;set bit 5
0C0009E0 STR     R1, [R0,#0x900]         ;set bit 5 of OTHERS register, marked as "DO NOT CHANGE" ???
0C0009E4 MOV     PC, LR                  ;return to init_hardware subroutine

0C0009E8 unrelated_routine
0C0009E8 LDR     R0, dword_C000A54
0C0009EC LDR     R1, dword_C000A94
0C0009F0 STR     R1, [R0]
0C0009F4 LDR     R0, dword_C000A70
0C0009F8 MOV     R1, #0
0C0009FC STR     R1, [R0,#8]
0C000A00 STR     R1, [R0,#0xC]
0C000A04 MOV     R1, #3
0C000A08 STR     R1, [R0]
0C000A0C LDR     R1, dword_C000A98
0C000A10 STR     R1, [R0,#4]
0C000A14 MOV     R1, #0x22
0C000A18 STR     R1, [R0,#0x28]
0C000A1C LDR     R1, dword_C000A9C
0C000A20 STR     R1, [R0,#0x2C]
0C000A24 LDR     R1, dword_C000AA0
0C000A28 STR     R1, [R0,#0x20]
0C000A2C MOV     PC, LR
0C000A30 LDR     R0, dword_C000AA4
0C000A34 LDR     R1, [R0]
0C000A38 ORR     R1, R1, #0x70
0C000A3C ORR     R1, R1, #0x7700
0C000A40 STR     R1, [R0]
0C000A44 LDR     R1, [R0,#4]
0C000A48 ORR     R1, R1, #3
0C000A4C STR     R1, [R0,#4]
0C000A50 MOV     PC, LR

literal_pool
0C000A54 dword_C000A54 DCD 0x7F008000
0C000A58 dword_C000A58 DCD 0x55540000
0C000A5C dword_C000A5C DCD 0x55555555
0C000A60 dword_C000A60 DCD 0x7F008924
0C000A64 dword_C000A64 DCD 0x71200000
0C000A68 dword_C000A68 DCD 0x71300000
0C000A6C dword_C000A6C DCD 0x7E00F904
0C000A70 dword_C000A70 DCD 0x7F005000
0C000A74 dword_C000A74 DCD 0x4B4B4B4B
0C000A78 dword_C000A78 DCD 0x7E00F908
0C000A7C dword_C000A7C DCD 0x7E00FA00
0C000A80 dword_C000A80 DCD 0x7E00F000
0C000A84 dword_C000A84 DCD 0x3310
0C000A88 dword_C000A88 DCD 0x810A0301
0C000A8C dword_C000A8C DCD 0x80200203
0C000A90 dword_C000A90 DCD 0x2007
0C000A94 dword_C000A94 DCD 0x220022
0C000A98 dword_C000A98 DCD 0xE45
0C000A9C dword_C000A9C DCD 0x1FFF
0C000AA0 dword_C000AA0 DCD 0x4F4F4F4F
0C000AA4 dword_C000AA4 DCD 0x70200000
</code>```

The OTHERS register of the system controller is loaded into r1, logically OR'd with 0x20, setting bit 5, then written back into OTHERS register. Changing a bit that apparently shouldn't be changed.

The bootloader is never verified, so it can be overwritten in flash at will. This is a rooted android tablet, so I used the DD command to swap the STR R1, [R0,#0x900] instruction at SRAM location 0x0C0009E0 out with a NOP. The tablet still boots. So am I interpretting the instruction incorrectly? (just started learning arm assembly) Is this just a harmless bug? Or could these "DO NOT CHANGE" bits have some hidden functionality?


问:
How can one replace bitmap (image) inside exe?
I have an application (something like a text editor) that has a background image.
I understand how to replace text in exe file, but what about image?
I wonder how difficult and what is the way to replace such image using etc ollydbg, IDA?  </p>


问:
Z3 and If-logic
Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it:

```<code>def fact(x):
    if x == 1:
        return 1
    else:
        return x * fact(x - 1)
</code>```

I'm aware of the fact Z3 python has If() function but it can only switch between two values.

Here is example of simple keygen-me which I wrote to illustrate this problem. Is there a way to solve it cleanly with Z3?

```<code>import sys

def fact(x):
    if x == 1:
        return 1
    else:
        return x * fact(x - 1)

def check_serial(s):

    for i in range(len(s)):
        if s[i] < 10:
            print("[!] poor serial number")
            exit(0)

    facts = [fact(s[i]) for i in range(len(s))]

    xor = 0
    for i in range(len(s)):
        xor = xor ^ facts[i]

    return xor

if len(sys.argv) != 9:
    print("[!] Usage: %s x x x x x x x x, where is number > 10" % sys.argv[0])
    exit(0)

nums = [int(x) for x in sys.argv[1:]]

if check_serial(nums) == 0x3fb4b7f405d4fb5e2a6740000:
    print("[+] serial number is valid, congratz!")
else:
    print("[!] serial number is invalid")
</code>```

Title: Z3 and If-logic


问:
How to display processes that are running of computer in LordPE?
I tried to install some LordPE version but all when I open then no program that is  running displayed in LordPE.I don't know why?

I hope you guys show me the way to fix this problem.I appreciate all of your help?


问:
How to repack reverse-engineered router firmware?
I managed to unpack the filesystem contents of a TP-Link router .bin file using binwalk, dd and unsquashfs. The squash FS was at the end of the bin file, the part before having a relatively large lzma archive.

Now I would like to make changes to the filesystem and repack the firmware file back. How can I achieve this? How do I know whether I need to attach a checksum or similar?

This question is different from How can I put a Binwalk extracted firmware back into a .bin binary file? in that it's vendor specific, firmware-mod-kit is a not preferred option (unless it's the only one...) and it contains an extra question


问:
Reverse ASCII checksum algorithm
I am looking to reverse engineer what appears to be a 24-bit ASCII checksum.  I tried the standard CRC 16 and 32-bit checksums and they don't work.  Any pointers would be appreciated.  Here is some samples:

```<code>CMD21415A00M40C153S117!D0H$
CMD21415A00M40C197S439!EJG$
CMD21415A00M40C239S825!CIB$
CMD21415A00M40C239S029!FHZ$
CMD21415A00M40C197S275!BJE$
CMD21415A00M40C153S302!N7W$
CMD21415A00M40C153S141!A4I$
CMD21415A00M40C197S266!8KE$
CMD21415A00M40C197S714!RD0$
</code>```

I believe for each line the checksum (3 ASCII characters between '!' and '$') is for the ASCII data between 'CMD' and '!'.  It does not seems to match any of basic checksum algorithms that I am familiar with.

Title: Reverse ASCII checksum algorithm


问:
Alternative APIs to hook instead of messagebox for message pop ups?
So i am reversing an app that pops up a message at some point, but its not doing this using messagebox

i also tried to pause and then run to user code but didn't work, so what are some of the other ways to trace back to where this "message box" was generated?  sorry if this is a newbee question

i watched a lot of youtube videos but regarding this issue the only solution i found was pausing and going to user code but that doesn't work, for some reason sometimes the pause just doesn't even work (if anyone knows why please let me know) and sometimes when it does, and i go to user code its just gibberish code, nothing that caused the box ( i think maybe this is because multi threading, since when i check the threads there are like 12 threads running!, tried going to main thread and some of the non suspended ones and repeating this didnt work )


问:
Checksum of an old serial devices
I've got an old devices which communicate through serial port. There's main device which send simple commands and then asked device responds. I've got almost all sorted out. The only thing left is the checksum. I've spend so much time on this but no idea pops out. Messages may vary in length, there's no length byte. Last byte is checksum I believe. Here's the data sample: </p>

```<code>E1-7E-00-00-03
E1-7E-00-01-92
E1-E2-FE-00-00-D5
E1-E2-FE-00-01-44
E1-7D-00-00-B2
E1-7D-00-01-23
E1-E2-FD-00-00-64
E1-E2-FD-00-01-F5
E1-7C-00-00-62
E1-7C-00-01-F3
E1-E2-FC-00-00-B4
E1-E2-FC-00-01-25
E1-7B-00-00-11
E1-7B-00-01-80
E1-E2-FB-00-00-C7
E1-E2-FB-00-01-56
E1-7A-00-00-C1
E1-7A-00-01-50
E1-E2-FA-00-00-17
E1-E2-FA-00-01-86
E1-79-00-00-70
E1-79-00-01-E3-F1
E1-E2-F9-00-00-A6
E1-E2-F9-00-01-37
E1-78-00-00-0D-39-CB
E1-78-00-01-31
E1-E2-F8-00-00-76
E1-F8-00-01-E7
E1-77-00-01-07
E1-E2-F7-00-01-D1
E1-77-00-00-96
E1-E2-F7-00-00-40
</code>```

<p>E1 and E2 have no impact on checksum, cause I saw things like E1-E2-FE-38 and E1-FE-38. 7E, FE and so on are devices id. 7x is main device data and Fx is device response.
Thanks in advance. </p>

Title: Checksum of an old serial devices


问:
How to interpret binary instruction using the intel manual
OK. So I am really trying to figure out how to use the "Intel 64 and IA-32 Architectures Software Developer's Manual" for myself, since it seems like the authoritative source for x86(_64) machine code.

I am looking at a program in Ghidra (specifically, a dynamically linked .so file to the program I actually care about). File info for the .so file:

```<code>ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked
</code>```

I come to the following instruction in Ghidra:

```<code>ff 25 de ad be ef  --- deadbeef being a substitute for the real bytes.
</code>```

I have Ghidra set up so that I can right click on the instruction and go to the relevant page in the processor manual, which brings me to the JMP reference (p.590 in the version of the manual I have). Cool.

From looking through the options there, I find the ff opcode rows that correspond to the instruction I am looking at. Further, I know that my ModR/M byte is 25H which corresponds to MOD = 00B, REG = 100B and R/M = 101B so I know that this narrows it down to the FF /4 rows in the JMP instruction description table. But how do I know if it is referring to JMP r/m16 or JMP r/m32 or JMP r/m64? Also what is the difference between those three? And further, I know from looking at tables 2-1 through 2-3 (combined with how Ghidra interprets the instruction) that de ad be ef actually ends up being a disp32 that gets added to the index. But how would I have known which table to reference in tables 2-1 to 2-3, and how does that information correspond to choosing between JMP r/m16 or JMP r/m32 or JMP r/m64?


问:
Google Maps, Android serialisation format
I've come across an SQLite database (gmm_storage.db) used by Google Maps on Android, and I'm unsure as to how the data it contains is serialised. For example:

I'm saying serialised, as from the header 0xACED it appears to be a Java serialised object.  However, as I have no idea what the serialised class actually looks like, I've been unable to deserialise it.

I'm also not entirely sure it's standard Java serialisation, as I've tried a number of different tools, and Java itself,  and all of them report that the stream is corrupt.

You can see some references to standard Java classes, such as java/util/Set, but also a lot of smaller references to things like 'fic', or 'vot'.  I'm guessing these are either obfuscated class names, or they are part of some kind of lookup/offset table.

My other guess is that as it's a Google product, it's probably using a Google serialisation library, like GSON or protobuf, but the data doesn't look like either of those.

Anyone come across this before, or can shine some light on it?


问:
Immunity Debuggger Inconsistent Results
Question for people using Immunity Debugger.

Just started using Immunity Debugger, using 1.85 on Win 7 Pro.

Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity Debugger. I will attach vulnserver.exe, select run in IB and execute a script to crash vulnserver to analyze the output. Detach & restart vulnserver.exe, then attach again and run the same script. I get two different results in the output.

However, if I exit and restart Immunity Debugger between scripts, I get the correct output after running a script each time.

Is this standard behavior for Immunity Debugger? You have to exit and restart between each debugging capture?

I have re-installed IB twice and it continues to give these inconstant results.

TIA

Title: Immunity Debuggger Inconsistent Results


问:
Opening the test file in the Radare2 recording mode
I'm studying the radare2 utility (I installed it on Windows) and I wanted to edit the file with it. But an error constantly occurs:

```<code>[0x080486f5]> oo+
r_core_file_reopen: Cannot reopen file: C:\Users\User\Desktop\crackme\megabeets_0x1 with perms 0x0006, attempting to open read-only.
</code>```

I don't understand what the matter is.


问:
What's the pattern in this sequence extracted from a LYR document, used by the ESRI ArcGIS
I'm trying to reverse engineer a binary format, and I'm running up against a variable-length sequence of numbers which varies between files. I can't work out the pattern here and how to determine how long this sequence is. I'm 99% sure that the sequence is self-contained and isn't reliant on any information from the preceding parts of the file.

An example (in hex) of the sequence is:

```<code>06 00 00 00    01 00 00 00    fd ff ff  ff     08 00 00 00    f7 ff ff ff     0e 00 00 00
</code>```

To me, this looks like a sequence of little endian signed integers (i.e. 6, 1, -3,  8, -9,  14)

Here's some sequences I've collected:

6, 1, -3, 8, -9, 14

5, -11, 10, 13, -14, 27

2, 0, 3

3, 6, -7, 9

3, 1, -3

348, 1, -348

4, 1, -4

18, 1, -18

28, 1, -28

244, 1, -244

70, 1, -70

449, 1, -446, 453, 455, -456

12, 0, -1, 5, 9, 11, -12, 14, 17, 19, 25, 31, 33

69, 7, 13, 31, 87, 136, 168, 267,275, 277, 323, -324, 327, 329, 331, 334, -334, 337, 340, 344, 371, 379, 383, 386, 416, 422, -423, 426, 429, 432, 446, 686, -689, 692, -709,725, -727, 731, 833, 837, 841, 845, 856, 860, 868, 877, -878, 883, 885, 887, 909

1, 2

1, 861

1, 22

1, 1

1, 78

1, 93

1, 5

1, 9

1, 4016

Any ideas?

Update:
As requested, some extra context:

This is part of a "LYR" document format, used by the ESRI ArcGIS mapping software. LYR files are structured using the Microsoft Compound Document Format. All the useful content is stored in a single file contained inside the document.

This file stream uses (a variation of) the COM IPersistStream interface to encode the object's contents/properties

LYR objects consist of a hierarchy of objects -- they basically directly represent the original object class structure, with layer containing a renderer which itself contains multiple fill/line/marker symbols, a "labeling properties" object, a "field" set, etc.

This sequence occurs mid-way through reading the bytes encoded by a "FeatureLayer" object. It's almost right in the middle of the content encoded by FeatureLayer objects, and doesn't fall into any headers or footers.

For 99% of the files encountered, this sequence consists of a single 00 00 00 00 integer.

There's absolutely no chance of missed digits in the sequences above -- the sequences are bordered on either side by bytes of known purpose (the persisted stream representing the "area of interest" Envelope object for the layer and an array of layer "Extension" objects -- both of which are direct members of the FeatureLayer class).

This sequence does not seem to contain any actual useful content -- every member of the FeatureLayer object class is encoded elsewhere

The files aren't corrupt, and will open fine in the original software (ArcMap). However, saving them without any changes results in the sequence being removed from the file. It's possibly something which was only written in earlier versions of the software, OR it represents some temporary/cached values which don't directly form part of the persisted object state...


问:
How to prepend offset to smart names?
So I'm trying to reassemble an PE to ELF so I can debug it with rr.

However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts. If they were postfixed with stack or data offset respectively there wouldn't be such problems.

Alternatively maybe there is a switch in masm which can correct those errors.

TRAOD_P4_orig.exe.v2.data.asm(1058192) : error A2005:symbol
  redefinition : Args TRAOD_P4_orig.exe.v2.data.asm(2724112) : error
  A2005:symbol redefinition : Dest

```<code>; LINE somewhere in the code above
Dest            = byte ptr -404h
Args            = byte ptr  10h

; LINE 1058192
; char Args[]
Args            dd ?                    ; DATA XREF: _Caption_Draw:loc_523425\u2191r

; LINE 2724112
; char Dest
Dest            db ?                    ; DATA XREF: sub_42DF68+38\u2191o
</code>```

Apparently there was even a case where Memory was both a local variable and a data reference in the same function.

Title: How to prepend offset to smart names?


问:
Is it possible to define the adress of a function in assembly?
I am creating a PoC for anti-disassembly techniques, and I would like to know if there were ways to define the address of functions once compiled with gcc.

Here is the PoC program :

```<code>BITS 32
EXTERN puts
SECTION .data
    chaine      db "Hello world !", 0

SECTION .text
    GLOBAL main

    I_Want_to_control_this_func_addr:
    ret

    main:
    push chaine
    ; xor eax, eax
   jz beer+1
beer:
   db 0xe8
    add al, 3
    add al, 8
    pop eax
    ret
</code>```

I would like the function to have the address 0x08040309.

I am compiling with : nasm -f elf test.asm; gcc -m32 -o test test.o


问:
Reversing Contactless Chip Capabilities
I have a contactless card which I'd like to know the capabilities. I assume the card works with NFC. However standard tools (nfc-list) do not seem to be able to retrieve regular informations from it (not even the UID), the phone can't detect it either. This may be because the chip may have a not common NFC type.

Now my question is: how can I know what kind of chip technology this is so I can begin working on understanding how data is stored and what is the protocol ?

What kind of additional hardware other than a simple reader (e.g ACR122U) may come handy to identify the card ?

OwnerDisplayName: Ra'Jiska

Title: Reversing Contactless Chip Capabilities


问:
Strange behaviour debugging Android ARM binary with gdbserver
I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any guidance!

If I run the program

```<code>$ adb push validate /data/local/tmp
$ adb shell /data/local/tmp/validate AAAAAAAAAAAAAAAA
Entering base32_decode
Outlen = 10
Entering check_license
Incorrect serial.
</code>```

It works as expected.

The issue arises when I attach gdbserver to the process and attempt to debug it over the network with gdb running on my x86_64 machine (Ubuntu 18.04).

Run under GDBserver

```<code>$ adb root
$ adb forward tcp:8888 tcp:8888
$ adb push validate /data/local/tmp
$ adb shell gdbserver --version
GNU gdbserver (GDB) 7.11
$ adb shell gdbserver :8888 /data/local/tmp/validate
</code>```

Connect with GDB from host (Ubuntu 18.04 x86_64)

```<code>$ ~/Android/Sdk/ndk/20.0.5594570/prebuilt/linux-x86_64/bin/gdb --version
GNU gdb (GDB) 7.11
$ ~/Android/Sdk/ndk/20.0.5594570/prebuilt/linux-x86_64/bin/gdb

gdb$ target remote :8888
gdb$ break *(0x2a000000 + 0x3bc) # Set breakpoint in main function
gdb$ c
Program received signal SIGSEGV, Segmentation fault.
0x2a0003c0 in ?? ()
</code>```

Upon further inspection, it seems that the reason it fails, is because GBD fails to restore the instruction at the breakpoint to it's original value after mangling it to facilitate the breakpoint.

Try with hardware breakpoint instead

```<code>gdb$ hbreak *(0x2a000000 + 0x3bc)
</code>```

No SIGSEGV this time, but now if we try to step with

```<code>gdb$ nexti
</code>```

It doesn't increment the program counter

Even if we clear the break points, it's still stuck on that one instruction and there doesn't appear
to be any way to make gdb continue execution.

Android Image Details (taken from Android Studio AVDManager)

Name:    Pixel_3_XL_API_25_armeab-v7a

CPU/ABI: Google APIs ARM (armeabi-v7a)

Aditional notes

gdb sets the architecture to armv5te so it's probably not related to gdb not supporting the architecture

I've tried a few other versions of gdb (7.11, 8.1, 8.3) compiled with ARM support, none work and the behaviour is inconsistent between versions

I've tried gdbserver versions 7.11 and 8.3, neither made a difference

The steps outlined above work fine when the android image is x86, they only fail if it's ARM.


问:
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.

Code area in range 0x0000..0x7ffff is common always accessible code bank.
Upper side of code memory 0x8000..0xffff is mapped to banks in extended code memory which specified by some bank selector register.

What is recipe to handle analysis of this kind of code overlaying?

Title: Radare2 8051 code bank switching


问:
Intel Pin assertion failed: RTN_Valid(x)
I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The real use of a tool was on the Win7 virtual machine. Recently, I started getting incorrect behavior of a tool. It doesn't crash, however, it stops recording traces before it should and writes the following in the log file:

```<code>A:  source\pin\pin\image.cpp: LEVEL_PINCLIENT::RTN_Name: 2012: assertion failed: RTN_Valid(x)
</code>```

I thought that it was caused by recent updates of a Windows or new antivirus that was introduced by our IT department. However, I tested it on the Win7 VM and it worked there as fine as before. Then I have created Win10 VM without antivirus and switched off all possible security features but got the same assertion failed problem. I have been using Intel Pin 3.6, so I decided to build my tool under 3.11 but got the same problems.

Finally, a question: what causes such behavior?

I know, that Pin's FAQ doesn't explicitly say (https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-faq) that Intel Pin should work on Win10, however it worked for me before.


问:
Need help reversing .m4t TTML subtitles format
I am currently trying to create subtitles for some proprietary Sony software. Unfortunatly, it only recognizes Sony's own .m4t subtitles format. After some research I found that this subtitles is also used in Crackle app for PS3.

There is source code of this app available here:
https://github.com/eigentopia/PS/tree/92d04b264016c4a16c6772bd9cf7c1184649cf54/js/app/com/dadc/lithium

Look for model/TTMLSubtitleModel.js

This format appears to be some variant of TTML subtitles.

Subtitles converted to .ttml and with extintion changed to .m4t is recognized by the programm, but isn't displayed.

Any help with figuring out this format (or it's differences from standard TTML) is appreciated.


问:
<error sending command to monitor>
I'm trying to debug a backtrace created with rr so I type:

```<code>rr replay -s 50505 -k
</code>```

it displays out:

```<code>gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target
</code>```

Then I attach to it with ida remote debugger - i can continue, dismiss exceptions but nothing else - pressing the step over button just resumes the process.

Also rr have special set of instructions reverse-* however when i type anything in the gdb command line at the bottom it says:

```<code><error sending command to monitor>
</code>```

Title: <error sending command to monitor>


问:
Angr Use argv as initialstate
I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "Done!" being printed.
I thought of using the following in my python script:

```<code>b = angr.Project('a.out')
arg1 = claripy.BVS('arg1', 32)
b.factory.entry_state(args=['a.out', arg1])
pg = b.factory.simgr()
pg.explore(find=lambda x: b'Done!' in x.posix.dumps(1))
</code>```

In my current knowledge of angr, this should result in the path, wich leads to "Done!" being printed. Am I mistaken? With found[0] I could then access the result.
But angr leaves me with

```<code><SimulationManager with 1 deadended>
</code>```

as an output for my simulation manager. What am I doing wrong? Are there more requirements needed for this to work?

Apriciate any help.

Cheers

Title: Angr Use argv as initialstate


问:
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like to see the imported functions and DLLs for these binaries. I've noticed that _CorExeMain is the only thing that I can see in the imports section with tools such as IDA for such binaries. I'm aware that I can decompile the .NET binary in a tool like dnSpy and manually read the function calls but I would like an automated and fast of doing this such as the imports section in IDA.

Is there a way to see functions imported from dynamic libraries for .NET binaries?


问:
How to extract an unknown archive files? (umd "I am alive" PC)
I'm trying to extract game files which contains textures, meshes etc. I wanted to see how hard would it be to make a texture mod. I just have knowledge on editing graphics from school and youtube tutorials and I'm really lazy and give up on something really fast but I thought if I could work on this game from the very beginning, having a whole structure of files which I could make sense of (not like with ninjaripper) maybe I could motivate myself to do this. I tried to use quickbms script and some tools from xentax and zenhax forums but quickbms gave me and error and the tool did nothing. I'm a total beginner to reverse engineering as I've only touched it because I didn't have much to do.

 I've got the header of the file which is EPCK, then the next line I guess is unpacked file size (based on offzip scan seeing almost all files with size of 131072) I have the offset refering to first file in the archive? which is 29, and I have a part which is the beginning of each file?  which is ".x" or "x". I've tried to understand quickbms script to see if I could make something of it and what was the reason that I got an error but even though I understood that it makes array which stores the offset I couldn't understand the reason behind the error. So long story short I need help with next steps to unpacking the file. I'd like to understand it completely from the beginning so I could help other beginners or so I could just stop asking for help. I guess it'll be really hard to understand for me since this archive is probably encrypted. Quickbms script gives an error on line 42.

Script: https://drive.google.com/open?id=1C1cGRsaY4Kx9xgL4Ov-VYA61wNTqtzC0

File: https://drive.google.com/open?id=1l2eWZmBwxRe6RraLWQRWBTfkz8zW-PRL

```<code>idstring "EPCK"
get DUMMY long
get UNPACKED_SIZE long
get OFFSET long
goto OFFSET
get XSIZE long
get SIZE long
get ZSIZE long
savepos OFFSET
#clog MEMORY_FILE OFFSET ZSIZE SIZE  # unused? zlib compression
math OFFSET += XSIZE
goto OFFSET

endian big
comtype xmemdecompress

get EPCK_SIZE asize
putvarchr MEMORY_FILE UNPACKED_SIZE 0
log MEMORY_FILE 0 0
append
for OFFSET = OFFSET < EPCK_SIZE
    math NEXT_OFFSET = OFFSET
    math SIZE = 0
    for STOP = 0 == 0
        goto NEXT_OFFSET
        get CHUNK_ZSIZE byte
        if CHUNK_ZSIZE == 0xFF
            get CHUNK_SIZE short
            get CHUNK_ZSIZE short
            math STOP = 1
        else
            goto NEXT_OFFSET
            get CHUNK_ZSIZE short
            math CHUNK_SIZE = 0x8000
        endif
        math SIZE += CHUNK_SIZE
        savepos NEXT_OFFSET
        math NEXT_OFFSET += CHUNK_ZSIZE
    next
    math NEXT_OFFSET += 5
    xmath ZSIZE "NEXT_OFFSET - OFFSET"
    clog MEMORY_FILE OFFSET ZSIZE SIZE
    math OFFSET = NEXT_OFFSET
next
append

set NAME string "dump_scc_data.bin"
get SIZE asize MEMORY_FILE
goto 0 MEMORY_FILE
findloc OFFSET binary "\0\0\0\0\0\0\0\0" MEMORY_FILE ""
if OFFSET == ""
    log NAME 0 SIZE MEMORY_FILE
else
    math OFFSET x= 0x10000
    log MEMORY_FILE2 0 OFFSET MEMORY_FILE
    append
    filexor 0xb7
    xmath TMP "SIZE - OFFSET"
    log MEMORY_FILE2 OFFSET TMP MEMORY_FILE
    append
    filexor ""
    log NAME 0 SIZE MEMORY_FILE2
endif
</code>```


问:
Deconstructing Unity games
Note: I only want to edit/mod the games not trying to steal things etc.

I'm trying to deconstruct some Unity games from both PC and Android platforms and already extracted assets with uTinyRipper successfully, but having the some issues at the script part.

What exactly should i do to export scripts correctly from a compiled Unity game to editor?

Firstly I deobfuscate everything in data\managed with de4dot

Secondly I extract the code from these .dlls with dnSpy

Then I import all the .cs files to Unity editor

After that, Unity gives hundreds/thousands of errors, when i fix all of them, it gives another hundreds of errors. So it doesn't stop giving more errors.

Title: Deconstructing Unity games


问:
jmp to 4 byte address in shellcode
I'm playing around with the PE header and the Import Address Table. I wrote a dummy program that calls MessageBoxA with some retard parameters. After successfully replacing the MessageBoxA function address with an address inside a cave with PAGE_EXECUTE_READWRITE access, I tried running the program. The shellcode is just messing with the pushed arguments and afterwards it's jumping to the original MessageBoxA function address.

If the address is 75FD0CD0 then the Little Endian representation would be D00CFD75, right?

After running it and the program successfully calling the code inside the cave, it would crash. I opened Cheat Engine to compare the values. The instruction that was supposed to jump to the MessageBoxA function was showing a jump to a different function. After opening the edit option, the instruction was: jmp 76552F20 instead of jmp 75FD0CD0. I edited that and put the correct address inside and the bytes that were written were 80EAA475 which was somehow pointing to the MessageBoxA function.

How did Cheat Engine get 80EAA475 from 75FD0CD0?

Title: jmp to 4 byte address in shellcode


问:
static core dump analysis
I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..)

Most of the answers available on the web speak about coredump analysis using the binary that produce it.

I'm looking for a tool able to retrieve some information or a specification/standard about how is a coredump mapped (to do my own tool).

Title: static core dump analysis


问:
Extracting Archive-Like file format analysis that does not seem to match known formats
Good afternoon,

I am looking to try me skills at extracting some data from a proprietary format. I have made some progress but I wanted to contact the experts to see if I could gain some insights. The format in question is the '.clip' format created by the software 'clip studio paint'. Specifically this is a raster graphics editor (Photoshop-like) which I would like to get the image data from. There should, in the most basic usage, be a bunch of layers, each being an image. (For raster graphics, not vector)

The format seems to be not encrypted or compressed, but rather split up in some kind of archive format. All regular archive tools I have tried can't make any sense of it (zip, tar, etc). It might be an archive format more common to windows which I am not as familiar with.

Manually parsing the file with python I was able to find a raw sequence near the end which is in sqlite3 format. I was able to extract this and read the tables which contain the majority of the metadata. Unfortunately this does not shed much light on a way to extract the image data. I was able to split on a few delimiters I found in the file but still I would not find any image algorithm which was able to make sense of the delimited parts.

Outer delimiters in the file seem to look like:

b'CHNKHead'
 b'CHNKFoot'
 b'CHNKExta'
 b'CHNKSQL'

And there are also many inner delimiters in some of these chunks like:

b'B\x00l\x00o\x00c\x00k\x00D\x00a\x00t\x00a\x00B\x00e\x00g\x00i\x00n\x00C\x00h\x00u\x00n\x00k'
b'B\x00l\x00o\x00c\x00k\x00D\x00a\x00t\x00a\x00E\x00n\x00d\x00C\x00h\x00u\x00n\x00k'

(I am guessing the special null byte separation to reduce the chance that this sequence matches other binary data?)

Anyway I am attaching my little python split and save script and the sample CSP file I am trying to read, incase anyone was interested in taking a look. http://s000.tinyupload.com/index.php?file_id=04264848249049623399


问:
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into Wireshark as an RSA cert but it requested a passphrase to decrypt the key. Of course I don't have the passphrase but surely the application must know it somehow and I couldn't find the passphrase in any configuration files so I figure it must be in the main executable or possibly in a dll.

The program uses libcurl.dll and libssl-1_1.dll, my plan is to disassemble the main executable and try to find a function call to the OpenSSL API (libssl-1_1.dll) and see if the passphrase is possibly referenced somewhere in it.

If I were looking for a particular function that takes a passphrase to decrypt a PEM file what function would it be? And if anyone has any better ideas please let me know. I've never been this directly involved with SSL/TLS in applications, any time I've written a server/client application that used TLS it's been in Python using very high level methods. Thanks for any help.


Title: Reversing a firmware update for an LG HTS

Body:
I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall.

This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the markings "D78F1165 1205EM406 MALAYSIA" which led me to to believe its the μPD78F1165 from NEC / Renesas, at least the pin configuration matches in the datasheet and schematics.
Interestingly, the hardware manual shows that this chip has internal ROM but in this home theater it’s connected to an external EEPROM chip (ST M24C16, 16-Kbit).The update file is exactly 2KB in size so it matches the EEPROMs size.

The file has a wired structure. It has some headers and the data is duplicated for some reason.

It has some strings

```<code>...
0000c000  4c 6f 61 64 65 72 46 57  24 20 20 20 20 20 20 20  |LoaderFW$       |
0000c010  4d 41 49 4e 00 16 80 00  00 00 00 00 00 09 30 00  |MAIN..........0.|
0000c020  50 4f 57 43 00 01 00 00  02 00 00 00 00 00 04 00  |POWC............|
0000c030  46 41 54 42 00 01 10 00  01 0f e0 00 00 00 20 00  |FATB.......... .|
0000c040  50 41 52 4d 00 01 50 00  02 00 00 00 00 00 20 00  |PARM..P....... .|
0000c050  42 4f 4f 54 00 00 00 00  00 00 00 00 00 00 10 00  |BOOT............|
0000c060  53 48 49 46 00 1f b0 00  04 00 00 00 00 00 10 00  |SHIF............|
0000c070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
...
00010000  05 80 00 31 1f 00 00 00  4d 54 4b 20 38 35 35 30  |...1....MTK 8550|
00010010  4a 56 30 33 39 30 20 20  20 20 20 20 38 35 35 30  |JV0390      8550|
00010020  30 33 39 30 04 30 9f e5  03 30 8f e0 13 ff 2f e1  |0390.0...0..../.|
...
0008b410  06 06 41 62 6e 6f 72 6d  61 6c 20 74 65 72 6d 69  |..Abnormal termi|
0008b420  6e 61 74 69 6f 6e 00 00  00 41 72 69 74 68 6d 65  |nation...Arithme|
0008b430  74 69 63 20 65 78 63 65  70 74 69 6f 6e 3a 20 00  |tic exception: .|
0008b440  49 6c 6c 65 67 61 6c 20  69 6e 73 74 72 75 63 74  |Illegal instruct|
0008b450  69 6f 6e 00 00 00 00 49  6e 74 65 72 72 75 70 74  |ion....Interrupt|
0008b460  20 72 65 63 65 69 76 65  64 00 00 00 00 00 49 6c  | received.....Il|
0008b470  6c 65 67 61 6c 20 61 64  64 72 65 73 73 00 00 00  |legal address...|
0008b480  00 00 00 00 00 54 65 72  6d 69 6e 61 74 69 6f 6e  |.....Termination|
0008b490  20 72 65 71 75 65 73 74  00 00 00 00 53 74 61 63  | request....Stac|
0008b4a0  6b 20 6f 76 65 72 66 6c  6f 77 00 00 00 00 00 00  |k overflow......|
0008b4b0  00 00 00 52 65 64 69 72  65 63 74 3a 20 63 61 6e  |...Redirect: can|
0008b4c0  27 74 20 6f 70 65 6e 3a  20 00 4f 75 74 20 6f 66  |'t open: .Out of|
0008b4d0  20 68 65 61 70 20 6d 65  6d 6f 72 79 00 00 00 00  | heap memory....|
0008b4e0  00 55 73 65 72 2d 64 65  66 69 6e 65 64 20 73 69  |.User-defined si|
0008b4f0  67 6e 61 6c 20 31 00 00  55 73 65 72 2d 64 65 66  |gnal 1..User-def|
0008b500  69 6e 65 64 20 73 69 67  6e 61 6c 20 32 00 00 50  |ined signal 2..P|
0008b510  75 72 65 20 76 69 72 74  75 61 6c 20 66 6e 20 63  |ure virtual fn c|
0008b520  61 6c 6c 65 64 00 43 2b  2b 20 6c 69 62 72 61 72  |alled.C++ librar|
0008b530  79 20 65 78 63 65 70 74  69 6f 6e 00 00 4f 75 74  |y exception..Out|
0008b540  20 6f 66 20 68 65 61 70  00 00 00 00 00 00 00 00  | of heap........|
...
</code>```

and an "end of file/segment"? marks

```<code>...
000ffff0  00 ff ff ff ff ff ff ff  00 00 00 00 45 4e 44 46  |............ENDF|
...
001ffff0  00 ff ff ff ff ff ff ff  00 00 00 00 45 4e 44 46  |............ENDF|
00200000
</code>```

Per this answer, I tried loading it to Cubesuite+ (v2.2.0) with various offsets and it never worked. It will error either “bad instructions” or “illegal file type”.

I tried running Binwalk to check the architecture and this is what it shows:

```<code>$ binwalk -B Downloads/H12IM2S.ROM

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

$ binwalk -Y Downloads/H12IM2S.ROM

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64662         0xFC96          ARM executable code, 16-bit (Thumb), little endian, at least 851 valid instructions

binwalk -Y --verbose Downloads/H12IM2S.ROM

Scan Time:     2019-11-18 23:22:29
Target File:   /home/Downloads/H12IM2S.ROM
MD5 Checksum:  73ec6a79d66112a7580f5dc7d0213594

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64662         0xFC96          ARM executable code, 16-bit (Thumb), little endian, at least 851 valid instructions
64662         0xFC96          movs r0, r0
64664         0xFC98          movs r0, r0
64666         0xFC9A          movs r0, r0
64668         0xFC9C          movs r0, r0
64670         0xFC9E          movs r0, r0
64672         0xFCA0          movs r0, r0
64674         0xFCA2          movs r0, r0
64676         0xFCA4          movs r0, r0
64678         0xFCA6          movs r0, r0
64680         0xFCA8          movs r0, r0
64682         0xFCAA          movs r0, r0
64684         0xFCAC          movs r0, r0
...
</code>```

There's also a MediaTek MT8580 SoC on the board which handles the USB port and Ethernet, so maybe it makes sense to have some ARM instructions in the update file?

Where do I go from here?
Should I remove the EPROM chip and try to dumb it’s content or is there a way to get the firmware from this update file?

PS, I’m mostly interested in the firmware of this controller because it’s blocking Multichannel PCM audio from any HDMI input except from other LG Blu-ray players. I.e. it will only play stereo PCM from any pc or PlayStation and other devices that I tested but it will perfectly play 5.1 PCM if it comes from another LG Player. Checked with the main service provider here in Germany and this is by design as a copyright protection. Unbelievable!


问:
What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?
The relevant files for this question are here:

https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip

Contains a before and after DLL.  This simple PHP script demonstrates the problem:

```<code><?php
    $ts = microtime(true);
    file_put_contents("test.dll", file_get_contents("32_pe_msmpeng_before.dll"));
    echo "Time taken:  " . sprintf("%.02f", microtime(true) - $ts) . " sec\n";
    unlink("test.dll");

    $ts = microtime(true);
    file_put_contents("test.dll", file_get_contents("32_pe_msmpeng_after.dll"));
    echo "Time taken:  " . sprintf("%.02f", microtime(true) - $ts) . " sec\n";
    unlink("test.dll");
?>
</code>```

The output looks like:

```<code>>php test.php
Time taken:  0.00 sec
Time taken:  4.14 sec
</code>```

The only difference between the two DLLs is that the certificate table has been removed and the PE checksum has been updated in the "after" DLL.  The 4 second delay is caused by MsMpEng.exe using 100% of one core of a CPU during that time.  MsMpEng.exe is the main Windows Defender realtime scanning engine.  The files are not flagged as malware but the behavior is bizarre in that simply removing the certificate table would trigger a deep scan.

The original file was modified using my Windows PE File Tools for PHP and these commands:

```<code>php pe_tools.php modify clear-certs 32_pe_msmpeng_before.dll 32_pe_msmpeng_after.dll

php pe_tools.php modify apply-checksum 32_pe_msmpeng_after.dll 32_pe_msmpeng_after.dll
</code>```

I've checked the "after" file in every conceivable way I can think of and it appears to be completely valid to all of the tools I've used.  I've also modified plenty of other PE files without tripping up the realtime scanner.  Just this file causes the time delay and spike in CPU usage and that only happens after the certificate table is removed.  I can make all kinds of other crazy changes to the file that should immediately result in an invalid certificate table (e.g. adding a new PE section, embedding icons, etc) and it won't trip up the realtime scanner either.  But remove the certificate table entirely and that 4 second delay + 100% CPU in MsMpEng.exe appears.  This behavior seems to imply that just having a certificate table possibly bypasses portions or even, um, all of Windows Defender...

But that's not really the question.  What I'd like to know is what exactly is in the "after" DLL that is causing MsMpEng.exe to conduct a deep scan that takes upwards of 4 seconds to complete?


问:
ASUS Strix Vega 56 or 64
I'm in the process of creating ASUS AURA drivers for Linux. I'm hoping somebody here has access to a Strix version of the Vega 56 or 64 on a windows machine? If you do, would you please dump the smbus. This can be done using a demo version of AIDA64. Right click the bottom status bar and select "debug video -> dump ATI SMBUS" (or something like that).

I have the Polaris line of cards figured out, but Vega and Navi have thrown me a curve ball.

Title: ASUS Strix Vega 56 or 64


问:
Go back to the original entry point after executing the instructions in the newly added segment- PE32+, C++
I am learning PE32+ (64 bit) files. I have added a new section to the PE32+ file and made the new section as the entry point. Some simple instructions are added in the new segment. Now I want to go to the old entry point after executing the new segment, then continue execution from there. I read the articles for PE32 that are using assembly language instructions. But I am not able get it working for 64 bit(tried to add .asm files). Please help me with any useful information. Is it possible to do it in C++?


问:
How to use arm-none-eabi-objcopy to extract texts, translate, and rebuild ELF file
I have this arm elf file: https://www20.zippyshare.com/v/2yLS1H8D/file.html

I want to extract the user-interface texts to translate them to my local language.
I found the section containing the texts and tried to

```<code>arm-none-eabi-objcopy hmi --dump-section .rodata=dump.txt
</code>```

there are English and Spanish texts in it, and i want to change the Spanish ones to German ones.

how can i take the ELF apart, change these texts and rebuild the elf back again in a correct way?

I did some text changes with a hex editor but this does not work very well.


问:
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil

my aim is to get full source code,

I tried decompiling using dnSpy, JustDecompile & Reflector

however it just shows the public methods and properties inside the dll

and no method body is shown

something like this:

```<code>    public class TestManager
    {
        // Fields
        private OleDbDatabase b;

        // Methods
        public TestManager();
        public OperationResult AddRecord(XProfile record);
        public OperationResult RevokeRecord(XProfile record);
    }
</code>```

it errors out when I try to export source code

so how do I get the source code? is it possible?

I guess at-least if I see the IL code then I can rewrite the functions

Title: reverse engineering obfuscated .net dll


问:
TMS320VC5416 DSP firmware reversing
I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers:

page: 0000 offset: 0080 len: 0149

page: 0000 offset: 02c2 len: 033b

page: 0000 offset: 0639 len: 14d4

page: 0000 offset: 1bc6 len: 0053

page: 0000 offset: 4000 len: 0100

page: 0000 offset: 4220 len: 0009

page: 0000 offset: 4300 len: 00a1

page: 0000 offset: 4670 len: 0075

page: 0000 offset: 46f0 len: 00c4

page: 0000 offset: 47c0 len: 003e

page: 0000 offset: a210 len: 0009

page: 0000 offset: b0a4 len: 0030

page: 0000 offset: b1a8 len: 0039

page: 0000 offset: c000 len: 0200

page: 0000 offset: c9db len: 003f

page: 0000 offset: ca20 len: 013b

page: 0000 offset: cb60 len: 0034

page: 0000 offset: ce81 len: 00d1

page: 0000 offset: d000 len: 0100

page: 0000 offset: d200 len: 080e

page: 0002 offset: 9000 len: 339a

page: 0002 offset: f000 len: 08ab

page: 0003 offset: 8000 len: 435d

How can I implement memory paging addressing using standard ida pro facilities ?

Title: TMS320VC5416 DSP firmware reversing


问:
API Hiding Issue
I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a breakpoint on GetProcAddress() and I ran it. Then I saw decoded API names like OpenProcess, CreateMutex etc..

But I could not find its location in malware I'm analyzing. So, I cannot identify API parameters.

How can I do this?

Title: API Hiding Issue


问:
How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange
This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine using a disassembler like IDA?

Warning: The program is flagged as malware by Windows Defender.

hxxps://drive.google.com/open?id=1uErzKPIV-HyOBunn0ecF6pehXJ_mDdGR


问:
How can I find loading adress of eCos firmware
From:https://www.tendacn.com/en/download/detail-3482.html

Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find entry point address?
binwalk's output:


问:
Export logic analyzer data to protocol analyzer
Probably I'm little ot but I'm unsure where to ask this.
Is there any easy (already working) way to export my logic analyzer data (vcd format) to a protocol analyzer like Wireshark? I'm analyzing an USB stream.</p>


问:
How to hook eval function in node.js
As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me how to hook or monkey patch eval() function.

Title: How to hook eval function in node.js


问:
Alternative for Wireshark for USB packet sniffing
I'm looking for alternative for Wireshark, with this requirements:

Cross-platform (Windows and Linux)

USB packet sniffing

Easy creation of dissectors

Wireshark is great, but Lua API for writing dissectors miss some critical features, like conversations (linking request and response packets).


问:
Ghidra loading Linux kernel function signatures

TLTR

I want to load Linux kernel headers vs. 4.19 to Ghidra so that it recognizes kernel structures and function signatures.

Full description

I'm trying to reverse engineer a Linux kernel module (kernel version 4.19).
Ghidra does recognize correctly all function names such as: open, misc_register, etc., but it cannot determine their exact signatures.

Let's take as an example the copy_from_user() function with the signature:

```<code>unsigned long copy_from_user (void *to, const void __user *from, unsigned long n);
</code>```

and here's how Ghidra sees it:

```<code>undefined _copy_from_user (void)
</code>```

I believe that it won't be the last kernel module for me to reverse engineer, and so I would like to learn how to load all missing kernel structures to the program.

Moreover, I am aware that I can edit the function signature by hand, but I would then need to add plenty of structures by hand as well (such as struct file) and this would be very ineffective.

What I've tried so far

(I'm super new to Ghidra and if you know a better way to load Linux kernel headers, please just share.)

I've downloaded headers from Debian repository:

```<code>$ wget linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb .
$ ls
linux-headers-4.19.0-6-common_4.19.67-2+deb10u2_all.deb  usr
$ ls /usr/src/
linux-headers-4.19.0-6-common
</code>```

I extracted and copied the whole content of all files into all_headers.h (Ghidra didn't want to accept the directory itself. I couldn't find any information about loading files form Makefile as well)

```<code>$ cat `find . | grep .h` > all_headers.h
$ cat all_headers.h | wc -c
29824650
</code>```

And I've provided all_headers.h to get parsed, but Ghidra has only added around 20 defines and no function signatures.


问:
How to dump a unpacked PE and still get the API names with IDA when they are called directly?
So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)

i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one from there, and the IAT search was successful

but the problem is after dumping it and loading it in IDA so i can use the decompiler, the API calls are like MEMORY[address](a , b . c)

i couldn't use the IDA to debug it because it gave some error before reaching WriteProcessMemory, i guess some anti debugging stuff, even with scyllahide i couldn't bypass these errors, but weirdly enough x32dbg had no problems, errors are because of wrong memory access, but somehow x32dbg has no problem!

so how can i fix this? i checked the addresses in MEMORY[address] and they are in fact the address of API calls, but i guess since the program is using them directly and not via IAT then IDA cannot know what are they, i guess one fix would be somehow including those dlls in their exact address in the dumped PE but i dont know how


问:
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like

```<code>call    ds:dword_4010B4
</code>```

now these are actually addresses of APIs in kernel32.dll

my problem is IDA doesn't know that these are kernel32 APIs and therefore in the decompiler all i see is stuff like

```<code>MEMORY[address](&v1, "explorer.exe %s", &v2);
</code>```

which are API calls without names

so how can i sync these API calls with their actual names? is there any way i can tell IDA that for example kernel32.dll is loaded at address x so it can therefore load it there statically or  dynamically and resolve these names ?