问:
Understand DLL function signature from ordinal
I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions.

To my surprise the DLLs don't use names to export functions like the ELF format, but use the so called ordinals and you need another file (the corresponding .lib) to link them with the actual name.

In the binary there is a particular function that seems to call ordinal 4129 and ordinal 5710 corresponding to CString::Left(int) and CString::Right(int) respectively (ghidra internally uses an XML to track the correspondence function <-> ordinal).

But if I check the actual assembly of this function seems that these functions take a further argument (this can be deduced from the stack depth value that you can enable along the disassembly with ghidra). Obviously I'm taking into account the fact that the class instance is passed via the ecx register but that it's not relevant for the discussion, I'm interested in the arguments passed using the stack.

Trying to reverse the dll itself, indeed ghidra finds out the signature as having two arguments but bad enough it cannot tell what is the actual name of these functions.

Since mfc42.dll (I think) is a pretty standard library can anyone explain to me what is going on?

To add information, the application seems compiled using Visual Studio VC6, this can be deduced from the signature of the FuncInfo structure that is 0x19930520.


问:
WinDbg does not shows all first chance exceptions
I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this:

```<code>[14:29:38] Exception: E06D7363.?AVCServicesMDException@@
[14:29:38] Exception: E06D7363.?AVCServicesMDException@@
[14:29:38] Exception: E06D7363.?AVCBaseException@@
[14:29:38] Exception: E06D7363.?AVCBaseException@@
</code>```

I want to attach to process and analyze some of these exceptions. But have difficulties with setting WinDbg to handle it.

I run .foreach(exc {sx}) {.catch{sxe ${exc}}} & sxe * to catch all first chance exceptions and events.

But got nothing similar to exceptions from dump (written by procdump).

ContentLicense: CC BY-SA 4.0


问:
Reversing ELF 64-bit LSB pie executable
I have a file crackme, which is an executable.

```<code>hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme
crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=5418569f8ce35c5b188b0a4f13e79f4a611ee54e, stripped
</code>```

I tried to follow the instructions of the solution of the bellow question.

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

Sadly, I have a problem and I can't find a solution.

What I did:

```<code>hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ gdb crackme -q
Reading symbols from crackme...
(No debugging symbols found in crackme)
gdb$ info files
Symbols from "/home/hamuto/Security/NOOB/FruitSalad/crackme".
Local exec file:
    `/home/hamuto/Security/NOOB/FruitSalad/crackme', file type elf64-x86-64.
    Entry point: 0x22b0
    0x00000000000002a8 - 0x00000000000002c4 is .interp
    0x00000000000002c4 - 0x00000000000002e4 is .note.ABI-tag
    0x00000000000002e4 - 0x0000000000000308 is .note.gnu.build-id
    0x0000000000000308 - 0x0000000000000340 is .gnu.hash
    0x0000000000000340 - 0x0000000000000850 is .dynsym
    0x0000000000000850 - 0x00000000000010d4 is .dynstr
    0x00000000000010d4 - 0x0000000000001140 is .gnu.version
    0x0000000000001140 - 0x00000000000011f0 is .gnu.version_r
    0x00000000000011f0 - 0x0000000000001508 is .rela.dyn
    0x0000000000001508 - 0x00000000000018b0 is .rela.plt
    0x0000000000002000 - 0x0000000000002017 is .init
    0x0000000000002020 - 0x00000000000022a0 is .plt
    0x00000000000022a0 - 0x00000000000022a8 is .plt.got
    0x00000000000022b0 - 0x0000000000009b81 is .text
    0x0000000000009b84 - 0x0000000000009b8d is .fini
    0x000000000000a000 - 0x000000000000a2da is .rodata
    0x000000000000a2dc - 0x000000000000ae90 is .eh_frame_hdr
    0x000000000000ae90 - 0x000000000000df70 is .eh_frame
    0x000000000000df70 - 0x000000000000e25c is .gcc_except_table
    0x000000000000fd10 - 0x000000000000fd28 is .init_array
    0x000000000000fd28 - 0x000000000000fd30 is .fini_array
    0x000000000000fd30 - 0x000000000000fdb8 is .data.rel.ro
    0x000000000000fdb8 - 0x000000000000ffc8 is .dynamic
    0x000000000000ffc8 - 0x0000000000010000 is .got
    0x0000000000010000 - 0x0000000000010150 is .got.plt
    0x0000000000010150 - 0x000000000001016c is .data
    0x0000000000010180 - 0x00000000000103f0 is .bss
gdb$

</code>```

As you can see the entry point is at 0x22b0. If I try to create a breakpoint and run :

```<code>gdb$ break *0x22b0
Breakpoint 1 at 0x22b0
gdb$ r
Starting program: /home/hamuto/Security/NOOB/FruitSalad/crackme

[1]+  Arrêté                gdb crackme -q
hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$
</code>```

The program actually get to the background, I can get it back with the command fg:

```<code>hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ fg
gdb crackme -q
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0x22b0
</code>```

It is still strange, that gdb went to the background, but that's not all if I try to disassemble the entry point, with a size of 50:

```<code>gdb$ disas 0x22b0,+50
Dump of assembler code from 0x22b0 to 0x2300:
   0x00000000000022b0:  Cannot access memory at address 0x22b0
</code>```

It doesn't work, I must be missing something. Thank you for your help.

Title: Reversing ELF 64-bit LSB pie executable


问:
How would I sniff kline data packets
I have a board that is using kline to communicate and I have a tool that can read the software from that board. I want to see the communication that is happening between the two to see how the tool is able to read the firmware from that board.
I didn't find any tool or any information on how to sniff kline packets. Found only how to sniff CAN packets.

I it is possible to sniff data using arduino or raspberry or any other tool.

All I'm interested in is making a software that can read the firmware from that board.

Title: How would I sniff kline data packets


问:
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:

According to the source for Lua, this function should be passed a pointer to the Lua_State struct:

```<code>LUA_API int lua_gettop (lua_State *L) {
  return cast_int(L->top - L->base);
}
</code>```

I'm currently trying to figure out what pointer is being passed to this procedure (In this case arg_0). I can attach a breakpoint and it correctly breaks, but how would I find the associated .data location for where it's stored?


问:
R13 off by 2 bytes. Any help?
in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable.

I have overwritten RIP register with the address of "print_flags", but when it is going to call "getenv" i get a SIGSEGV because of the argument passed to getenv which is "AGS" instead of "FLAGS".

What am i doing wrong?

```<code>00000000004006a6 <read_all_stdin>:
  4006a6:   55                      push   rbp
  4006a7:   48 89 e5                mov    rbp,rsp
  4006aa:   48 83 ec 20             sub    rsp,0x20
  4006ae:   48 89 7d e8             mov    QWORD PTR [rbp-0x18],rdi
  4006b2:   c7 45 fc 00 00 00 00    mov    DWORD PTR [rbp-0x4],0x0
  4006b9:   eb 18                   jmp    4006d3 <read_all_stdin+0x2d>
  4006bb:   8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
  4006be:   8d 50 01                lea    edx,[rax+0x1]
  4006c1:   89 55 fc                mov    DWORD PTR [rbp-0x4],edx
  4006c4:   48 63 d0                movsxd rdx,eax
  4006c7:   48 8b 45 e8             mov    rax,QWORD PTR [rbp-0x18]
  4006cb:   48 01 d0                add    rax,rdx
  4006ce:   8b 55 f8                mov    edx,DWORD PTR [rbp-0x8]
  4006d1:   88 10                   mov    BYTE PTR [rax],dl
  4006d3:   48 8b 05 86 09 20 00    mov    rax,QWORD PTR [rip+0x200986]        # 601060 <stdin@@GLIBC_2.2.5>
  4006da:   48 89 c7                mov    rdi,rax
  4006dd:   e8 ae fe ff ff          call   400590 <fgetc@plt>
  4006e2:   89 45 f8                mov    DWORD PTR [rbp-0x8],eax
  4006e5:   83 7d f8 ff             cmp    DWORD PTR [rbp-0x8],0xffffffff
  4006e9:   75 d0                   jne    4006bb <read_all_stdin+0x15>
  4006eb:   90                      nop
  4006ec:   c9                      leave
  4006ed:   c3                      ret

00000000004006ee <print_flags>:
  4006ee:   55                      push   rbp
  4006ef:   48 89 e5                mov    rbp,rsp
  4006f2:   48 8d 3d 0b 01 00 00    lea    rdi,[rip+0x10b]        # 400804 <_IO_stdin_used+0x4>
  4006f9:   e8 52 fe ff ff          call   400550 <getenv@plt>
  4006fe:   48 89 c7                mov    rdi,rax
  400701:   e8 5a fe ff ff          call   400560 <puts@plt>
  400706:   bf 00 00 00 00          mov    edi,0x0
  40070b:   e8 90 fe ff ff          call   4005a0 <exit@plt>

0000000000400710 <main>:
  400710:   55                      push   rbp
  400711:   48 89 e5                mov    rbp,rsp
  400714:   48 83 ec 20             sub    rsp,0x20
  400718:   48 8d 45 e0             lea    rax,[rbp-0x20]
  40071c:   ba 20 00 00 00          mov    edx,0x20
  400721:   be 00 00 00 00          mov    esi,0x0
  400726:   48 89 c7                mov    rdi,rax
  400729:   e8 52 fe ff ff          call   400580 <memset@plt>
  40072e:   48 8d 45 e0             lea    rax,[rbp-0x20]
  400732:   48 89 c7                mov    rdi,rax
  400735:   e8 6c ff ff ff          call   4006a6 <read_all_stdin>
  40073a:   48 8d 45 e0             lea    rax,[rbp-0x20]
  40073e:   0f b6 00                movzx  eax,BYTE PTR [rax]
  400741:   84 c0                   test   al,al
  400743:   75 0e                   jne    400753 <main+0x43>
  400745:   48 8d 3d be 00 00 00    lea    rdi,[rip+0xbe]        # 40080a <_IO_stdin_used+0xa>
  40074c:   e8 0f fe ff ff          call   400560 <puts@plt>
  400751:   eb 18                   jmp    40076b <main+0x5b>
  400753:   48 8d 45 e0             lea    rax,[rbp-0x20]
  400757:   48 89 c6                mov    rsi,rax
  40075a:   48 8d 3d bc 00 00 00    lea    rdi,[rip+0xbc]        # 40081d <_IO_stdin_used+0x1d>
  400761:   b8 00 00 00 00          mov    eax,0x0
  400766:   e8 05 fe ff ff          call   400570 <printf@plt>
  40076b:   b8 00 00 00 00          mov    eax,0x0
  400770:   c9                      leave
  400771:   c3                      ret
  400772:   66 2e 0f 1f 84 00 00    nop    WORD PTR cs:[rax+rax*1+0x0]
  400779:   00 00 00
  40077c:   0f 1f 40 00             nop    DWORD PTR [rax+0x0]
</code>```

Here are some screenshots of the payload that i used to and the Segmentation fault error:

UPDATE: Fixing the memory out of bounds, now i get another SIGSEGV:

Stopped reason: SIGSEGV
__strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120
120 ../sysdeps/x86_64/multiarch/../strlen.S: No such file or directory.

I've read some articles and it might be a NULL terminated string problem or like EOF problem from fgets?

I'm freaking out for this.

Title: R13 off by 2 bytes. Any help?


问:
Need help : restoring a netgear dgn1000 v3 adsl modem/router
coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909

currently have serial console but i may have borked the u-boot looking for help on how to jtag or spi flash the chip to restore original firmware on the modem

Currently on the serial console i get this output

```<code>ROM VER: 1.2.0

CFG 04

EEPROM Data OK

UART
</code>```

running binwalk gives:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
192           0xC0            Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3548940 bytes, 1283 inodes, blocksize: 131072 bytes, created: 2015-04-07 07:20:16
3551424       0x3630C0        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5398000 bytes
</code>```

extracting gives:

here's the serial output logs before i bricked the device at the end you can see the upload got interrupted and bricked the device
 https://pastebin.com/SQUsq1Zv

need help/ideas/pointers on how to reflash the original firmware.
thanks.


问:
How can I spoof WMI data?
I want to add a fake KB to the OS, and see it using wmic qfe list. So do you know how can I create a faked KB? Or if it is possible to cause WMI to report a specific KB?</p>

Title: How can I spoof WMI data?


问:
Unable to attach java sources to APK being debugged in Android Studio -- Option not displayed
This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it mostly working). Other tutorials online likewise give the same instruction, which is to open the smali file in Android studio, and when presented with the banner saying to attach Java sources, click the link in the banner to attach them. The problem is when I do this myself, there is no link in the banner. I've tried context menus, scouring the toolbar, searching online, but no one mentions what to do in this situation. I can't find another method of attaching them except from this one place, so there's no fallback.


问:
unsquashfs failed to read SquashFS file
I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor.
binwalk show:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, non-standard signature, version 3.1, size: 8372772 bytes, 1028 inodes, blocksize: 131072 bytes, created: 2017-08-02 06:39:51
</code>```

First I tried to unsquash it use unsquashfs utility, compiled from the source, provided by vendor in their GPL release, but not works.
(more precisely, the GPL source is for the previous version of F/W release, whereas I have a more recent F/W version)

```<code>./unsquashfs mtd4.bin
Parallel unsquashfs: Using 4 processors
Lseek failed because Invalid argument
sqlzma_un: ZLIB data error
Aborted
</code>```

Tried also use sasquatch utility:

```<code>sasquatch mtd4.bin
SquashFS version [3.1] / inode count [1028] suggests a SquashFS image of the same endianess
Non-standard SquashFS Magic: shsq
Parallel unsquashfs: Using 1 processor
Lseek failed because Invalid argument
read_block: failed to read block @0x92e6f69dab953c47
read_fragment_table: failed to read fragment table block
FATAL ERROR:failed to read fragment table
</code>```

Can anybody advice how to unpack file?

Title: unsquashfs failed to read SquashFS file


问:
Using an arduino or raspberry pi, how can I drive and control a proprietary diehen servomotor?

I’m trying to resurrect this robot from Daihen-I need to determine how this proprietary motor and encoder are wired. Anyone got experience with this?


问:
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a possibly multilevel pointer that leads to any address in that memory region, and that starts from an address in a memory region I choose, is that possible to do with gdb? I've checked out the popular gdb extensions (peda, pwndbg), but didn't find such a feature, if there is no existing implementation, any tips on how to optimize the search? Kind of like the Pointer Scanner of Cheat Engine, pointers can also have offsets (for example : main_module+3170 -> 0x7fff42dc7220 ; 0x7fff42dc7220+10 -> 0x7ff464213460 ; 0x7ff464213460 -> address wanted).

This would be useful for example in a context where we have a write-what-where condition (we can write or read anywhere in memory), and we need to defeat ASLR to find interesting memory regions (for example, JIT buffers in browsers).


问:
Is it possible to proxify custom windows application without installing any additional software (programatically)
Is it possible somehow to set reverse proxy for a windows application (e.g. by creating a wrapper launcher for this application) that will proxify all HTTP/S requests of this application? </p>


问:
How to export to *.so file after patching in ghidra
I'm using ghidra to patch an *.so file in the Android APK.
While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "Format".

c/c++ will result in *.c file,

binary will result in *.bin file.

How can I export to *.so file?

This might be a very silly question but it would be great if someone could give me any hints.


问:
How is sprintf() identified by IDApro?
```<code>#include<stdio.h>
int main()
{
    char buffer[50];
    int a = 10, b = 20, c;
    c = a + b;
    sprintf(buffer, "Sum of %d and %d is %d", a, b, c);

    // The string "sum of 10 and 20 is 30" is stored
    // into buffer instead of printing on stdout
    printf("%s", buffer);

    return 0;
}
</code>```

How is this code disassembled by IDApro?

Title: How is sprintf() identified by IDApro?


问:
Decompress from file with crush32
I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll.

information can be found here
Reverse engineering file format - ImageLink

I found c# code to decompress it, but it is not working. What did I do wrong? I tried to read s001.bli, it`s ok, than from result gets "true" and that's all. decompressedPixelData is empty, with size 0.

I run the code through Visual Studio 2012 on emulated Windows 7 X86 in VirtualBox. The crush32.dll library seems to work only with x86, although on win10 x64 the result is exactly the same.

Files and dll: https://drive.google.com/file/d/1GipwXL9ikog1YVu46uqxLfuuY1Rk-5Pc/view

Code:

```<code>using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.IO;

namespace Crush32Wrap
{
    public unsafe static class Crush32
    {
        #region Private PINVOKE signatures
        /// <summary>
        /// Name of legacy crush32.dll file (put it in same folder!)
        /// </summary>
        public const string DLLName = "crush32.dll";
        public const string FName = "s001.bli";

        /// <summary>
        /// The cxERROR for SUCCESS
        /// </summary>
        private const short CX_SUCCESS = 0;

        /// <summary>
        /// Initializes the library
        /// </summary>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxInit();

        /// <summary>
        /// Cleanup
        /// </summary>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxCleanup();

        /// <summary>
        /// Initializes a buffer to buffer operation.
        /// </summary>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxBuf2BufInit();

        /// <summary>
        /// Closes a buffer to buffer operation
        /// </summary>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxBuf2BufClose();

        /// <summary>
        /// Decrypts data in a buffer.
        /// </summary>
        /// <param name="Buffer">A pointer to the data to be decrypted.</param>
        /// <param name="Length">How many bytes should be decrypted.</param>
        /// <param name="Challenge">The Challenge used to test your password first.</param>
        /// <param name="ExpectedResponse">The ExpectedResponse matching your Challenge and your password.</param>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxBufDecrypt(byte* Buffer, int Length, uint Challenge, uint ExpectedResponse);

        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxBufDecrypt(IntPtr Buffer, int Length, uint Challenge, uint ExpectedResponse);

        /// <summary>
        /// Encrypts data in a buffer.
        /// </summary>
        /// <param name="Buffer">A pointer to the data to be encrypted.</param>
        /// <param name="Length">How many bytes should be encrypted.</param>
        /// <param name="Challenge">The Challenge used to create the returnvalue.</param>
        /// <returns>The "ExpectedResponse" matching your given Challenge and your Password, use this in decryption later.</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern uint cxBufEncrypt(IntPtr Buffer, int Length, uint Challenge);

        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern uint cxBufEncrypt(byte* Buffer, int Length, uint Challenge);

        /// <summary>
        /// Sets a password for the encryption and decryption methods.
        /// </summary>
        /// <param name="PtrPasswordString">A pointer to the nullterminated passwordstring in memory.</param>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxSetPassword(IntPtr PtrPasswordString);

        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxSetPassword(byte* Password);

        /// <summary>
        /// Compresses the data from the InputBuffer to the OutputBuffer.
        /// </summary>
        /// <param name="InputBuffer">A pointer to read inputdata from.</param>
        /// <param name="OutputBuffer">A pointer to write outputdata to.</param>
        /// <param name="InputLength">How many bytes should be read from input buffer.</param>
        /// <returns>The length of the compressed data.</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern int cxBuf2BufCompress(IntPtr InputBuffer, IntPtr OutputBuffer, int InputLength);

        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern int cxBuf2BufCompress(byte* InputBuffer, byte* OutputBuffer, int InputLength);

        /// <summary>
        /// Decompresses the data from the InputBuffer to the OutputBuffer.
        /// </summary>
        /// <param name="InputBuffer">A pointer to read inputdata from.</param>
        /// <param name="OutputBuffer">A pointer to write outputdata to.</param>
        /// <param name="DecompressedLength">The length of the data in decompressed state.</param>
        /// <param name="CompressedLength">The length of the data in compressed state.</param>
        /// <returns>cxERROR statevalue</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxBuf2BufExpand(IntPtr InputBuffer, IntPtr OutputBuffer, int DecompressedLength, int CompressedLength);

        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        private static extern short cxBuf2BufExpand(byte* InputBuffer, byte* OutputBuffer, int DecompressedLength, int CompressedLength);

        /// <summary>
        /// Creates a CRC32 for the data in the Buffer.
        /// Note: The used algorithm is equal to
        /// http://damieng.com/blog/2006/08/08/calculating_crc32_in_c_and_net
        /// </summary>
        /// <param name="Buffer">A pointer to read the data to CRC.</param>
        /// <param name="Length">How many bytes should be read from pointer.</param>
        /// <returns>The created CRC32</returns>
        [DllImport(DLLName, CharSet = CharSet.Unicode, SetLastError = true, CallingConvention = CallingConvention.StdCall)]
        public static extern uint cxBufCRC32(IntPtr Buffer, int Length);

        #endregion
        #region Public Wrappers

        /// <summary>
        /// Fast decompresses data from managed sourcebuffer to managed targetbuffer using pointers
        /// </summary>
        /// <param name="SourceBuffer">SourceBuffer containing compressed data</param>
        /// <param name="SourceIndex">Cursor in SourceBuffer to start reading</param>
        /// <param name="TargetBuffer">TargetBuffer for decompressed data</param>
        /// <param name="TargetIndex">Cursor in TargetBuffer to start writing</param>
        /// <param name="UncompressedLength">Uncompressed data length</param>
        /// <param name="CompressedLength">Compressed data length</param>
        /// <returns>True if the operation was successful.</returns>
        public static bool Decompress(byte[] SourceBuffer, int SourceIndex, byte[] TargetBuffer, int TargetIndex, int UncompressedLength, int CompressedLength)
        {
            bool isSuccessful = false;

            // init crush32
            if (Crush32.CX_SUCCESS == Crush32.cxInit())
            {
                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())
                {
                    // pin the managed source & targetbuffers in memory so crush32 can access them
                    // and we can directly use them without marshaling.
                    fixed (byte* ptrSourceBuffer = SourceBuffer, ptrTargetBuffer = TargetBuffer)
                    {
                        // add the offsets to the pointers (they still point to the beginning of the buffer)
                        byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;
                        byte* ptrTargetIndex = ptrTargetBuffer + TargetIndex;

                        if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufExpand(ptrSourceIndex, ptrTargetIndex, UncompressedLength, CompressedLength))
                            isSuccessful = true;

                    }

                    Crush32.cxBuf2BufClose();
                }

                Crush32.cxCleanup();
            }

            return isSuccessful;
        }

        /// <summary>
        /// Fast compresses data from managed sourcebuffer to managed targetbuffer using pointers
        /// </summary>
        /// <param name="SourceBuffer">SourceBuffer containing data to be compressed</param>
        /// <param name="SourceIndex">Cursor in SourceBuffer to start reading</param>
        /// <param name="TargetBuffer">TargetBuffer for compressed data</param>
        /// <param name="TargetIndex">Cursor in TargetBuffer to start writing</param>
        /// <param name="UncompressedLength">Uncompressed data length in SourceBuffer</param>
        /// <returns>Compressed length</returns>
        public static int Compress(byte[] SourceBuffer, int SourceIndex, byte[] TargetBuffer, int TargetIndex, int UncompressedLength)
        {
            int compressedLength = 0;

            // init crush32
            if (Crush32.CX_SUCCESS == Crush32.cxInit())
            {
                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())
                {
                    // pin the managed source & targetbuffers in memory so crush32 can access them
                    // and we can directly use them without marshaling.
                    fixed (byte* ptrSourceBuffer = SourceBuffer, ptrTargetBuffer = TargetBuffer)
                    {
                        // add the offsets to the pointers (they still point to the beginning of the buffer)
                        byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;
                        byte* ptrTargetIndex = ptrTargetBuffer + TargetIndex;

                        // compress
                        compressedLength = Crush32.cxBuf2BufCompress(ptrSourceIndex, ptrTargetIndex, UncompressedLength);
                    }

                    Crush32.cxBuf2BufClose();
                }

                Crush32.cxCleanup();
            }

            return compressedLength;
        }

        /// <summary>
        /// Fast decrypt data in managed buffer using pointer
        /// </summary>
        /// <param name="SourceBuffer">SourceBuffer containing encrypted data</param>
        /// <param name="SourceIndex">Cursor in SourceBuffer to start reading</param>
        /// <param name="Length">Encrypted data length</param>
        /// <param name="Challenge">Challenge to use</param>
        /// <param name="ExpectedResponse">ExpectedRespone to use</param>
        /// <param name="Password">Password to use</param>
        /// <returns>True if the operation was successful.</returns>
        public static bool Decrypt(byte[] SourceBuffer, int SourceIndex, int Length, uint Challenge, uint ExpectedResponse, byte[] Password)
        {
            bool isSuccessful = false;

            // pin the managed sourcebuffer in memory so crush32 can access
            // and we can directly use without marshaling.
            fixed (byte* ptrSourceBuffer = SourceBuffer)
            {
                // add the offsets to the pointers (they still point to the beginning of the buffer)
                byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;
                isSuccessful = Decrypt(ptrSourceIndex, Length, Challenge, ExpectedResponse, Password);
            }

            return isSuccessful;
        }

        /// <summary>
        ///
        /// </summary>
        /// <param name="SourceBuffer"></param>
        /// <param name="Length"></param>
        /// <param name="Challenge"></param>
        /// <param name="ExpectedREsponse"></param>
        /// <param name="Password"></param>
        /// <returns></returns>
        public static unsafe bool Decrypt(byte* SourceBuffer, int Length, uint Challenge, uint ExpectedResponse, byte[] Password)
        {
            bool isSuccessful = false;

            // init crush32
            if (Crush32.CX_SUCCESS == Crush32.cxInit())
            {
                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())
                {
                    // pin the managed sourcebuffer in memory so crush32 can access
                    // and we can directly use without marshaling.
                    fixed (byte* ptrPassword = Password)
                    {
                        // set password && decrypt
                        if (Crush32.CX_SUCCESS == Crush32.cxSetPassword(ptrPassword))
                            if (Crush32.CX_SUCCESS == Crush32.cxBufDecrypt(SourceBuffer, Length, Challenge, ExpectedResponse))
                                isSuccessful = true;
                    }

                    Crush32.cxBuf2BufClose();
                }

                Crush32.cxCleanup();
            }

            return isSuccessful;
        }

        /// <summary>
        /// Fast encrypt data in managed buffer using pointer
        /// </summary>
        /// <param name="SourceBuffer">SourceBuffer containing data to be encrypted</param>
        /// <param name="SourceIndex">Cursor in SourceBuffer to start reading</param>
        /// <param name="Length">Length of data to be encrypted</param>
        /// <param name="Challenge">Challenge to use</param>
        /// <param name="Password">Password to use</param>
        /// <returns>ExpectedResponse for Challenge/Password combination.</returns>
        public static uint Encrypt(byte[] SourceBuffer, int SourceIndex, int Length, uint Challenge, byte[] Password)
        {
            uint expectedResponse = 0;

            // pin the managed sourcebuffer in memory so crush32 can access
            // and we can directly use without marshaling.
            fixed (byte* ptrSourceBuffer = SourceBuffer, ptrPassword = Password)
            {
                // add the offsets to the pointers (they still point to the beginning of the buffer)
                byte* ptrSourceIndex = ptrSourceBuffer + SourceIndex;
                expectedResponse = Encrypt(ptrSourceIndex, Length, Challenge, Password);
            }

            return expectedResponse;
        }

        /// <summary>
        /// Fast encrypt data on unmanaged pointer
        /// </summary>
        /// <param name="SourceBuffer"></param>
        /// <param name="Length"></param>
        /// <param name="Challenge"></param>
        /// <param name="Password"></param>
        /// <returns></returns>
        public static unsafe uint Encrypt(byte* SourceBuffer, int Length, uint Challenge, byte[] Password)
        {
            uint expectedResponse = 0;

            // init crush32
            if (Crush32.CX_SUCCESS == Crush32.cxInit())
            {
                if (Crush32.CX_SUCCESS == Crush32.cxBuf2BufInit())
                {
                    // pin the managed sourcebuffer in memory so crush32 can access
                    // and we can directly use without marshaling.
                    fixed (byte* ptrPassword = Password)
                    {
                        // set password && encrypt
                        if (Crush32.CX_SUCCESS == Crush32.cxSetPassword(ptrPassword))
                            expectedResponse = Crush32.cxBufEncrypt(SourceBuffer, Length, Challenge);
                    }

                    Crush32.cxBuf2BufClose();
                }

                Crush32.cxCleanup();
            }

            return expectedResponse;
        }
        #endregion
        #region Public main
        [STAThread]
        static void Main(string[] args)
        {
            byte[] Data = File.ReadAllBytes("s001.bli");
                int CompressedLength = Data.Length;
                int UncompressedLength = 0;
                byte[] decompressedPixelData = new byte[UncompressedLength];
                bool result = Crush32.Decompress(Data, 15, decompressedPixelData, 0, (int)UncompressedLength, CompressedLength);
                string s = "{" +
                        string.Join(", ",
                            decompressedPixelData.Select(x => string.Format("0x{0}", x.ToString("X")))
                        ) + "}";
                Console.WriteLine(s);
                Console.ReadKey(true);

        }
        #endregion
    }
}
</code>```

Title: Decompress from file with crush32


问:
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.

Some of the decompiled generated plain C code, show as ASM code :/

i.e:

```<code>  sqrt(v4);
  __asm
  {
    fstp    [esp+24h+var_C]
    fld     [esp+24h+var_C]
    fstp    [esp+24h+var_14]
    fldz
  }
</code>```

What could be the cause for this? possibly wrong stack pointers? I must admit that sometimes I also get the famous sp issue that I always fix by ALT + K and adjust the negative stack pointer, but the generated ASM code issue has happened to some functions before I even did that.

Note that when I load the same executable into another IDA instance and go to that same function memory, the decompiled code looks fine, so I'm guessing some how the database instance I'm working on due to one of my changes(probably structures layout) made that function failed?

Is there a way also fixing that so the generated code will look as plain C again?
I already tried to undefine the corrupted function and re-analyze it, but the output code will still be as ASM.

Thanks in advance!


问:
IDA Pro Reset All Stack Pointers to Default
Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?

I'm asking because I used to change the stack pointers for some functions I couldn't read due to having negative sp value and I didn't know that it's going to affect all it's caller functions. So I would like to reset all stack pointers in all the database(Using IDA Pro 7.0).


问:
How to return a list of vtable methods?
I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for further programmatic analysis. My intention is to pass them to another framework in order to do symbolic execution.

Based on my naive understanding of the available options I am going to assume the easiest way to do this is IDA python.

In IDA Python how can I gather the addresses and bodies of all methods contained in vtables?

Extra Credit: The same for Binary Ninja or any other disassembler platform.

Title: How to return a list of vtable methods?


问:
How does cartridge protection distinguish an original vs fake cartridge?
Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected.

What is embedded in the chip?

How can we make sure that it is original and not duplicated with a 3rd party?

Is this a safe and well-known offline security protocol? (it will be great if some one can point me to a reference about it)

OwnerDisplayName: Shabnam


问:
I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?
I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system.

Can I edit the code off the .exe file? I need to change a value in the code.

Thank you!


问:
Mysterious chunk of code in IOLI crackme0x06 challenge
I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge.

Context

But first of all, here is the context : I've successfully cracked the challenge, which by the way simply needs :

An even number

This number being in the range of 32-bit representation of signed integers, ie between  (INT32_MIN) and  (INT32_MAX) (due to the call to sscanf which apparently performs integer saturation on the input if it's greater than INT32_MAX)

An environment variable - whose name shall begin by 'LOL' - being exported in the crackme process environment.

The issue

Now, for completeness purposes, I'm trying to grasp the purpose of every single instruction of this crackme, but so far, I'm struggling to understand how the following code (from ##loop beginning to ##loop end) from the sym.parell function is actually useful in anyway to the program :

```<code>
    0804851a <parell>:
     804851a:       push   ebp
     804851b:       mov    ebp,esp
     804851d:       sub    esp,0x18
     8048520:       lea    eax,[ebp-0x4]
     8048523:       mov    DWORD PTR [esp+0x8],eax
     8048527:       mov    DWORD PTR [esp+0x4],0x804873d
     804852f:       mov    eax,DWORD PTR [ebp+0x8]
     8048532:       mov    DWORD PTR [esp],eax
     8048535:       call   80483c8 <sscanf@plt>
     804853a:       mov    eax,DWORD PTR [ebp+0xc]
     804853d:       mov    DWORD PTR [esp+0x4],eax
     8048541:       mov    eax,DWORD PTR [ebp-0x4]
     8048544:       mov    DWORD PTR [esp],eax
     8048547:       call   80484b4 <dummy>
     804854c:       test   eax,eax
     804854e:       je     8048586 <parell+0x6c>
     8048550:       mov    DWORD PTR [ebp-0x8],0x0   # Initialization of i (see pseudo-code below)
     8048557:       cmp    DWORD PTR [ebp-0x8],0x9   ## loop beginning
     804855b:       jg     8048586
     804855d:       mov    eax,DWORD PTR [ebp-0x4]   # Handling password's parity check
     8048560:       and    eax,0x1
     8048563:       test   eax,eax
     8048565:       jne    804857f <parell+0x65>
     8048567:       mov    DWORD PTR [esp],0x8048740
     804856e:       call   80483b8 <printf@plt>
     8048573:       mov    DWORD PTR [esp],0x0
     804857a:       call   80483e8 <exit@plt>
     804857f:       lea    eax,[ebp-0x8]
     8048582:       inc    DWORD PTR [eax]
     8048584:       jmp    8048557 <parell+0x3d>     ## loop end
     8048586:       leave
     8048587:       ret
</code>```

It seems to be equivalent to the following pseudo-code :

```<code>    for (int i = 0; i <= 9; ++i)
            if LSB (password) is 0    // ie if password is an even number
                printf("Password OK!\n");
                exit(0);
</code>```

But the thing is, looping from 0 to 9 won't do anything relevant for the parity check of the number ...

And as far as the password testing is concerned, the computation taking place in the sym.parell function is never impacted by such a loop !

I've been scratching my head over that for hours, but I really couldn't figure out its exact purpose.

Had this challenge not been for beginners (by the way it's the first hands-on lab of the RPISEC academic course), I would have thought that this is just some silly obfuscation/junk code technique meant to deflect the attention of the attacker, which is obviously not the case.

This series of challenges is only aiming at helping newbies build strong basics in the field.

Am I wrong ?

So, seriously, what is the aforementioned code's purpose in this program ?


问:
Find File System in Firmware
This is my first attempt at working with firmware. We have some SNMP cards that are flaky & my ultimate goal is to try to make them better.

The current firmware version is 12.06.0069. When downloaded, the firmware folder contains several files:

pwralert.dat

rom.12.069.0001.3078.sbz2

rom.55.0.bin

rom.69.0.bin

rom.69.0.bin.sbz2

I've been trying to use binwalk to locate the filesystem. So far, the only thing I've found is a few lines that say "gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), NULL date (1970-01-01 00:00:00). Here is how I got there:

```<code>binwalk -e rom.12.069.0001.3078.sbz2

cd _rom.12.069.0001.3078.sbz2.extracted

ls

418

binwalk 418
</code>```

Title: Find File System in Firmware


问:
How to Dump a locked PIC
I have tried these few days to read a PIC18F microcontroller which is locked.it says all protected (0000 E0FF 40FF).then i found out that it is possible to bypass the CRP on some of these microcontrollers by writing a small program into the bootloader (i think this is called heart of darkness) but didn't find that program to try to dump my PIC18F6722.
If someone knows a particular method to dumping firmware on this microchip please let me know
Thank you</p>

Title: How to Dump a locked PIC


问:
radare2 wrong output
I saw rasm2 giving different output each time for x64
Take a look at this:

```<code>C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF"
test r15b, 0xff

C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test r15b, 0xff"
f7ffff000000

C:\WINDOWS\system32>rasm2 -v
rasm2 3.5.1 1 @ windows-x86-64 git.3.5.1
commit: 4ec482ba2d4f554beeafb3aa47758e970bcab937 build: Wed 05/15/2019__ 7:58:44.85
</code>```

Is this some unresolved bug or did I do something wrong?

Title: radare2 wrong output


问:
How does IDA provide function names to dynamic calls?
I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to 004019c0.

Looking in IDA I notice this call is identified as ___dyn_tls_init_callback. I want to better understand how IDA gets this name and applies to this address.

If I follow the function in IDA via xrefs I see a reference to the code with a label provided by IDA but I'm unsure where this name comes from. How can I figure out how IDA got this name? I'd like to understand further so I can do the work myself in Immunity.


问:
How to generate exe from compiled Python files?
I have extracted compiled files from exe (executable in windows) using
PyInstaller Extractor script.

In Resultant folder, i have got was pyc files bundled in pyz folder.
Then I decompiled files (using uncompyle6) from pyc to py.
Then updated code in py files and recompiled back to pyc files.

My question is how can i convert these pyz bundled folder back to 'exe' so that it can be executed in windows?

I tried pyinstaller, but could not find any .spec file or entry py file to begin this process.
what are the steps to achieve this required result.


问:
Disassembling ARM binary
I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys.

My current state is that I was able to obtain the *.bin file of the firmware and analyze it using binwalk. The standard analysis did not find anything, but trying the --opcodes option revealed some further information.

According to the opcodes it seems to contain a mix of different instruction sets using ARM, Ubicom32 and ARMEB instructions. Therefore, there is probably no file system to recover, but if I understand it right I may be able to disassemble the binary using something like objdump?

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
-----------------------------------------------------------------------
1406157       0x1574CD        ARM instructions, function prologue
12575041      0xBFE141        ARM instructions, function prologue
14942348      0xE4008C        ARM instructions, function prologue
16502970      0xFBD0BA        Ubicom32 instructions, function epilogue
28109096      0x1ACE928       ARM instructions, function prologue
29833956      0x1C73AE4       ARMEB instructions, function prologue
39390093      0x2590B8D       ARMEB instructions, function prologue
</code>```

Title: Disassembling ARM binary


问:
Reverse engineer Apple T2/SSD driver for linux
I wasn't exactly sure if this is the right place, as opposed to thinkdifferent or stackoverflow but I figure this might be a good place to start. I have a Macbook Pro 2018 15-inch laptop and want to to run linux. Unfortunately, Apple has moved some driver functions of the SSD or SSD controller to the T2 chip so currently no version of linux is able to "see" the SSD, and thus Linux can't be installed on these machines, although you can theoretically run it off an external drive.

Since MacOS is a darwin-BSD fork, I wanted to know if anyone had opinions on whether to start with the MacOS driver or the driver for Windows 10, since Apple allows/enables Windows 10 via bootcamp. I've turned off all the security options and disabled csrutil.

This github thread seems willing, and slowly making progress:
https://github.com/Dunedan/mbp-2016-linux/issues/71

It is possible to install Linux on this model's predecessor, which is nearly identical, with the major difference being the T2 chip:
https://foolcontrol.org/?p=2952

I'm willing to risk bricking my machine to get a working driver out there, but I've never written any kind of hardware driver, much less try to reverse-engineer one! Any guidance on where to start or which tools to use to capture IO?


问:
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.

This is the func that will compare how many cards i've chosen with 3

it'll jump to this address if > 3

so i replace the jump with NOP

now i can select cards more than 3, but when i trying to pass the cards, there's msg showing, i can't pass the cards

so what am i missing ? I guess when we click the arrow button it'll compare the value again with 3, am i right?

Title: Hearts Game Passing Cards


问:
Is there any way to change the encoding of an exe file?
I have an exe file and it will browse the xml, or txt files to display this exe file.

And the characters only display the exact language of that country when I switch the language of the computer to a certain fixed locale (eg locale chinese simplified "gb2132").

Is there any way for me to interfere with these character encodings through reverse engineering, so this exe file can browse unicode characters instead of having to switch the computer's locale?

This is the file.
https://drive.google.com/open?id=1nU9Wz0DIsGjPz2ebzEmfkqaIYxBE5b7_


问:
Unknown three part signature
I have received a string which is supposed to be a cryptographic signature. I have access to a certificate which should let me verify the signature. However, I am rather confused about the structure of the signature.

I was expecting a byte string, likely base64-encoded. Instead, I received three lines, each 255 characters long, comprised of hex characters, and padded with trailing or leading zeroes.

Unfortunately, I have very little and somewhat uncertain information:

Payload: "Hello Crypto World"

Hashing Algorithm: SHA256

Crypto Algorithm: RSA (not certain)

PKCS7 is likely involved

The following is roughly the structure of the signature. Note that the string contains mostly random hex characters. I preserved only the length of the (non) padded sections. And I discovered that the first line contains the payload, so I preserved that part also. Since I am uncertain about this string, I don't want to risk potentially publishing a private key, that's why the rest is just random hex characters.

```<code>1342120FF49C008D19FCA5208C216A8C69E11DE084442AA66B786A0F010766BE82238BEE9BAB9B9DA085E89A41BE8B660A109582F2782987780C6CEB5F85AE1D0A48656C6C6F2043727970746F20576F726C6400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005518C31F61B521823A97E4995D0F4E85B432A73FC0FD098B489D2C9AC533E19BA253AF93D275D906A043975FA03B86A15D993B944DCBF135156A378163E38
042669BAF26B40FA9EDD9460D089DB1725778EB9304CA3034291C21CFB5B750000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
</code>```

In python this is how I discovered the payload in the first line.

```<code>>>> bytes.fromhex(line_one + "0")
>>> b'...Hello Crypto World\x00\x00...'
</code>```

Note that it was necessary to append the line with another character ("0") as the line is only 255 characters long which wouldn't translate to full bytes.

I have played around with a python crypto library (pycryptodome) trying to make sense of this, to no avail. I have googled, particularly regarding PKCS7, but couldn't quite make sense of this either.

Using the same crypto library I was able to unpad each line, which simply stripped away some of the trailing zeroes leaving me with only 207 instead of 255 characters.

My Questions

What kind of format is this?

How can I turn this into or extract only the signature part (byte string, base64 string)?

Any help to steer me in the right direction is greatly appreciated.

OwnerDisplayName: pmlk

Title: Unknown three part signature


问:
x64 hook Fails on Messagebox
Quite new to the intels so i might not know much , I just need some form of direction here.
I am trying to do a simple 64 bit hook detour for function hooking

I do it like so :

The detour hook Engine :

```<code>BOOL JHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)
{
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde64s disam;
    BYTE Jump[13] = { 0x49, 0xBB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0xFF, 0xE3 };

    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);
    if (!FunctionAddress)
        return FALSE;

    //disassemble length of each instruction, until we have 5 or more bytes worth
    while (TrampolineLength < 5)
    {
        LPVOID InstPointer = (LPVOID)((DWORD)FunctionAddress + TrampolineLength);
        TrampolineLength += hde64_disasm(InstPointer, &disam);
    }

    //Build the trampoline buffer
    memcpy(original, FunctionAddress, TrampolineLength);
    *(DWORD*)(Jump + 1) = ((DWORD)FunctionAddress + TrampolineLength) - ((DWORD)original + TrampolineLength + 5);
    memcpy((LPVOID)((DWORD)original + TrampolineLength), Jump, 5);

    //Make sure the function is writable
    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &OriginalProtection))
        return FALSE;

    //Build and atomically write the hook
    *(DWORD*)(Jump + 1) = (DWORD)proxy - (DWORD)FunctionAddress - 5;
    //SafeMemcpyPadded(FunctionAddress, Jump, 5);

    //Restore the original page protection
    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &OriginalProtection);

    //Clear CPU instruction cache
    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);

    *length = TrampolineLength;
    return TRUE;
}
</code>```

The header file.

```<code>#pragma once

    #include <stdio.h>
    #include <stdlib.h>
    #include <Windows.h>
    #include "hde64.h"

    class SHook
    {
    private :
        LPVOID FunctionAddress;
        DWORD TrampolineLength = 0, OriginalProtection;
        hde64s disam;
        BYTE Jump[13] = { 0x49, 0xBB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0xFF, 0xE3 };
    public:
        BOOL SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length);
    };
</code>```

Now the implementation

```<code>#include <stdio.h>
#include <Windows.h>
#include <intrin.h>
#include <string>
#include "JHook.h"

typedef int (WINAPI* TdefOldMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType);
TdefOldMessageBoxA myOldMessageBoxA;

JHook Jhook;
int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType)
{
    MessageBoxA(NULL, "Hooked", "Hooked", MB_OK);
    return myOldMessageBoxA(hWnd, lpText, lpCaption, uType);
}

void EstablishHook()
{
        Jhook.SetHook("user32.dll","MessageBoxA", (LPVOID)&HookMessageBoxA, myOldMessageBoxA,0);
}

int main()
{
    EstablishHook();
}
</code>```

Now i was expecting to see something like a Messagebox saying its hooked, and i just see a cmd nothing else, where am i getting it wrong?

Edit

Opening inside a Debugger i have this

```<code>00007FF663D143F4 | 55                       | push rbp                                |
00007FF663D143F5 | 57                       | push rdi                                |
00007FF663D143F6 | 48:81EC E8000000         | sub rsp,E8                              |
00007FF663D143FD | 48:8D6C24 20             | lea rbp,qword ptr ss:[rsp+20]           |
00007FF663D14402 | 48:8BFC                  | mov rdi,rsp                             |
00007FF663D14405 | B9 3A000000              | mov ecx,3A                              | 3A:':'
00007FF663D1440A | B8 CCCCCCCC              | mov eax,CCCCCCCC                        |
00007FF663D1440F | F3:AB                    | rep stosd                               |
00007FF663D14411 | 48:8B8C24 08010000       | mov rcx,qword ptr ss:[rsp+108]          |
00007FF663D14419 | 48:8D0D 15FC0000         | lea rcx,qword ptr ds:[7FF663D24035]     | MessageBoxTest.cpp:15732480
00007FF663D14420 | E8 5DCCFFFF              | call shook.7FF663D11082                 |
00007FF663D14425 | 45:33C9                  | xor r9d,r9d                             | MessageBoxTest.cpp:13
00007FF663D14428 | 4C:8D05 95880000         | lea r8,qword ptr ds:[7FF663D1CCC4]      | 00007FF663D1CCC4:"Hooked"
00007FF663D1442F | 48:8D15 8E880000         | lea rdx,qword ptr ds:[7FF663D1CCC4]     | 00007FF663D1CCC4:"Hooked"
00007FF663D14436 | 33C9                     | xor ecx,ecx                             |
00007FF663D14438 | FF15 2AED0000            | call qword ptr ds:[<&MessageBoxA>]      |
00007FF663D1443E | 44:8B8D F8000000         | mov r9d,dword ptr ss:[rbp+F8]           | MessageBoxTest.cpp:14
00007FF663D14445 | 4C:8B85 F0000000         | mov r8,qword ptr ss:[rbp+F0]            |
00007FF663D1444C | 48:8B95 E8000000         | mov rdx,qword ptr ss:[rbp+E8]           |
00007FF663D14453 | 48:8B8D E0000000         | mov rcx,qword ptr ss:[rbp+E0]           |
00007FF663D1445A | FF15 90AF0000            | call qword ptr ds:[<int (__cdecl* __ptr |
00007FF663D14460 | 48:8DA5 C8000000         | lea rsp,qword ptr ss:[rbp+C8]           | MessageBoxTest.cpp:15
00007FF663D14467 | 5F                       | pop rdi                                 |
00007FF663D14468 | 5D                       | pop rbp                                 |
00007FF663D14469 | C3                       | ret                                     |
</code>```

Which shows the MessageBox Now i am a bit lost as to what to do next. Worked on detour Function, pls see above.

Edit

NOW i fixed the Sethook Engine now and it looks like this somehow

```<code>#include "SHook.h"

BOOL SHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)
{
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde64s disam;
    BYTE Jump[14] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);
    if (!FunctionAddress)
        return FALSE;

    //disassemble length of each instruction, until we have 5 or more bytes worth
    while (TrampolineLength < 5)
    {
        LPVOID InstPointer = (LPVOID)((DWORD64)FunctionAddress + TrampolineLength);
        TrampolineLength += hde64_disasm(InstPointer, &disam);
    }

    //Build the trampoline buffer
    memcpy(original, FunctionAddress, TrampolineLength);
    *(DWORD64*)(Jump + 1) = ((DWORD64)FunctionAddress + TrampolineLength) - ((DWORD64)original + TrampolineLength + 5); // <-- error falls here
    memcpy((LPVOID)((DWORD64)original + TrampolineLength), Jump, 5);

    //Make sure the function is writable
    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &OriginalProtection))
        return FALSE;

    //Build and atomically write the hook
    *(DWORD64*)(Jump + 1) = (DWORD64)proxy - (DWORD64)FunctionAddress - 5;
    //SafeMemcpyPadded(FunctionAddress, Jump, 5);

    //Restore the original page protection
    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &OriginalProtection);

    //Clear CPU instruction cache
    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);

    *length = TrampolineLength;
    return TRUE;
}
</code>```

Other things remain the same. do not have an idea why it fails still , especially on this line :

```<code>*(DWORD64*)(Jump + 1) = ((DWORD64)FunctionAddress + TrampolineLength) - ((DWORD64)original + TrampolineLength + 5);
</code>```

Title: x64 hook Fails on Messagebox


问:
Turning p-code generated by VBA (Visual Basic for Applications) back into VBA
According to the README in https://github.com/bontchev/pcodedmp :

"As each VBA line is entered into the VBA editor, it is immediately compiled into p-code"

"when you open the source of a macro module in the VBA editor, what is displayed is not the decompressed source code but the p-code decompiled into source"

This means that there is a line-to-line correspondence between the p-code and the VBA source code that generates it.

Is there a tool that can take the dumped p-code and get the VBA source code that generated it?

So for example, the input would be something like

```<code>Line #0:
    FuncDefn (Private Sub Document_Open())
Line #1:
    LitStr 0x001D "This could have been a virus!"
    Ld vbOKOnly
    Ld vbInformation
    Add
    LitStr 0x0006 "Virus!"
    ArgsCall MsgBox 0x0003
Line #2:
    LitStr 0x0008 "calc.exe"
    Paren
    ArgsCall Shell 0x0001
Line #3:
    EndSub
</code>```

and output

```<code>Private Sub Document_Open()
    MsgBox "This could have been a virus!", vbOKOnly + vbInformation, "Virus!"
    Shell("calc.exe")
End Sub
</code>```


问:
Why decrement a hex value in assembly code?
I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange.

```<code>EntryPoint:
00001000         db  0x00 ; '.'
00001001         db  0xff ; '.'
00001002         lsls       r7, r7, #0x3
</code>```

Why run decrement before on 0x00 and 0xff, what is the reasoning behind it?


问:
How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem
I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking function was about 88k basic blocks long, but is entirely linear. So each block would check for a single byte and, if incorrect, would branch to a smaller block that would call an exiting function. The operation in each block is simple:

```<code>if(RANDOM_CONST0 == mem[i] ^ RANDOM_CONST1){
    goto next_basic_block;
}else{
    exiting_function()    //no return
}
</code>```

The constants used are different for each basic block. So, it seemed like a great target for angr!

Attempts (using call_state):

1)

Uses SimulationManager.explore

Drops avoid and deadended states after each step (using step_func)

Runs of out memory after ~10 minutes (8GB)

2)

Uses SimulationManager.step

Manually prunes off 'bad' state after each step (e.g. one that leads to calling the exiting function)

Evaluates a single byte of the solution after each block

Sets the memory to concrete value 0 (for memory reduction)

Still churning after 20 hours (65k bytes of solution)

Dramatic slowing at this point -- about 1 byte/3 seconds

Uses SimulationManager.simplify to reduce memory overhead per step

Other misc things:

Absolutely no constraints on the symbolic memory (containing the solution)

The buffer is ~88k and constraints on that much memory alone consumes a lot of RAM

Questions:

Why is so much memory be taken up?

The only symbolic register is eax in each basic block (because it reads a symbolic byte from memory), but it does not compound complexity with each step (it gets set to another symbolic value in the next basic block)

Why has angr slowed so dramatically?

I uploaded the CTF binary here for those interested.


问:
How to add xrefs to indirect call targets in IDA?
I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information to the database? The only option I have now is to add the target address as a comment since it simplifies navigation, but the target function's references won't come up in xrefs this way. And another drawback is, I have to correct all the comments if I change the name of the target function. Is there any right way to do this?</p>

ContentLicense: CC BY-SA 3.0


问:
Ghidra - Export namespaces
I am currently learning to use ghidra, and I found the Symbol Tree.

Ghidra found some namespaces that I would like to export.
These namespaces don't even have to be readable, just reusable, such that I can use them in another application.

Is there any way in Ghidra to export those namespaces in a reusable form? And if not, what would be my best bet of achieving this?

Some additional information:

The namespace is written in Visual C++ or C++.

The application is running on windows, and so is Ghidra.

If any more information or clarification is needed, please tell me.

Title: Ghidra - Export namespaces


问:
Reverse engineering non-standard LIN protocol
I'm trying to reverse engineer an ECU / GSU protocol from a model airplane jet turbine, in order to make a telemetry adapter.
I have decoded several other protocols in the past with good success but this one is especially tough, so I thought I would ask for assistance.

I have an Arduino Nano as the GSU emulator, with a LIN transceiver and verifying communication on a Saleae logic analyser.

The ECU uses a LIN interface but on a proprietary protocol unknown to me. In order to read it I am using an Arduino with a level shifter, and I verified that the incoming data is correct.

When ECU is stand alone, it sends several strings which appear to be interrogations for bus nodes, but nobody is replying obviously.

```<code>0x0A 0x00 0x00 0x00 0x00 0x0A
0x14 0x00 0x00 0x00 0x00 0x14
0x1E 0x00 0x00 0x00 0x00 0x1E
0x28 0x00 0x00 0x00 0x00 0x28
</code>```

When the GSU is connected to the ECU, it responds immediately (0.2ms) after the first string (0x0A 0x00 0x00 0x00 0x00 0x0A), with a 6 byte reply. Each time it is a slightly different reply.

Such a reply is followed by the ECU sending a stream of data, which is the data I need to read.

I tried emulating some of these GSU replies with Arduino, but the ECU never sends the stream of data back on the bus if the arduino is interrogating it; it just ignores it and continues interrogating as if nothing happened. With the GSU interrogating, the ECU replies.

I have attached an Excel table that shows some of the replies and a bit of data processing I played with. It appears that the reply is a 6 byte stream, where the MSB (most significant BIT) of each byte is either 0 or 1. I'm not sure about the rules here and why it's changing.

Does this make sense to anyone?
Any reverse engineering experts can share some ideas?
So far haven't been able to get the ECU to answer to Arduino.

Thanks for your help.


问:
Determine what architecture a piece of shellcode targets
After some personal research I didn't find any possible way or a paper to explain how to determine what architecture a given piece of shellcode may targets. The only obvious way I found would be to disassemble it for various architectures and check for which one of those the assembly code makes any sense. But this way demands that an actual person has to study the assembly code every time. So is there any other way that we can use to be certain that a piece of shellcode targets a certain architecture? Thank you in advance!</p>


问:
Reproduce compilation (ASM) output for library detection - identifying compiler, version & options used
I want to reverse a stripped x86 sample that uses a static library.

So far I could identify the library itself and narrow the version of the library used.

Now I want to use Ghidra's Function ID plugin to identify all the library functions within the sample.

The function signatures depend on the instructions of the function - so for them to match, the instructions need to match.

The instructions of a function depend heavily on the compiler, its version & options that were used.

I have compiled the library myself using gcc and compared the assembly output - and they differ.

Do you have some suggestions on what to try / things to look out for / clues that might lead to the original compiler used?

I have tried compiling the source with some of the compilers listed on godbolt.org, but none of them seem similar to the original disassembly.

For example, here is one of the functions from the original sample and from one of my gcc-compiled version:

Function within the original sample:

Function within my gcc-compiled version of the library:

Relevant source code of the function:

```<code>#define MBEDTLS_SSL_TRANSPORT_DATAGRAM          1   /*!< DTLS     */
#define MBEDTLS_SSL_MINOR_VERSION_0             0   /*!< SSL v3.0 */
#define MBEDTLS_SSL_MINOR_VERSION_1             1   /*!< TLS v1.0 */
#define MBEDTLS_SSL_MINOR_VERSION_2             2   /*!< TLS v1.1 */
#define MBEDTLS_SSL_MINOR_VERSION_3             3   /*!< TLS v1.2 */
#define MBEDTLS_SSL_PROTO_DTLS

struct mbedtls_ssl_config
{
    unsigned int transport : 1;
};

struct mbedtls_ssl_context {
    int minor_ver;
    const mbedtls_ssl_config *conf;
};

const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
    if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
    {
        switch( ssl->minor_ver )
        {
            case MBEDTLS_SSL_MINOR_VERSION_2:
                return( "DTLSv1.0" );

            case MBEDTLS_SSL_MINOR_VERSION_3:
                return( "DTLSv1.2" );

            default:
                return( "unknown (DTLS)" );
        }
    }
#endif

    switch( ssl->minor_ver )
    {
        case MBEDTLS_SSL_MINOR_VERSION_0:
            return( "SSLv3.0" );

        case MBEDTLS_SSL_MINOR_VERSION_1:
            return( "TLSv1.0" );

        case MBEDTLS_SSL_MINOR_VERSION_2:
            return( "TLSv1.1" );

        case MBEDTLS_SSL_MINOR_VERSION_3:
            return( "TLSv1.2" );

        default:
            return( "unknown" );
    }
}
</code>```

Any hints and ideas are greatly appreciated, thank you!


问:
Extracting ARM Boot zImage
I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware image from the SPI flash. I connected to the flash with a Bus Pirate and pulled off the firmware image. When I run binwalk on it, I get the following.

```<code>$ binwalk spidump.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
271284        0x423B4         Sega MegaDrive/Genesis raw ROM dump, Name: "ETIR_ON", "ECCAS",
744708        0xB5D04         CRC32 polynomial table, big endian
786432        0xC0000         gzip compressed data, maximum compression, from Unix, last modified: 1970-01-04 16:05:57 (bogus date)
917760        0xE0100         Linux kernel ARM boot executable zImage (big-endian)
9306332       0x8E00DC        Zlib compressed data, compressed
9307424       0x8E0520        Zlib compressed data, compressed
9308196       0x8E0824        Zlib compressed data, compressed
9309036       0x8E0B6C        Zlib compressed data, compressed
9310040       0x8E0F58        Zlib compressed data, compressed
9310220       0x8E100C        Zlib compressed data, compressed
9311200       0x8E13E0        Zlib compressed data, compressed
9312104       0x8E1768        JFFS2 filesystem, little endian
9317132       0x8E2B0C        Zlib compressed data, compressed
9317428       0x8E2C34        JFFS2 filesystem, little endian
9318332       0x8E2FBC        Zlib compressed data, compressed
[...]
</code>```

If I run binwalk -Mre it gives me nearly 6000 files and several hundred folders of the extracted Zlib and JFFS2 data. After analyzing these, I thought I'd look at the boot image.

I carved out the zImage by running dd if=spidump.bin of=carved.bin bs=1 skip=917760 count=8388572. Running file returns carved.bin: Linux kernel ARM boot executable zImage (big-endian).

So far so good. This is where I get lost.

From reading other posts here and elsewhere, it seems like I should search for the magic bytes of where compression starts--since this is big-endian, I run objdump with a lot of results (only the first few lines listed).

```<code>$ arm-none-eabi-objdump -EB -D -m armv5te -b binary carved.bin | grep 1f8b
    9b38:   1f8b3c36    svcne   0x008b3c36
   1f8b0:   bf2e3abe    svclt   0x002e3abe
   1f8b4:   0811cabb    ldmdaeq r1, {r0, r1, r3, r4, r5, r7, r9, fp, lr, pc}
   1f8b8:   baaee7f4    blt 0xfebd9890
   1f8bc:   fc3711aa    ldc2    1, cr1, [r7], #-680 ; 0xfffffd58
   20c38:   f3b1f8b9            ; <UNDEFINED> instruction: 0xf3b1f8b9
   233c0:   d1f8badf    ldrsble fp, [r8, #175]! ; 0xaf
   2c7d8:   011f8b05    tsteq   pc, r5, lsl #22
   2d990:   e9ff1f8b    ldmib   pc!, {r0, r1, r3, r7, r8, r9, sl, fp, ip}^  ; <UNPREDICTABLE>
</code>```

I carve the file starting from the first occurrence of the magic bytes by running dd if=carved.bin of=arm.gz bs=1 skip=39736. file returns arm.gz: gzip compressed data, unknown method, has CRC, extra field, has comment, encrypted, last modified: Mon Sep 15 08:57:49 1975 and gunzip refuses to unzip, saying unknown method 60 -- not supported. Most later occurrences of 1f8b are not aligned at the beginning of a byte, so I assume they are not good candidates for carving and unzipping. It seems like the first occurrence, and subsequent occurrences, might just all be by chance.

Is this truly a zImage, or could binwalk and file be confused? How can I tell? How do I extract it?

Unfortunately, I can't provide the binary for your own perusal.

Update - 6/25/2019

I've included a graph of the entropy of the file, as requested by julian. It does look like the section in question is compressed.

Update - 7/5/2019

Upon further review with an expert, it seems like binwalk misidentified the type(s) of files. It looks like there is a custom unpacker I need to either disassemble or have it run and then take the unpacked image from memory.

Title: Extracting ARM Boot zImage


问:
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.

When I tried to do it in OllyDbg, it processed the parameters simply as a string.

Can I redirect stdin in OllyDbg?

Title: How to redirect stdin in OllyDbg?


问:
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also tried a hardware breakpoint, but that doesn't help.
I have installed TitanHide plugins etc. but also without result.

I use x32dbg (32 bit target program). And recently read this article.
But x64 debugger does not allow to open x32 application. What could be the problem?


问:
Reverse Engineering Android ROMS to detect malicious code
I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm coming short on any guides to do this or a lead of which to achieve this. My question is, given an android ROM such as the ones you can download online which tools / methodologies have you guys found most effective in dissecting them to detect malicious behavior (such as sending your private data to China for example).</p>


问:
Avrdude inconsistent readings
I have a problem with this dude and i don't know what to do to make him do a consistent reading or to figure out which reading is the perfect one
I'm trying to read my own arduino uno which has a sample sketch i read it fine and the reading completes perfectly.but the problem is when i read the file more than 3 times the 4 files i got are different.first one has data only until 870 and has some string characters (which exist in serial print) second file has data until Hex 1570. And the third one has data until 1570 plus at the end of the file (i think it is the bootloader section).
The fourth file is completely full but after 1570 it seams that the data is repeated.( I think this is the correct one since my example file has only 4 lines repeated to fill up the entire program memory)
The problem is why avrdude doesn't read the same reading each time.
I wanted to show some pictures but i think that this is clear enough to understand the issue</p>

Title: Avrdude inconsistent readings


问:
How to speed up panda?
When looking for a reversing tool I discovered PANDA. Unfortunately, its performance is too slow. When I run some large programs in a virtual machine, the whole system becomes very slow and I can't debug the programs at all. Are there other faster full system debuggers that support taint forward or backward analysis?</p>

Title: How to speed up panda?


问:
How Do i create a simple Detour Library
Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some Sources i saw on the Internet.
Now i have a challenge with the simple MessageBox does not trigger errors at the same time , it fails to hook as i get this Execption

```<code>Exception thrown at 0x0F2B3839 (vcruntime140d.dll) in SHook.exe: 0xC0000005: Access violation writing location 0x75C51F70.
</code>```

On this Line

```<code>memcpy(original, FunctionAddress, TrampolineLength);
</code>```

My source code looks like this  :

SHook.h

```<code>#pragma once

#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include "hde32.h"

class SHook
{
private :
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde32s disam;
    BYTE Jump[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };
public:
    BOOL SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length);
};
</code>```

Now SHook.cpp

```<code>#include "SHook.h"

BOOL SHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)
{
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde32s disam;
    BYTE Jump[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };

    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);
    if (!FunctionAddress)
        return FALSE;

    //disassemble length of each instruction, until we have 5 or more bytes worth
    while (TrampolineLength < 5)
    {
        LPVOID InstPointer = (LPVOID)((DWORD)FunctionAddress + TrampolineLength);
        TrampolineLength += hde32_disasm(InstPointer, &disam);
    }

    //Build the trampoline buffer
    memcpy(original, FunctionAddress, TrampolineLength); //shoots error here
    *(DWORD*)(Jump + 1) = ((DWORD)FunctionAddress + TrampolineLength) - ((DWORD)original + TrampolineLength + 5);
    memcpy((LPVOID)((DWORD)original + TrampolineLength), Jump, 8);

    //Make sure the function is writable
    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &OriginalProtection))
        return FALSE;

    //Build and atomically write the hook
    *(DWORD*)(Jump + 1) = (DWORD)proxy - (DWORD)FunctionAddress - 5;
    //SafeMemcpyPadded(FunctionAddress, Jump, 5);

    //Restore the original page protection
    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &OriginalProtection);

    //Clear CPU instruction cache
    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);

    *length = TrampolineLength;
    return TRUE;
}
</code>```

And the implementation is looking like this

MessageBoxTest.cpp

```<code>#include <stdio.h>
#include <Windows.h>
#include <intrin.h>
#include <string>
#include "SHook.h"

typedef int (WINAPI* TdefOldMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType);
TdefOldMessageBoxA myOldMessageBoxA;

SHook shook;
int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType)
{
    MessageBoxA(NULL, "Hooked", "Hooked", MB_OK);
    return myOldMessageBoxA(hWnd, lpText, lpCaption, uType);
}

void EstablishHook()
{
        myOldMessageBoxA = (TdefOldMessageBoxA)& MessageBoxA;
        shook.SetHook("user32.dll","MessageBoxA", (LPVOID)&HookMessageBoxA, myOldMessageBoxA,0);
}

int main()
{
    EstablishHook();
}
</code>```

Please Can someone give a clarification what i did miss pls

I am trying to understand what i missed there? Please i do need some form of help here

Title: How Do i create a simple Detour Library


问:
Reconstructing struct/union-based IPC protocol wire format
I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with.

I have three C programs which communicate together using an unknown IPC protocol over TCP sockets.

A Linux armel binary that might be described as the "target".

A Linux x86 binary that provides a "shell" or REPL that translates text commands on stdin to IPC I/O against the target. This is a tiny 50KB binary (probably because it was compiled with -O3 and then stripped ;D).

A second Linux armel binary that presents a frontend/UI to the target and incorporates additional IPC-related functionality not found in the REPL.

My first goal is to understand the fundamentals of the IPC wire format by disassembling the shell/REPL control program. The smallness of the control program is encouraging.

With this done, I want to dive into the additional IPC-related functionality only available in the frontend program, which is somewhat bigger (and has noise in the form of UI code).

I have a very hopeful starting environment: I've gotten the two armel programs running in QEMU (the target, easily enough; the control program, after much effort). The x86 binary trivially runs on my host computer.

I've also put together a shaky but functional hamster dance of scripts that route the traffic between the two armel programs (incidentally running in separate QEMU VMs, for operational simplicity!) in such a way that I can intercept the traffic at any time.

And so it is that I... take one look at the protocol and have no idea how to proceed:

```
21:37:21.839965  UI->target   08 00 00 00  01 00 00 01  00 00 00 00  03 00 00 00   .... .... .... ....
                 UI->target   01 00 00 00                                          ....

21:37:21.892845  target->UI   04 00 00 00  01 00 00 01  00 00 00 00  3a 03 00 00   .... .... .... :...

21:37:21.930144  UI->target   08 00 00 00  06 00 00 01  00 00 00 00  6c 70 70 61   .... .... .... lppa
                 UI->target   00 00 00 00                                          ....

21:37:21.991124  target->UI   d0 02 00 00  06 00 00 01  00 00 00 00                .... .... ....
```

I incidentally know what "lppa" means - but this small fragment was taken from a 4,000-line protocol dump that clearly shows that the other bytes change in important ways, but I don't have the experience to discern patterns or significance from the changes.

The only thing I immediately twigged about was the suspicion that I was looking at C structs dumped straight onto a network. For what this program was and did, that makes a lot of sense (it's for all intents and purposes an internal IPC protocol that doesn't, well, need to be particularly resilient).

So, I fired up Ghidra, which I learned about a little while back. Finally, IDA Pro has some competition :)

I spent some time ambling aimlessly around inside the decompiler, and fairly quickly found the following interesting function that does both recv() and send().

But the way this function works is both really interesting and really confusing.

I've highlighted some lines below that refer to buffer_length which are really messing with my head.

When I first saw the code around buffer_length I happened to be looking at the second send() call, so it felt natural to rename that variable to describe "length".

But then I looked at the first send() and found that buf was being pointed to... yeah no that doesn't work.

So I now wonder if this might actually a union. YAY.

(See below for the struct definition)

```
uint maybe_perform_ipc(astruct *something_struct) {

    char *buf;
    uint return_code;
    ssize_t bytecount;
    size_t message_length;

    bytecount = 0;
    return_code = 0x30040000;
    something_struct->only_used_once_and_set_to_256 = 0x100;
    message_length = 12;
    <b>buf = (char *)&something_struct->buffer_length;</b>

    while (
        message_length > 0 &&
        (bytecount = send(something_struct->socket, buf, message_length, MSG_NOSIGNAL)) > 0
    ) {
        message_length -= bytecount;
        buf += bytecount;
    }

    if (bytecount > -1) {

        <b>if (something_struct->buffer_length != 0) {</b>
            <b>message_length = something_struct->buffer_length;</b>
            <b>buf = (char *)something_struct->buffer;</b>
            while (
                message_length > 0 &&
                (bytecount = send(something_struct->socket, buf, message_length, MSG_NOSIGNAL)) > 0
            ) {
                message_length -= bytecount;
                buf += bytecount;
            }
            if (bytecount buf = (char *)&something_struct->buffer_length;

        while (
            message_length > 0 &&
            (bytecount = recv(something_struct->socket, buf, message_length, 0)) > 0
        ) {
            message_length -= bytecount;
            buf = buf + bytecount;
        }

        if (bytecount > -1 && message_length maybe_status_code == 0) {

                my_free_then_realloc((astruct_4 *)something_struct, something_struct->buffer_length);

                if (something_struct->buffer_length != 0) {

                    <b>message_length = something_struct->buffer_length;</b>
                    <b>buf = (char *)something_struct->buffer;</b>

                    while (
                        message_length > 0 &&
                        (bytecount = recv(something_struct->socket, buf, message_length, 0)) > 0
                    ) {
                        message_length -= bytecount;
                        buf = buf + bytecount;
                    }

                    if (bytecount maybe_status_code | 0x30060000;

            }

        }

    }
    return return_code;
}
```

```
offset  length  type           name
0x0     0x4      int           maybe_signature
0x4     0x1      undefined
0x5     0x1      undefined
0x6     0x1      undefined
0x7     0x1      undefined
0x8     0x1      undefined
0x9     0x1      undefined
0xa     0x1      undefined
0xb     0x1      undefined
0xc     0x4      int           socket
0x10    0x4      uint          buffer_length
0x14    0x2      undefined2    maybe_function_code
0x16    0x2      undefined2    only_used_once_and_set_to_256
0x18    0x2      ushort        maybe_status_code
0x1a    0x1      undefined
0x1b    0x1      undefined
0x1c    0x4      uint
0x20    0x4      void *        buffer
0x24    0x4      undefined4    maybe_pid
```

I couldn't figure out how to make Ghidra export the above as a struct so I've just dumped it here as Ghidra presented it, since it's quite readable as it is (and I have no idea how I'd rewrite this as a C struct myself, actually :/).

Looking at buffer_length, if I understand how unions work properly, a function code and a status code (guess-identified from elsewhere) would be kind of exactly the kind of thing you'd want to dump out of a C struct into a network packet.

ALSO, if you go back and look at the code where it sets message_length to 12, the range from buffer_length extends down to the two undefineds currently underneath maybe_status_code.

I unfortunately don't know how to tell Ghidra "go and find me where these two definitions are used!" from the struct editor, and I don't know how to tell Ghidra "search in decompiled code" for field_0x1a and field_0x1b, so these two remain mysteries for now. (I also tried to turn the range into a sub-struct, but then it disappeared in the struct editor.)

Anyway, my point, and my question is...

What direction should I head in so I can make progress with this dissection and get enough context to make sense of what I'm seeing?

Static analysis is proving really cool and interesting, but only because I can decompile to C. Ghidra doesn't provide debugger integration :'(, so I can't fire the shell program up and watch it tick away unless I want to stare at assembly in GDB.

Which I'm not at all unwilling to do, I just find asm really disorientating. I must admit I've been trying to pick it up for about... wow, I think it's been 15 years now, heh. (All the tutorials I've yet found are either really regimented (to the point I can't piece the details together), assume I'm a vegetable (...8086? uhh....), or try and teach me to juggle by handling me 6 balls to start with.)

It's very late so I'll leave this question here for now, and possibly add to it / clarify details a little later on.

One key point: the program I'm reverse engineering is proprietary but its status is "quietly floating around on the internet if you know what rock to look under", so I could share more details privately (incidentally my email is in my bio).


问:
Using Angr in Vulnerability Research
I would like to use angr for vulnerability research.
I was thinking that if I did the following:

```<code>p = angr.Project('a.out', auto_load_libs=False)
sm = p.factory.simulation_manager()
while len(sm.unconstrained) == 0:
  sm.step
</code>```

then the unconstrained state could potentially point me to a vulnerability.
I coded an obvious potential buffer overflow as follows:

```<code>void processPacket( char * pkt )
{
    char buffer[255];
    memcpy(buffer, &pkt[3], *((uint16_t*)&pkt[0]));
}
</code>```

where the first two bytes of a packet determine the length of the rest of the packet and therefore the length of the memcpy.

angr did find an unconstrained state, but it was not readily obvious how to examine the unconstrained state to determine the cause of the vulnerability.

Once I find an unconstrained state, is there a way to determine the cause? Are vulnerability researchers using angr to look for potential vulnerabilities?
Is there a typical methodology to do so?

Title: Using Angr in Vulnerability Research


问:
Dump the value of register into file
I've reverse engineering little game on windows 32bit.

I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move on the board).

You can see that in the string is moved into eax. But more interesting part here is instruction before that

```<code>mov ebx,eax
</code>```

Here ebx will contain the coordinate of a move which player made. This is what I'm interested about. I want to dump this coordinate into a file. So what I want to do is to modify assembly(in my case this code is in dll) and just write that data(which is in ebx) into a file.

I've done a little research but could not found anything useful. All I found is how to patch an executable like make a slightest modifications into assembly which is pretty simple. I was even wondering if there is any tool that could help me achieve this(like shift assembly code to make enough space for me to write some code in it).

One idea that I have is to write a shellcode which dumps data, then add that shellcode at the end of some section, find my string into .txt section, edit the code to jump to my shellcode and then back to original state. But that would be pretty hard because I'm not really experienced in writing shellcode.

Title: Dump the value of register into file


问:
Android APK debugging: modify value of smali register
I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled.

I used to do this with apktool, but looking at their website, smali-debugging is deprecated and they point to SmaliIdea - a plugin for android studio. So I installed that, and indeed - it works fine: I can step, set breakpoints, view smali registers (v7,v8,v9 etc) when I set a watchpoint on them.

What I cant do is actually modify those registers / local variables. I can see them when I set a watchpoint on them, but cant assign a value.

Looking at "planned features" of SmaliIdea:

Show all registers with a value in "locals" pane

Ability to set the value of a register in "watch" pane

It doesnt say I cant modify a register at all right now, but doesnt exactly confirm it either.

This used to be possible with ancient apktool version though! A pretty hefty regression, I would say. (Going back is impractical, too much changed)

Question: How can i modify those smali registers while debugging? is there a register view I am missing or something? How do other people debug APK on smali level?


问:
find a video file in memory dump of a process
I have a player that plays encrypted video files and works like this:

I open an encrypted video file with it

it decrypts the video file and writes it to its memory

and plays the file from the memory after that

and I want to copy the decrypted video file from memory and play it with a usual video player like VLC so I tried to create its memory dump with task manager and hoped to find out the video file there. Sadly I don't know enough to find a video file in a large chunk of bits from memory. I tried to find mp4 patterns in a hex editor (I guessed it might be mp4 because of the unencrypted sample files that they provide before purchase and many mp4 occurrences in the memory dump) and tried every solution that I find online but nothing worked for me so I hoped someone here maybe has an idea and willing to help me how to make it done.

I upload its memory dump here (after opening a short encrypted video with it) and this is the original encrypted video and this is the player and these two are the prerequisites before installing the player: this and this (the last one is the K-Lite Codec Pack)

This player doesn't provide any information about the video, but from their unencrypted sample files, it might be 1280x720 and the duration of video file that is inside the memory dump and original encrypted file, is 13 minutes and 26 seconds.

After loading the video, the disk activity of the process (player) tends to zero (even if I seek to middle or end), and I found a direct ratio between the encrypted video file size and the amount of memory that player occupies, that's why I think video file might be in the memory dump. I just don't know if it is encrypted or not, if not how to find and extract it, if yes how to analyze and find out about its encryption method and hopefully find out a way to decrypt it.

This video is encrypted by a commercial software named Balas Soft Lock (https://www.copyprotection.net/balas-soft-lock.aspx) and the main reason I want to unlock it is that their player doesn't provide the features that I need (for example keyboard shortcut and fast forward).

This question is a clone from StackOverflow and still is active.

Any insight is appreciated, Thanks :)


问:
Reverse Engineering a Vehicle Identification Number (VIN) encoding
Not sure if this is the right place so please point me to the right place if needed.

I have an input of a VIN (Vehicle Identification Number) number with 17 characters, each character is either an uppercase letter or number.

The input is then encoded into 24 signed integers, the integers go from -128 to +127.

There doesn't seem to be any direct linear relationship between the two.

Does anyone know what this encoding might be? Or, how I should go about trying to reverse engineering it?

An example is:

Input: 1D8HB58D04F177301
Output:-2|-72|-11|-2|18|100|-69|15|93|120|15|-97|-35|52|85|-114|53|-123|-1|-101|-38|125|-100|113

I have access to a dataset mapping the inputs to outputs and also a tool that converts an encoding (24 integers) into a VIN

Inexperienced with this so any help is greatly appreciated!


问:
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But after it prints the password is incorrect, it closes, and when I click Debug>Restart it deletes the break point.

So, how can I fix this?

I am using OllyDbg 2


问:
Can a device be forced to stop using SSL?
Lately I’ve become interested in reverse-engineering the APIs used by the Nintendo Switch Online (NSO) services (especially to see if it would be plausible for me to access their Mario Maker 2 API directly due to the lack of a bookmark site) and have been looking for various methods to access the original requests sent.

The first thing I did was fire up Fiddler to try and read the requests. Obviously, they were sent using HTTPS and there is no reasonable way (that I can find) for me to get the Switch to trust my computer without hacking the Switch (ultimately banning me from the very services I’d like to examine, according to most hacking guides).

I was ready to give up when I stumbled upon this post on the GBATemp Forums about someone else attempting to read traffic (except from a 3DS), where one member brought up that there are:

various tools and methods created to force devices to stop using SSL without access to them at all

Do such tools/methods actually exist that would force my Switch to send plaintext requests that I could read from my proxy? Otherwise, is there anything else I’m not seeing here?


问:
Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible)
Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk

which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php

the problem is the api authors are now forcing everyone (with 302 redirect) to connect to https version of that endpoint (the endpoint is used by the new app so it still works) the problem is that they use TLS1.2 which Android 4.0 doesn't support (I think you have to enable it but I am not sure how to do that in an app that I did not write (I can dissasemble/reassemble the app so changing endpoints in it is not a problem, but enabling TLS1.2?))

end the new app requires Android 5 or later so if I want to use the service which I pay for (Voyo) I have to eather upgrade my tabled (which I don't want to do) or downgrade HTTPS to HTTP so my android 4.0 will be able to connect to the API endpoint again

Short question: How to strip SSL on Windows so non-https clients (my old android 4.0 ICS tablet) can connect to the HTTPs service again?

Thanks for Anwsering and Best Regards


问:
What are possible ways to dynamically analyze windows service?
I am working executable, which is meant to be loaded as windows service. I have statically determine certain breakpoints that I'd like it to break upon execution. Is there any particular way to dynamically analyze this executable with OllyDBG?
What are general approaches to dynamically analyzing windows service?</p>


问:
Calling functions of a shared object (.so) extracted from an APK
Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for different architectures (arm64-v8a, armeabi-v7a, x86, x86_64). Each folder contains the same (.so) file.

I decompiled one of them (the one under the x86 folder) using IDA Pro and I found all the functions used natively from the Java code. Since I'm still not so good with assembly code, I would like to reverse the behavior of those functions calling them with different arguments from my own code, maybe linking the (.so) library in some way. I've never done something like this.

So, do you know a proper way to do this in Windows/Linux? (Preferably Java on Windows?) That could help me a lot to follow the instructions in IDA.