问:
Reverse-engineering 24-bit to make the lock system recognize NFC cards as their own
I own a lock system that uses SRI512 cards.
My supplier (manufacturer of the locks) sells the cards at a very expensive price, so I decided to buy them online.
Once they arrived, when I tried to write them, through the proprietary reader, the writer would not write on them, although it recognizes them.

I did a dump of a blank card (given by the manufacturer) and noticed that in the fifth block there is a value, all the remaining card is blank. By changing the card the value of the block changes. Obviously trying to using that block from a working card doesn't work and that's why I think there is an algorithm that turns the UID of the card into these 24 bits (in this way, the system only allows cards distributed by the manufacturer).

I decided to get more data by getting block 5 of every blank card I had, that's about 50.

```<code>D0021B6847E77BD3 -> 01 2B 3D A9
D0021B6847E77D68 -> 01 EB AA 3D
D0021B6847E78738 -> 01 B5 5D 18
D0021B6847E789C0 -> 01 35 CA 34
D0021B6847EA2AE3 -> 01 87 27 4B
D0021B6847EAB92C -> 01 B3 4A 2D
D0021B6847EABDAA -> 01 96 57 11
D0021B6847EAC34D -> 01 BC B3 5C
D0021B6847EAC5F6 -> 01 BB C7 42
D0021B6847EB28FD -> 01 3B F4 03
D0021B6847EB2AC0 -> 01 FD F6 71
D0021B6847EB2C7B -> 01 98 5D 94
D0021B6847EB2E46 -> 01 DC A1 23
D0021B6847EB3481 -> 01 96 76 9C
D0021B6847EB36BC -> 01 B1 2E 0A
D0021B68480B086D -> 01 7F D2 83
D0021B68480B0A50 -> 01 6F 35 6E
D0021B68480B396A -> 01 1A F5 13
D0021B68480B3B57 -> 01 81 06 F1
D0021B68480D878B -> 01 69 BD 13
D0021B68480D8973 -> 01 4F 42 01
D0021B68480D93B4 -> 01 2D 5E 8D
D0021B68DCB18896 -> 01 D5 B8 81
D0021B68DCB18AAB -> 01 19 8A C6
D0021B68DCB196D7 -> 01 EF 9A 3B
D0021B68DCBF3D1D -> 01 73 74 0B
D0021B68DCC0352B -> 01 E2 1E 35
D0021B68DCC03F55 -> 01 BE 08 F4
D0021B68DCC041B2 -> 01 97 A5 96
D0021B68DCC065F0 -> 01 94 2C B5
D0021B68DCC067CD -> 01 82 EB E1
D0021B68DCC46D6F -> 01 B2 8E 99
D0021B68DCC46E28 -> 01 8E 7C 55
D0021B68DCC47DD6 -> 01 C9 E4 80
D0021B68DCCE0B95 -> 01 73 6F 85
D0021B68DCCE15D4 -> 01 33 3D 54
D0021B68DCCE578B -> 01 A4 92 2E
D0021B68DCCE5DF5 -> 01 66 D1 98
D0021B68DCCE6370 -> 01 F6 C0 4F
D0021B68DCDCE779 -> 01 D2 4D CB
D0021B68DCDCE981 -> 01 F7 6D 34
D0021B68DCDD34F7 -> 01 E7 C7 DE
D0021B68DCDD406E -> 01 F2 AF 98
D0021B68DCE60945 -> 01 C0 35 51
D0021B68DCE61539 -> 01 76 71 8D
D0021B68DCE63EF9 -> 01 C2 44 63
D0021B68DCE64498 -> 01 F6 71 6B
D0021B68DCFAF9EE -> 01 1D 03 BF
D0021B68DCFAFF55 -> 01 20 62 ED
D0021B68DCFB0526 -> 01 15 2C E9
D0021B68DCFB0AA4 -> 01 83 FD 79
D0021B68DCFB0C1F -> 01 E1 E6 09
D0021B68DCFB16D8 -> 01 68 8F CA
D0021B68DD02FF77 -> 01 57 63 0A
D0021B68DD034621 -> 01 49 50 DC
D0021B68DD0348D9 -> 01 6F 68 02
</code>```

Added [45]:

```<code>D002196E1B02AC51 -> 01 89 76 A7
D002198F160A3050 -> 01 AD EA A7
D002198F160A3638 -> 01 17 DA EF
D002198F160A7AAE -> 01 43 9F CD
D00219901F512085 -> 01 4E E6 20
D00219901F512746 -> 01 A7 64 4E
D00219901F512A6F -> 01 A2 15 24
D00219901F512B47 -> 01 6E 01 6F
D00219901F512C74 -> 01 FE 02 B2
D00219901F51334D -> 01 C7 0F E7
D00219901F513C37 -> 01 7D D5 D6
D00219901F513F3B -> 01 9A 54 49
D00219901F514244 -> 01 31 9F B1
D00219901F514881 -> 01 06 A0 09
D00219901F514C42 -> 01 9C 3B D0
D00219901F51565D -> 01 39 BF 94
D00219901F515929 -> 01 AD B8 81
D00219901F515D39 -> 01 63 A2 F9
D00219901F515F8E -> 01 45 A5 C4
D00219901F5164A1 -> 01 2C 90 51
D00219901F516F5D -> 01 52 95 44
D00219901F517022 -> 01 FA 43 46
D00219901F518D40 -> 01 77 83 94
D00219901F51927C -> 01 EA 9A F1
D00219901F519397 -> 01 28 AB 7C
D00219901F51B462 -> 01 36 D2 2E
D002199117D14063 -> 01 F7 AF D0
D002199117D1471F -> 01 93 1D 36
D002199117D17F3D -> 01 D5 E6 54
D0021B6847E94417 -> 01 8F 92 AD
D0021B6847E98E3A -> 01 E9 AD 99
D0021B6847E9907B -> 01 DA 02 30
D0021B68480B0213 -> 01 26 D1 5F
D0021B68480B0ED6 -> 01 47 76 7D
D0021B68480B35AF -> 01 A2 D9 56
D0021B68480D8DF5 -> 01 E8 EC CC
D0021B68DCC03390 -> 01 BD 42 5E
D0021B68DCDD36CA -> 01 EF A3 64
D0021B68DCE60B78 -> 01 D6 F0 65
D0021B68DCE60DC3 -> 01 E4 DC A0
D0021B68DCE61704 -> 01 30 94 D8
D0021B68DCE6401E -> 01 9E D6 2B
D0021B68DD03409A -> 01 84 61 77
D0021B68DD034AE4 -> 01 31 1C 0C
D0021B68DD034C5F -> 01 1D DE 3B
</code>```

So here is what I know or what I have inferred:

I think the 01 is not part of the output of the algorithm, whether it is a CRC, hash function or something else is very unlikely to be part of the output, so the output is 24 bits and not 32.

I don't know if it helps but you have to take into account that the UID consists of 4 parts: D0 = Prefix, 02 = Manufacturer, 000110 [binary] (6 in decimal) = Card model (SRI512). The remaining 42 bits are the serial.

I don't know whether the entire UID is taken as input or only a part, but I noticed that among the examples I have available there are cases where the UID ends with the same 3 digits, which is why the algorithm must take as input at least the last 4 (or more).

I have made several attempts and the closest thing I could find is Reverse-engineering a weird 24-bit possibly not CRC checksum, but I am unable to apply it.

I have considered other alternatives, if only to test the reasoning such as buying cards with modifiable UIDs but SRI512s do not exist.

If I keep buying the cards from the manufacturer over time I will get more and more examples

I can't figure out what algorithm is being used.

Update:
I managed to find a file explaining that the encryption used is 3DES-AES, I think at this point the question should be moved.
However I don't know yet if it is used in this conversion, even if it is very likely.


问:
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:

```<code>arm-none-eabi-objdump -b binary --adjust-vma=0x08000000 --start-address=0x08000002 \
  -marm --disassembler-options=force-thumb -D binary_program.bin > /tmp/binary_program-bin.s
</code>```

First, I tested a loop of instructions like this:

```<code>adds    r0, r0, #255
</code>```

and I got in the .s file

```<code> 80002e4:   30ff        adds    r0, #255    ; 0xff
</code>```

After a long search in the ARM manual (and I hope I found the correct one), I could map that binary as:

```<code>instruction: 001_10_000_11111111
bit mask:    111_11_198_76543210
             543_21_0
</code>```

where

111 = "Add, subtract, compare, move (one low register and immediate)", page F3-7301

10 = "ADD, ADDS (immediate)", version T2 is at page F5-7453

000 = r0, source and destination register

11111111 = 255, the immediate operand

This, IIUC, is Thumb-2. So far so good, but the problem is that other instructions, which are not representable with Thumb-2, get mapped to Thumb-3, like

```<code>adds    r0, r0, #256
</code>```

which becomes

```<code> 80002e4:   f510 7080   adds.w  r0, r0, #256    ; 0x100
</code>```

Obviously this is no more T2, and the bit encoding should be something like

```<code>      i 0 op1  S Rn   0 imm3 Rd   imm8
11110_1_0_1000_1_0000_0_111__0000_10000000
33222_2_2_2222_2_1111_1_111__1198_76543210
10987_6_5_4321_0_9876_5_432__10
</code>```

as reported at "Data-processing (modified immediate)", pages F3-7310 and F3-7311. This lead me to pages F5-7452 to 55, "ADD, ADDS (immediate)".
Searching a lot, I found it should be T3: the mnemonic matches (adds.w). This would mean the processor expands the bits 11:0 like this:

it concatenates a 1 with the bits 6:0, 1 0000000

extends with 0s to get a 32 bit word: 00000000000000000000000010000000

it rotates right the integer of the amount specified in bits 11:7, which is 11111, or 31, getting 00000000000000000000000100000000 = 256.

The point is, since I'm using the same compiler for both the codes, and they end up to use different ISAs to translate the instructions, how can I tell which one is which, without dwelling the depths of the ARM manual every time?

Thanks!

ContentLicense: CC BY-SA 4.0


问:
Antidebug plugin for ollydbg 2.01
Can't find any working anti-antidebug plugin for olly 2.01. Maybe anyone can give me one?</p>

Title: Antidebug plugin for ollydbg 2.01


问:
reverse engineering an APK file to find HTTP requests in the source code
I've extracted an apk(react native) with dex2jar and jar to java through jd-qui and also with apktool, and I can view the source code but there is no clue where are the HTTP requests in the source code.

When I intercept the apk traffic I can see all the requests to graphql endoint but I cannot see in the source code, where they are triggered or stored.

I searched the extracted source code with some keywords such as grahpql endpoint name, and the server address but still no result.

And the code seems not obfuscated to me, just some parts are like;

```<code>@Metadata(d1 = {"\000\026\n\002\030\002\n\002\020\000\n\000\n\002\020\002\n\000\n\002\030\002\n\000\bf\030\0002\0020\001J\020\020\002\032\0020\0032\006\020\004\032\0020\005H&\006\006"}, d2 = {"Lcom/x/z/E2EModule;", "", "launch", "", "intent", "Landroid/content/Intent;", "app_release"}, k = 1, mv = {1, 7, 1}, xi = 48)
public interface E2EModule {
  void launch(Intent paramIntent);
}
</code>```

Is there any way to reach where these requests are triggered or stored on the source code?


问:
ghidra assigns local variable to register
im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from
this is the function that is calling the java method
note i renamed it to callvoidmethod

```<code>void CallVoidMethodV(JNIEnv *param_1,jobject param_2,jmethodID param_3,undefined8 param_4,
                    undefined8 param_5,undefined8 param_6,undefined8 param_7,undefined8 param_8)

{
  long lVar1;
  undefined auStack160 [8];
  undefined8 local_98;
  undefined8 uStack144;
  undefined8 local_88;
  undefined8 uStack128;
  undefined8 local_78;
  va_list local_70;
  va_list *ppvStack104;
  undefined *puStack96;
  undefined8 uStack88;
  va_list *ppvStack64;
  undefined *local_38;
  undefined8 uStack48;
  long local_28;

  lVar1 = cRead_8(tpidr_el0);
  local_28 = *(long *)(lVar1 + 0x28);
  puStack96 = auStack160;
  ppvStack104 = &local_70;
  uStack48 = 0xffffff80ffffffd8;
  uStack88 = 0xffffff80ffffffd8;
  local_98 = param_4;
  uStack144 = param_5;
  local_88 = param_6;
  uStack128 = param_7;
  local_78 = param_8;
  local_70 = register0x00000008;
  ppvStack64 = ppvStack104;
  local_38 = puStack96;
  (*(*param_1)->CallVoidMethodV)(param_1,param_2,param_3,&local_70);
  if (*(long *)(lVar1 + 0x28) == local_28) {
    return;
  }
</code>```

the variable i am interested in is local_70 which is assigned register0x00000008 what is this value and what does it mean? and what is the variables with the word stack in it
also is there a way i can use a debugger on this library?


问:
Looking for some help for decoding a signal from IR remote
The following signal has been captured from a remote that I suspect code for at least 3 things: the ID: 107, the item: 1, and the color. I didn't change the ID and item here (although I could do so and send the results), I only changed the color for each result:

Result (color 01): 3  1  2  1  1  5  1  5  2  1  1  1  3  4  4  1  1  3  3  4  1

Result (color 02): 3  1  2  1  1  4  1  6  2  1  1  1  3  4  3  1  5  1  2  1  1  1  1  2  1

Result (Color 03): 3  1  2  1  1  4  2  5  2  1  1  1  3  4  3  2  2  1  3  1  1  3  1  1  1

Result (Color 04): 3  1  2  1  1  3  1  7  2  1  1  1  3  4  5  1  2  3  4  2  2

Result (Color 05): 3  1  2  1  1  3  1  1  1  5  2  1  1  1  3  4  4  2  1  2  1  4  5

Result (Color 06): 3  1  2  1  1  3  2  6  2  1  1  1  3  4  3  1  1  2  2  4  2  2  1

Result (Color 08): 3  1  2  1  1  2  1  8  2  1  1  1  3  4  4  3  1  1  2  1  1  3  3

Result (Color 09): 3  1  2  1  1  2  1  2  1  5  2  1  1  1  3  4  5  5  2  1  1  1  1  1  2

Result (Color 0A): 3  1  2  1  1  2  1  1  1  6  2  1  1  1  3  4  3  3  6  4  2

31211 is obviously just here to tell us this is the start of the message.

the 2 following numbers tells us the color, (although something else is needed to distinguish some colors)

 All the information (including some kind of checksum to make sure the message is consistent) seems encoded, and numbers seem to always fit into one bit (values all between 1 and 8). My guess is that we can start to remove 1 to all the values, but then I am stuck ;-(

Any help from the geniuses I see here solving much harder problems is welcome!!


问:
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the beginning of the address is being parsed weird. For example, overflowing with b"\x7f" * 150 shows in the stack as as all 00. Further, it seems that values after these 0x7F bytes overwrite where the 00s are.

In the picture below you can see a test where I overflowed with bytes from 0x00 up to 0xFF. As you can see, 0x7F is non-existant because it has been written over by the values after it for some strange reason.

I'm fairly confident this has something to do with gets() treating the 0x7F weird but I'm not sure how to work around this. Any help much appreciated!

Edit: Okay, so I just realized that 0x7F corresponds to the del (delete) ascii character which would explain the odd behavior. So I guess my question is still how to work around this?

Title: Buffer overflow gets() weird parsing


问:
Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code
I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking but I could not find much.

Imagine we have a Linux shared object named CustLib.so, that exports one single function named Func.

Furthermore, imagine a program (let's call it ClientProg) imports Func from CustLib.so and calls it from its main.

What I have been trying to do with Ghidra is:

Load CustLib.so into Ghidra, Analyze it, and put a breakpoint somewhere within the decompiled code pertaining to Func.

Load ClientProg into Ghidra, Analyze it, and start it in the Debugger.

Wait until ClientProg calls Func, at which point I expect Ghidra to break on the breakpoint I had previously set at Func.

To my surprise, the last step above never happens. ClientProg runs from start to completion (in GDB IN-VM mode), without ever breaking on Func.

Could I ask whether I am actually missing something? Or am I expecting an unsupported functionality? Many thanks.


问:
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.

In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where there is a list of places where the function is called/branched to). I assume that these functions are virtual functions, and that the reference is in the vtable.

However, I expect that a reference to the function should still be found in the vtable data, and I should be able to see where the function is called by looking for read accesses on the vtable field. But Ghidra does not show any reference to the function from anything that looks like a vtable.

The only references that Ghidra finds to these functions are a bunch of places called "frame descriptor entry" and "LSDA call site record", which I understand are to do with exception handling?

This is seriously frustrating. I'll be working on a function and then follow the path up through all the functions that call it in order to find where some particular operation is being performed, and then suddenly reach a dead end at one of these functions that apparently isn't called anywhere.

I'm aware that Ghidra doesn't have particularly good support for C++, but the vtable still exists and the data for it has to be in memory somewhere so Ghidra should still be able to find it right? As it is I don't even know where the vtables are.

EDIT: Is it normal for these references to not show up? If so, how does one go about finding the vtables and determining which functions they point to, or determining which vtables point to a given function? I don't know what I should expect to be seeing, and the only examples that I can find are trivial examples with only one or two classes and with various kinds of type information available and automatically filled in, rather than a real-world example with lots of FUN_012345678 labels and undefined parameters and stripped and optimised object code.


问:
Cutter failing to XREF even a simple 1 line 'Hello world'

The disassembler yields 0 reference to the "Hello world" string!

Anyone knows what might be the issue?

IDA 8.2 Free and Ghidra find and shows the XREF as they are supposed to.


问:
How to correctly inject a [jump + address] instruction into another process (code injection)?
I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.

For example:

```<code>unsigned int addr = 0x0048DA03;
unsigned int jumpToAddr = 0x0048D9B2;
unsigned char command[] = { 0xEA };
WriteProcessMemory(hProcess, (void*)addr, (void*)command, sizeof(command), NULL); // this line for jmp
WriteProcessMemory(hProcess, (void*)addr, (void*)jumpToAddr, sizeof(jumpToAddr), NULL); // this line for the address
</code>```

The result:

As you see, after executing that code, the jump address is wrong.

Also, the same problem occurs with the following code:

```<code>void* reservedMemAddress = VirtualAllocEx(hProcess, NULL, 100, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (reservedMemAddress) {
    WriteProcessMemory(hProcess, (void*)addr, (void*)command, sizeof(command), NULL);
    WriteProcessMemory(hProcess, (void*)addr, (void*)reservedMemAddress, sizeof(reservedMemAddress), NULL);
}
</code>```

How can I write the address correctly?

How can I merge the two WriteProcessMemory lines into one to
write the entire instruction ex:JMP 0x0048D9B2?


问:
Inverter BLE communication module receives commands in HCI_ACL but apk shows ATT
I have a solar inverter which can be queried through mobile apps, eSolar O&M or eSolar SET. My goal is to read values from the inverter (solar power, grid consumption...) by querying the device from a home made program, and possibly implement this on an ESP32.

The communication between the app and the inverter goes through a BLE device, which internally sends and gets information using the Modbus protocol.
I've unpacked the apk and every command sent to the module is clearly available as an hexadecimal string, everything is very straightforward, from the string building to the hash applied to it. From the app point of view, this string is sent through BLE using ATT commands, yet when I try to send those commands either with a python script, gatttool or even using the nRF Connect mobile app, I receive an ack from the device (49 04 02 01 00) to the notification handle, but no result.

In order to understand the communication between the app and the device, I've enabled HCI snooping on the Android device and got a clean capture. And while what seems to be an initial setup (BLE characteristics, MTU negocition...) happen using ATT commands, it switches to HCI_ACL to query the device and the communication between the 2 becomes unreadable.

Moreover, grep'ing the initial commands sent by the app in the extracted apk gives no match. I am sure the apk is the one installed.

The more puzzling is that a person from this inverter (SAJ H1) hacking community is able to send ATT commands and receives results, the only difference is that I have a more recent firmware on the BLE module.

Does this rings a bell to anyone? Any idea on how to proceed?


问:
incorrect Ghidra decompile functions parameters
I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID)

I saw someone wrote here about this problem:
https://github.com/NationalSecurityAgency/ghidra/issues/4329

Is there any way to fix it ?


问:
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.

Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.

refer: Do IDA Python plugins work with IDA free or only IDA pro?

Title: Does IDA Freeware 8.x support plugins?


问:
deobfuscate Dexgaurd obfuscated code
I was reversing an apk. the code detects whether the apk is running on a rooted device or not. if it is rooted or an emulator it will stop and close out. so this is the snippet code which I think it was obfuscated with DexGuard not really sure if it is.

```<code>v0_4 = (int)(((Integer)((Class)withOrigin.read(((char)(-1 - Long.compare(ExpandableListView.getPackedPositionForChild(0, 0), 0L))), 476 - View.combineMeasuredStates(0, 0), 18 - Long.compare(Process.getElapsedCpuTime(), 0L))).getMethod("RemoteActionCompatParcelizer", Context.class, Integer.TYPE).invoke(null, v0_3, ((int)1))));
</code>```

so the method RemoteActionCompatParcelizer is the method determining whether rooted or not I believe. as such the withOrigin.read intercepted with frida returns o.a so tried to with jadx-gui find the package o.a as the method RemoteActionCompatParcelizer is apparently defined in this package but not found in the tree o and there are a bunch of other classes in it.

so what next steps can I take to solve these obfuscations?

Title: deobfuscate Dexgaurd obfuscated code


问:
How to do a Mifare Classic Replay attack
I'm learning for the university and have to do a Mifare Classic replay attack.
I don't really know how to do that and hope some of you can help me at least a bit.

The goal is to get the number of iterations after the start of the random number generator of the valid session.

Here is the information I got:

```<code>Random Number Zx:
2225499778

Seed:
1735622233

Polynomial:
x^24 + x^23 + x^22 + x^21 + x^19 + x^18 + x^17 + x^13 + x^5 + x^4 + x^3 + x^2 + 1
</code>```

I have already implemented a basic LFSR in C but don't know what to do next:

```<code>#include <sys/types.h>
#include <stdio.h>

#define INITIAL 67737E59
int main(void) {
    __int32 reg = INITIAL;
    __int32 bit;
    do {
        bit = (reg & 0x0001) ^
                ((reg & 0x0004) >> 2) ^
                ((reg & 0x0008) >> 3) ^
                ((reg & 0x0020) >> 5);
        reg = (reg >> 1) | (bit << 23);
        printf("%i", bit);
    } while (reg != INITIAL);

    return 0;
}
</code>```

OwnerDisplayName: Justin


问:
MCU 8051 MOV instructions
I've disassembled (dasmx 1.4) this 8051 firmware from device that has external program ROM and SRAM.
There are some lines I don't yet understand where they address to:
What's IPC?
Where 'mov X0032,xxx" is addressing to, and what does it move actually? I know 'movx @dptr,xxx" is used for external RAM.

```<code>mov ipc,#010H
mov dptr,#028A6H
mov X0032,dph
mov X0033,dpl
</code>```

then follows...

```<code>mov a,X0032
mov dph,a
mov a,X0033
mov dpl,a
clr a
movc    a,@a+dptr
</code>```

So is it internal RAM due to direct addressing?

Title: MCU 8051 MOV instructions


问:
Finding 3-byte checksum algorithm of key transponder
I am developing a tool for programming automotive RFID transponder chips from NXP (e.g. PCF7945, PCF7961). Those chips provide a 3-byte checksum over parts of their internal memory.
In order to check whether the chip was correctly programmed, I would like to verify the checksum.

Unfortunately I do not find any documentation of the used algorithm, even in the chip's full datasheet it is not mentioned.

As example, I would like to find the checksum for the EEPROM content, which has as size of 512 byte.
I already tried to use the tool CRC RevEng, but had no success.

Some sample data files can be found under following link: Sample files posted in mikrocontroller.net
(Hint: The last 6 characters of the filename represent the checksum which was calculated by the key)

Could anybody of the experts have a look on it? I would appreciate if someone could give me a hint how to determine the algorithm.

Edit: Just for the case you do not like the link to an external forum, I put some example data with corresponding checksum below:

In the following three samples, only the last byte was modified:

```4D 49 4B 52 FF 32 FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF 66 FF FF FF F6 00 6A AE ```

Checksum FD 4D 1F

```4D 49 4B 52 FF 32 FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF 66 FF FF FF F6 00 6A 6E ```

Checksum FD 4E 1F

```4D 49 4B 52 FF 32 FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF 66 FF FF FF F6 00 6A EE ```

Checksum FD 4F 1F


问:
Delphi MT05.3 ecu
Hi I have a Honda IGX800 V twin engine with a Delphi MT05.3 ecu The engine has an idle of 1400 rpm
I would like to be able to gain access to the ecu and reduce the idle rpm to around 950 /1000 rpm
What would I need to access the ecu? and is there anyone who could help with reducing the idle rpm?
Any help suggestions ideas really would be appreciated thanks</p>

Title: Delphi MT05.3 ecu


问:
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file

WPP_GLOBAL_Control == &WPP_GLOBAL_Control

Actually, I have seen this kind of condition a == &a in many other files. Some values are addresses but some are just int values with only 8 bits. Do they use this form because this value is frequently used in other programs and needs to check before use like critical section or sth

```<code>if ( (unsigned __int64)v3 < v4 )
  {
    while ( 1 )
    {
      v6 = *v5++;
      if ( v6 > 0x3Fu )
        break;
      if ( v6 )
      {
        ++v1;
        v5 += v6;
        if ( (unsigned __int64)v5 < v4 )
          continue;
      }
      goto LABEL_6;
    }
    v7 = WPP_GLOBAL_Control;
    if ( WPP_GLOBAL_Control == &WPP_GLOBAL_Control
      || (*((_DWORD *)WPP_GLOBAL_Control + 7) & 0x800) == 0
      || *((_BYTE *)WPP_GLOBAL_Control + 25) < 4u )
    {
      return 0i64;
    }

.data:00007FF7B0829D40 WPP_GLOBAL_Control dq offset WPP_GLOBAL_Control
.data:00007FF7B0829D40                                         ; DATA XREF: Aging_UpdateAgingTime+32↑r
.data:00007FF7B0829D40                                         ; Aging_UpdateAgingTime+39↑o ...
.data:00007FF7B0829D48                 align 10h
.data:00007FF7B0829D50 ; PWSTR g_genericDesiredAttrs
</code>```

Title: purpose for using a == &a


问:
What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?
I’m disassembling binaries in IDA Pro.

It usually takes 15+ minutes just to pre-process/open one binary,

Then another 20-30 min before IDA is fully done disassembling and finally becomes idle.

Another 10+ mins to search for all string references.

Further, something like BinDiff usually takes 50-60+ mins each time I run it when comparing 2 disassembled .i64 files.

What computer components are most important in these processes? Is it the CPU, RAM, storage/SSD, GPU, or some combo of those?

I have an i7-9750H (2.60GHz, up to 4.50GHz with Turbo Boost, 6 Cores, 12MB Cache), 16 GB 2666MHz DDR4, an M.2 PCIe-NVMe SSD, and NVIDIA GeForce GTX 1650 Max-Q 4GB.

I saw a similar question here (Is there a way to improve disassembler speed?), but I believe this is not a duplicate question because my binaries are much smaller and I’m still having these massive time delays. I’m wondering if any of these specific components could be holding me back and which would produce the highest throughout difference with regard to upgrading. Is it RAM size, RAM clock, CPU clock speed, CPU core count, CPU thread count, SSD read, write speed, or something else?


问:
IDA remote GDB debugger cannot suspend linux machine
I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit,  IMO it has something to do with bios! or I don't know at all!).

But after starting it I cannot get data back to IDA. when I try to suspend the machine via IDA it won't work at all and takes so long time without any chance.

I also tried connecting to the machine via another IDA instance by a 64bit version of IDA and I can only connect to process (1) which breaks the line to debug processes already running!

Could someone help a bit on this tricky thing?


问:
format-string + ret2libc (or format string only)?
I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me if I'm wrong). I don't know how to exploit it, can you help me?

Images: Ghidra and GDB


问:
Exporting patches as loader in x64dbg?
Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection?

The resulting file should function as a loader, automatically patching the desired modifications when the original executable is opened.

Title: Exporting patches as loader in x64dbg?


问:
How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?
I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/Substrate

After complete function hook. I tried comparing the .text section between the in-memory module and the shared object lib file but couldn't find the trampoline function. Here is the Frida script on the codeshare that I referenced https://codeshare.frida.re/@lichao890427/find-android-hook/. The origin function is hooked but .text section data in memory is same with shared object lib file. I also used memory tools like Cheat Engine or Game-Guardian (on Android) to look for the offset I hooked in memory and found it wasn't replaced. So, how did MSHookFunction work and how can I detect hooked functions ?


问:
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.

When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-click on reference to type description, you are presented with a comment nicely presenting the full class hierarchy along with all the mdisp, pdisp and vdisp offsets, like this:

```<code>.data:00000001400080F0 ; public class E /* mdisp:0 */ :
.data:00000001400080F0 ;   public class D /* mdisp:0 */ :
.data:00000001400080F0 ;     public class B /* mdisp:0 */ :
.data:00000001400080F0 ;       public virtual class A /* mdisp:0 pdisp:8 vdisp:4 */,
.data:00000001400080F0 ;     invisible private protected class C /* mdisp:24 */ :
.data:00000001400080F0 ;       public virtual class A /* mdisp:0 pdisp:8 vdisp:4 */
.data:00000001400080F0 ; class E `RTTI Type Descriptor'
.data:00000001400080F0 ??_R0?AVE@@@8   dq offset ??_7type_info@@6B@
.data:00000001400080F0                                         ; DATA XREF: .rdata:E::`RTTI Base Class Descriptor at (0,-1,0,64)'↑o
.data:00000001400080F0                                         ; .rdata:00000001400059B4↑o ...
.data:00000001400080F0                                         ; reference to RTTI's vftable
.data:00000001400080F8                 dq 0                    ; internal runtime reference
.data:0000000140008100 aAve            db '.?AVE@@',0          ; type descriptor name
</code>```

Since IDA seems to have parsed that hierarchy for you already, is it possible to access it with IDAPython and get access to both the hierarchy and the Xdisp values without parsing everything yourself?

While one could always parse the auto-generated comment itself, this looks like a crude workaround for me.


问:
How to get the address of a glibc private symbol at runtime programmatically?
I am trying to get the address of a private function in GLIBC.
For instance - the function __run_prefork_handlers().

I have done it with gdb, using info symbol __run_prefork_handlers and info address __run_prefork_handlers
And I get the relevant information (relevant so) and address of the function.

I tried to get the address of this function programmatically using dlsym.

Since glibc is loaded by runtime loader at startup I call dlsym(RTLD_GLOBAL, "__run_prefork_handlers") without first calling dlopen.

I get a NULL pointer and perror returns:

undefined symbol: __run_prefork_handlers

Running the same code for symbol of an exported function such as fork works well.

Which steps should I take to get this information within a program?


问:
I have just started working on firmware analysis. I do not know where to start from and what steps to follow
I am in the final semester of my college degree and I am working on firmware analysis. I have tried reversing various bin files of firmware provided by dlink. All of them seems to be encrypted and I do not know what to do in that case. Any idea how to know their encryption type and their decryption algorithms with their keys?</p>


问:
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file  (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).

Thus I changed it at first Hex Editing using HxD and the second time around with "Resource Hacker".

Although the program is written with Wide Characters style and functions, it doesn't seem to recognize the characters and it gives "?".

Therefore I thought the problem is the font, so I changed the font of the Dialog to "Arial"  but still it didn't work. I even changed the Dialog Language in Resource Hacker to Arabic/Persian it mostly broke the .exe file up and it wouldn't run but sometimes that it would work and run still couldn't recognize the characters. I even tried to change the manifest encoding to UTF-16LE but it seems Windows 11/10 only support UTF-8 encoding for manifest.

And by the way the Program is written in MFC I can share the decompiled .c file with HexRays IDA Pro if you like but, it wouldn't help that much.

For example I edited the dialog into this code and when I run the .exe file it gives this error

So this is a reverse engineering project and I'm programming anything and can't use C++/C.

What is the problem??

Here is the exe file: http://www.mediafire.com/file/7yhqgwmkt004qj4/FileSplitter.exe


问:
Binary Exploitation
I am trying to learn binary exploitation. I can modify the binary behaviour with gdb, but I have not understood how to exploit the binary in C.

I've found some references on "Hacking - the art of exploitation", but I cannot completely figure out how to exploit the binary. Could someone show me some examples or give me a guideline?

Below is the simple code I am trying to exploit (force the app to run execl):

```<code>#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
  int shell= 0;

  if (shell==0) {
  printf("Bye\n");
  return 1;

  }

  execl("/bin/sh", "/bin/sh", "-p", (void *) NULL);
  perror("exec");
  return 1;
}

</code>```

with objdump:

```<code>08048486 <main>:
 8048486:       55                      push   %ebp
 8048487:       89 e5                   mov    %esp,%ebp
 8048489:       83 ec 04                sub    $0x4,%esp
...
 80484b4:       68 68 85 04 08          push   $0x8048568
 80484b9:       68 68 85 04 08          push   $0x8048568
 80484be:       e8 8d fe ff ff          call   8048350 <execl@plt>
 80484c3:       83 c4 10                add    $0x10,%esp
...
 80484d8:       c9                      leave
 80484d9:       c3                      ret
 80484da:       66 90                   xchg   %ax,%ax
 80484dc:       66 90                   xchg   %ax,%ax
 80484de:       66 90                   xchg   %ax,%ax
</code>```

Thank you

Title: Binary Exploitation


问:
Decode encoded XHR/Ajax response payload
I'm trying to access a site using it's API with Insomnia client, but some XHR responses are encoded, it seems. I don't know the exact algorithm that's being used (but it's not base64, I tried decoding). Here's alink to one of the encrypted responses that I receive.

My question: can someone tell what encoding this is, or how can I proceed from here?


问:
Merge HEX file into existing ELF file in ghidra
I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually effectively via a hex editor).

How can I "replace" the hex within the ELF file but not lose all the other metadata in the elf file for processing?

Is there any way to import a HEX into an existing ELF project and have it override the binary it has already extracted?

I'm sure a tool could be written to do this, I'm just trying to save time and see if there is any existing functionality to do this. I am fairly inexperienced with Ghidra.

The goal is to get all the function names/variables annotated in the new modified HEX file.


问:
How can i Lifting x86_64 assembly code to LLVM-IR
I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting instructions to the LLVM-IR level? For example, where can I look at code that just translate one pop rsp instruction to LLVM-IR? Since I didn't find anything like that.

Maybe someone has articles where this is described or can someone suggest with an example?


问:
neovim: pwntools process automatically stops when trying to invoke interactive shell
I'm using python pwntools.
I'm using python 3.10.x

This line of code should open a shell for me:
io.interactive()

But while running this file from vim using
!./% it doesn't open the shell doesn't invoke as it was supposed to be. The process stops contrarily.

The code:

```<code>#!/usr/bin/python3
from pwn import *

elf = context.binary = ELF("house_of_force")
libc = elf.libc

gs = '''
continue
'''
def start():
    if args.GDB:
        return gdb.debug(elf.path, gdbscript=gs)
    else:
        return process(elf.path)

# Select the "malloc" option, send size & data.
def malloc(size, data):
    io.send("1")
    io.sendafter("size: ", f"{size}")
    io.sendafter("data: ", data)
    io.recvuntil("> ")

# Calculate the "wraparound" distance between two addresses.
def delta(x, y):
    return (0xffffffffffffffff - x) + y

io = start()

# This binary leaks the address of puts(), use it to resolve the libc load address.
io.recvuntil("puts() @ ")
libc.address = int(io.recvline(), 16) - libc.sym.puts

# This binary leaks the heap start address.
io.recvuntil("heap @ ")
heap = int(io.recvline(), 16)
io.recvuntil("> ")
io.timeout = 0.1

# =============================================================================

# =-=-=- EXAMPLE -=-=-=

# The "heap" variable holds the heap start address.
log.info(f"heap: 0x{heap:02x}")

# Program symbols are available via "elf.sym.<symbol name>".
log.info(f"target: 0x{elf.sym.target:02x}")

# The malloc() function chooses option 1 from the menu.
# Its arguments are "size" and "data".
malloc(24, b"Y"*24)

# The delta() function finds the "wraparound" distance between two addresses.
log.info(f"delta between heap & main(): 0x{delta(heap, elf.sym.main):02x}")

# =============================================================================

io.interactive()
</code>```

Error:

```<code>/home/pegasus/Documents/Courses/HeapLAB-main/house_of_force/./exploit.py:19: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  io.sendafter("size: ", f"{size}")
/home/pegasus/.local/lib/python3.10/site-packages/pwnlib/tubes/tube.py:813: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
/home/pegasus/Documents/Courses/HeapLAB-main/house_of_force/./exploit.py:21: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  io.recvuntil("> ")
[*] delta between heap & main(): 0xfffffffffebd9816
[*] Switching to interactive mode
[*] Stopped process '/home/pegasus/Documents/Courses/HeapLAB-main/house_of_force/house_of_force' (pid 7496)

</code>```


问:
Getting info for undocumented APIs called by StartServiceCtrlDispatcher
I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# and called it as a console app. I started it from WinDbg and set a breakpoint at ADVAPI32!StartServiceCtrlDispatcherWStub. I then stepped into a few calls until I got the following stack trace:

```<code>0:000> kP
Child-SP          RetAddr           Call Site
00000000`0037e578 00007ffa`101a52be RPCRT4!RpcStringBindingComposeW+0xff
00000000`0037e580 00007ffa`101abedf sechost!ScClientBindToServer+0x76
00000000`0037e690 00007ffa`101a8751 sechost!ScOpenServiceChannelHandle+0x1f
00000000`0037e6d0 00007ffa`009796f0 sechost!StartServiceCtrlDispatcherW+0x3c
00000000`0037e710 00007ffa`0097c0af System_ServiceProcess_ni+0x296f0
00000000`0037e7e0 00007ff9`a0730104 System_ServiceProcess_ni+0x2c0af
00000000`0037e880 00007ff9`ffe84113 0x00007ff9`a0730104
00000000`0037e8d0 00007ff9`ffe83fde clr!CallDescrWorkerInternal+0x83
00000000`0037e910 00007ff9`ffe889a3 clr!CallDescrWorkerWithHandler+0x4a
00000000`0037e950 00007ff9`fff591aa clr!MethodDescCallSite::CallTargetWorker+0x251
00000000`0037eb00 00007ff9`fff5999a clr!RunMain+0x1e7
00000000`0037ece0 00007ff9`fff59893 clr!Assembly::ExecuteMainMethod+0xb6
00000000`0037efd0 00007ff9`fff59372 clr!SystemDomain::ExecuteMainMethod+0x506
00000000`0037f5e0 00007ff9`fff592c6 clr!ExecuteEXE+0x3f
00000000`0037f650 00007ff9`fff59d84 clr!_CorExeMainInternal+0xae
00000000`0037f6e0 00007ffa`011e7ced clr!CorExeMain+0x14
00000000`0037f720 00007ffa`0128ea5b mscoreei!CorExeMain+0xe0
00000000`0037f770 00007ffa`107115cd MSCOREE!CorExeMain_Exported+0xcb
00000000`0037f7a0 00007ffa`10a343d1 KERNEL32!BaseThreadInitThunk+0xd
00000000`0037f7d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
0:000> !clrstack
OS Thread Id: 0x2ae4 (0)
        Child SP               IP Call Site
000000000037e738 00007ffa100795b3 [InlinedCallFrame: 000000000037e738] System.ServiceProcess.NativeMethods.StartServiceCtrlDispatcher(IntPtr)
000000000037e738 00007ffa009796f0 [InlinedCallFrame: 000000000037e738] System.ServiceProcess.NativeMethods.StartServiceCtrlDispatcher(IntPtr)
000000000037e710 00007ffa009796f0 DomainBoundILStubClass.IL_STUB_PInvoke(IntPtr)
000000000037e7e0 00007ffa0097c0af System.ServiceProcess.ServiceBase.Run(System.ServiceProcess.ServiceBase[])
000000000037e880 00007ff9a0730104 ConsoleAndSCMPatternDemo.Program.Main(System.String[]) [c:\Users\Justin\Documents\Visual Studio 2013\Projects\ConsoleAndSCMPatternDemo\ConsoleAndSCMPatternDemo\Program.cs @ 21]
000000000037ebb0 00007ff9ffe84113 [GCFrame: 000000000037ebb0]
</code>```

I have two questions:

What is this sechost.dll that seems to have AdvApi32 functionality.

Where can I find documentation about the following API calls:

ScClientBindToServer

ScOpenServiceChannelHandle

Google doesn't give good info on either.

ContentLicense: CC BY-SA 3.0


问:
How to view a QJsonValue while debuging exe with IDA
I'm step by step debugging a program in IDA.
The program uses the Qt-toolkit.
The function that I'm stepping through is handling a json document.
For example here it is accessing the key workgroup and putting its value in v15 (pseudocode):

v15 represents RAX, but when I take a look add the address RAX, I do expect to see the workgroup value but instead I see just zeros:

How can I see the textual value of the workgroup key of this json document?


问:
Find decryption key of coco2d lua
I am trying to find the encryption key for a lua file from a .so file
But I am new in this field. I visit websites and found that key is inside xxteaDecrypt function I found two xxteaDecrypt function.

First xxteaDecrypt function

```<code>__int64 __fastcall xxtea_decrypt(const unsigned __int8 *a1, unsigned int a2, const unsigned __int8 *a3, size_t a4, unsigned int *a5)
{
  char *v10; // x24
 __int64 v11; // x19

 *a5 = 0;
 if ( a4 > 0xF )
return sub_91716C(a1, a2, a3, a5);
 v10 = (char *)amt_malloc(0x10u);
 memcpy(v10, a3, a4);
 memset(&v10[a4], 0, 16 - a4);
 v11 = sub_91716C(a1, a2, v10, a5);
 amt_free(v10);
 return v11;
}

</code>```

Second xxteaDecrypt function

```<code>__int64 __fastcall encryption::xxteaDecrypt(encryption *this, void *a2, char *a3, const char *a4, unsigned int *a5)
{
  unsigned int v8; // w21
  __int64 result; // x0
  unsigned int v10; // [xsp+4h] [xbp-3Ch] BYREF
  __int64 v11; // [xsp+8h] [xbp-38h]

  v11 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  if ( !a3 )
  {
    __amt_assert(
      "/Users/user/jenkins/workspace/BFG/BFG-android/AMTEngine/native/tools/encryption/encryption.cpp",
      (char *)((unsigned int)&qword_28 + 4),
      "keyExactly16Characters && strlen(keyExactly16Characters) == 16",
      0);
    return 0LL;
  }
  v8 = (unsigned int)a2;
  if ( strlen(a3) != 16LL )
    __amt_assert(
      "/Users/user/jenkins/workspace/BFG/BFG-android/AMTEngine/native/tools/encryption/encryption.cpp",
      (char *)((unsigned int)&qword_28 + 4),
      "keyExactly16Characters && strlen(keyExactly16Characters) == 16",
      0);
  if ( strlen(a3) != 16LL )
    return 0LL;
  v10 = 0;
  result = xxtea_decrypt((const unsigned __int8 *)this, v8, (const unsigned __int8 *)a3, 0x10u, &v10);
  if ( a4 )
    *(_DWORD *)a4 = v10;
  return result;
}
</code>```

Signature - amta

link of so file - https://mega.nz/file/IKhl1aTY#YAh5SXwLTKuEWZkY1ZO8BCfv9yz-TAN9bW-z6h5PS7M

Please help me to get the key. I am trying from a long time

Title: Find decryption key of coco2d lua


问:
decompile, build apk without mdify code have error like app crashed and icon changed
I want to try modifying the apk and when I try to build then install there is no problem, but when I check the icon on the apk changes like the default Android icon and the app crashes. Likewise when I try when decompile, build, sign and install without modifying the contents.

the tools I use are apktool.

Trying to use JADX but error when decompile


问:
What Checksum Algorithm used
I have blocks 1 to 4 of an RFID card with 4-byte Hex data each. Block 5 contains some sort of 4-byte Hex data checksum which I would like to know how it was derived.

Please see the 3 sample data below:

(1)

Block
Data

Block 1
C9 09 1B 1B

Block 2
00 01 01 01

Block 3
64 64 DA 9C

Block 4
1A DA A3 00

Block 5
C7 60 01 E9

(2)

Block
Data

Block 1
C9 09 1B 1B

Block 2
00 01 01 01

Block 3
67 67 DA 9C

Block 4
1A DA A3 00

Block 5
DA 3D E6 E7

(3)

Block
Data

Block 1
C9 09 1B 1B

Block 2
00 01 01 01

Block 3
6A 6D DA 9C

Block 4
1A DA A3 00

Block 5
22 B7 DE 6F

Please note that only changes in block 3 1st and 2nd column data resulted in the changes shown in block 5 data in each of the sample.

Could anyone figure out how the checksums were calculated?

Many thanks in advance.

Title: What Checksum Algorithm used


问:
How do I log a string in smali without its obfuscated function?
I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.

```<code>String stc = ("msg=" + URLEncoder.encode(m20b.m60c(C22d.f54b), "UTF-8"));
</code>```

the fuction which obfuscates the messages is m20b.m60c and I need to log the string to the console without it. The problem is that the editable code is in Smali, a very difficult lower level language. Everything I tried so far made the app crash.

...

```<code>invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V

    const-string v2, "msg="
    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    sget-object v2, Lc/b/a/a;->b:Ljava/lang/String;

    invoke-static {v2}, Lc/b/a;->c(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v2

    const-string v3, "UTF-8"

    invoke-static {v2, v3}, Ljava/net/URLEncoder;->encode(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;

    move-result-object v2

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    new-instance v2, Ljava/lang/StringBuilder;

    invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V

    invoke-virtual {v2, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
</code>```


问:
How can I progress reverse engineering this Novatek NT96650 firmware
I'm trying to RE a Novatek NT96650 based trail cam. This device is circa 2012, and has a MIPS32 24Kec core.

I have copies of the firmware,

I have extracted the contents of flash,

and have a pretty good assembly language listing of it from Ghidra.

But I am now stuck trying to get any further. The listing shows the detail of (what I assume is) device drivers for memory-mapped peripherals, but the Novatek device and dev environment are not documented. Without the ability to (say) isolate LCD management code or flash access code, I am really struggling to make any sense of it.

I do not have any low-level access to the device, or the ability to upload amended firmware. Does anyone have any suggestions on other information sources I could use or techniques I could try? I did wonder if Novatek's SoC architecture is maybe similar to other MIPS vendor's devices, and I might get some clues from that. Does anyone have any idea if that idea is a runner, and if so where I could look?


问:
How to deal with this frustrating case of JWT auth bearer + async token?
Here's the case:

I'm analyzing an API and the way JWT was implemented seems to be anti-tampering. There's two components that must be there or there's an authentication error:

Auth Bearer -> Stays the same 'til the session expires

Async-Token -> Some fields Changes in every request made, it also expires.

So when I log in and do any operation (view/edit profile, check balance, top-up, etc) the server replies with a new Async-token, the app receives it and makes the same request with this token, only then the operation is made.

If I try to change values in the body, it doesn't do anything because the requests has already been made with both tokens. If I intercept and try to change the values (say user ID) before receiving the token, it returns an error. I tried to exploit the common flaws of JWT but this one appears to be very well secured.

Note: I can decode the tokens in base64 and see all the values except the signature.


问:
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. Since I've got no success with finding debug UART, I've managed to get a transaction to LCD driver IC and get a memory dump for each state of the LCD screen.
So, now I know the state of 128 bits of LCD controller memory, which is mapped somehow to segments on the LCD screen:

I can change the text displayed on a screen by manipulating various parameters such as distance, angle, and battery level, and collecting the correspondence between the real LCD segment states and the memory map. However, the central function of converting bits to segments is still a puzzle. Additionally, I am having difficulty manipulating all the segments as desired, as making changes to one segment in a seven-segment display requires moving the device and can result in unpredictable changes in distance values. Furthermore, not all bits in the memory map are being used.
My question is:

Are there any tools available to automate or simplify the finding of this mapping function? From a mathematical perspective, it appears to be a system of linear equations.

Are there any other suggestions for resolving this problem?

Title: Reverse engineering LCD memory map


问:
Can I get thread counts remotely with Immunity Debugger
I am debugging a program on a Windows server with Immunity debugger.

Immunity debugger offers a remote command line client. I can do basic tasks through this command line.

But is there a way to get threads count?


问:
The execution is not at AddressOfEntryPoint after patching .text section bytes

I have a shellcode and want to inject my shellcode into a PE file (a simple compiled c program that prints Hello World on the screen) . My shellcode size is 0x2a1 and the .text section of my PE file has enough space to hold it . So i opened my PE file in PE-Bear and find the .text section RawOffset in file :

then i patch .text section bytes using HxD . I set AddressOfEntryPoint in OptionalHeader to start of .text section where my shellcode is :

So now execution must be started from my shellcode bytes . but i ran PE file and got error :

I opened PE file using OllyDbg and execution wasn't at position that i expected :

AddressOfEntryPoint was 1000 . it's RVA so the execution must be started at 0x00401000 since the ImageBase is 0x00401000 (PE file is not dynamic base) but it isn't that and we got Access Violation .

i use Windows XP . what is going on ? why does this happen ?


问:
Tracing odd variant of call analysis failed
Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside).

That said, I opened up a .so, the contents of which I know nothing about, and got the dreaded 33AB0: call analysis failed. Looking at that line, it's a call to a function, which is an extern. So I know even less about it than the library im looking at. Weirdly that same call happens multiple times before the line causing the error, and it seems IDA is ok with those invokes. It looks like this:

```<code>.text:00033A1C                 mov     dword ptr [esp+18h], 0
.text:00033A24                 mov     dword ptr [esp+14h], 0
.text:00033A2C                 mov     [esp+10h], eax
.text:00033A30                 mov     dword ptr [esp+0Ch], (offset aFmt+1) ; "fmt"
.text:00033A38                 mov     dword ptr [esp+8], 1
.text:00033A40                 mov     dword ptr [esp+4], offset unk_51988
.text:00033A48                 mov     dword ptr [esp], 3
.text:00033A4F                 call    log_dispatch
.text:00033A54                 jmp     loc_33786
.text:00033A54 ; ---------------------------------------------------------------------------
.text:00033A59                 align 10h
.text:00033A60
.text:00033A60 loc_33A60:                              ; CODE XREF: ff_init_entry+136↑j
.text:00033A60                 call    get_sw_date
.text:00033A65                 mov     dword ptr [esp+8], offset byte_52420
.text:00033A6D                 mov     [esp+4], eax
.text:00033A71                 mov     dword ptr [esp], offset aSoftwareVersio
.text:00033A78                 call    lfmt
.text:00033A7D                 mov     dword ptr [esp+18h], 0
.text:00033A85                 mov     dword ptr [esp+14h], 0
.text:00033A8D                 mov     [esp+10h], eax
.text:00033A91                 mov     dword ptr [esp+0Ch], (offset aFmt+1) ; "fmt"
.text:00033A99                 mov     dword ptr [esp+8], 1
.text:00033AA1                 mov     dword ptr [esp+4], offset unk_519E8
.text:00033AA9                 mov     dword ptr [esp], 3
.text:00033AB0                 call    log_dispatch    <---- CALL ANALYSIS FAILED
.text:00033AB5                 jmp     loc_337BC
.text:00033ABA ; ---------------------------------------------------------------------------
.text:00033ABA
.text:00033ABA loc_33ABA:                              ; CODE XREF: ff_init_entry+366↑j
.text:00033ABA                 mov     dword ptr [esp+4], 1F2h
.text:00033AC2                 mov     dword ptr [esp], offset aSoftwareDat
.text:00033AC9                 call    lfmt
.text:00033ACE                 mov     dword ptr [esp+18h], 0
.text:00033AD6                 mov     dword ptr [esp+14h], 0
.text:00033ADE                 mov     [esp+10h], eax
.text:00033AE2                 mov     dword ptr [esp+0Ch], (offset aFmt+1) ; "fmt"
.text:00033AEA                 mov     dword ptr [esp+8], 1
.text:00033AF2                 mov     dword ptr [esp+4], offset unk_519A0
.text:00033AFA                 mov     dword ptr [esp], 3
.text:00033B01                 call    log_dispatch
.text:00033B06                 jmp     loc_339EC
</code>```

Seems obvious it's doing some logging, and IDA believes log_dispatch is int __cdecl log_dispatch(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD);, which also seems plausible to me.. How would I go about hunting this down? The answer is appreciated, but the path to find it myself is what I'm endeavoring to learn here..

UPDATED: In digging more, I found some oddness up in the PLT:

```<code>.plt:00013FA0 ; =============== S U B R O U T I N E =======================================
.plt:00013FA0
.plt:00013FA0 ; Attributes: thunk
.plt:00013FA0
.plt:00013FA0 ; _DWORD __cdecl std::string::reserve(std::string *__hidden this, unsigned int)
.plt:00013FA0 __ZNSs7reserveEj proc near              ; CODE XREF: std::operator+<char>(char const*,std::string const&)+41↓p
.plt:00013FA0                 jmp     ds:off_4F018    ; PIC mode
.plt:00013FA0 __ZNSs7reserveEj endp
.plt:00013FA0
.plt:00013FA6 ; ---------------------------------------------------------------------------
.plt:00013FA6                 push    18h
.plt:00013FAB                 jmp     sub_13F60
.plt:00013FB0
.plt:00013FB0 ; =============== S U B R O U T I N E =======================================
</code>```

The push and jmp outside the subroutine seems strange, though it seems to be the case with every entry in the PLT.. Not sure if this should be a hint to me, but messing with loading options on handling the PLT doesn't seem to change it..


问:
Java bytecode dynamic analysis
I've been trying to patch a certain functionality of a jar file, that's essentially a GUI app. I've tried numerous java agents -as it seems to be the only viable option for java- for such a task, however quite a few limitations arose. Namely:

Previously loaded classes don't fire up again during logging (causes plot holes).

Specific method calls are often omitted.

Real time decompilation is unheard of when it comes this approach, even though it's generally feasible.

I was wondering if there's a better approach -or an alternative that addresses those 'issues'- to go about dynamically analyse java executables, and not just instrumentation; as it seems to be geared more towards debugging during development rather than reverse engineering.

Title: Java bytecode dynamic analysis


问:
Is it possible to enhance CAPEv2 detection?
I have used the Flare-CAPA plugin on IDA to help me with reverse engineering. Could I use these rules to enhance the detection of CAPEv2 sandbox?

In general: How to enhance CAPEv2 sandbox detection?


问:
Weird anti-debugging mechanism
I am trying to grasp an anti-debugging trick used in this program. Upon attaching any debugger (x64dbg, VEH debugger) the software crashes after about 2 seconds.

x64dbg shows me that the following instruction causes an exception:

After stepping over it, control immediately transfers to ntdll._KiUserExceptionDispatcher, calling some vectored exception handler, which eventually ends up executing int 0x29 (KiRaiseSecurityFailure), crashing the program.

The log shows the following information regarding the exception

```<code>EXCEPTION_DEBUG_INFO:
           dwFirstChance: 1
           ExceptionCode: C0000005 (EXCEPTION_ACCESS_VIOLATION)
          ExceptionFlags: 00000000
        ExceptionAddress: 16B224E1
        NumberParameters: 2
ExceptionInformation[00]: 00000000 Read
ExceptionInformation[01]: 00000000 Inaccessible Address
</code>```

This subroutine is referenced exactly once where it is getting pushed:

```<code>16B22405 | 50                             | push eax                                                                       |
16B22406 | 6A 00                          | push 0                                                                         |
16B22408 | 56                             | push esi                                                                       |
16B22409 | 68 C024B216                    | push <sub_16B224C0>       // HERE                                              |
16B2240E | 6A 00                          | push 0                                                                         |
16B22410 | 6A 00                          | push 0                                                                         |
16B22412 | E8 4CF92800                    | call <sub_16DB1D63>                                                            |
</code>```

Looking into sub_16DB1D63 it is used here (ebp+10h):

```<code>16DB1D84 | 56                             | push esi                                                                       |
16DB1D85 | FF75 14                        | push dword ptr ss:[ebp+14]                                                     | [ebp+14]:sub_16DB1E7B
16DB1D88 | FF75 10                        | push dword ptr ss:[ebp+10]                                                     | [ebp+10]:sub_16DB1E7B
16DB1D8B | E8 64000000                    | call <sub_16DB1DF4>                                                            |
</code>```

Now it gets weird... This subroutine apparently calls GetModuleHandleExW:

```<code>16DB1E19 | 8B4D 08                        | mov ecx,dword ptr ss:[ebp+8]                                                   |
16DB1E1C | 8B45 0C                        | mov eax,dword ptr ss:[ebp+C]                                                   |
16DB1E1F | 890E                           | mov dword ptr ds:[esi],ecx                                                     |
16DB1E21 | 8946 04                        | mov dword ptr ds:[esi+4],eax                                                   |
16DB1E24 | 8D46 0C                        | lea eax,dword ptr ds:[esi+C]                                                   |
16DB1E27 | 50                             | push eax                                                                       |
16DB1E28 | 51                             | push ecx                                                                       |
16DB1E29 | 6A 04                          | push 4                                                                         |
16DB1E2B | FF15 803DE316                  | call dword ptr ds:[<sub_16E33D80>]    // GetModuleHandleExW stub               |
</code>```

So it is passing a function address as the module name? Any ideas what kind of black magic this might be?

Also in general, what are some ways to trace back such exceptions to their origins? Since vectored exception handlers are registered globally (process-wide), I can't really figure out which instruction exactly caused it (looking at the call stack, there are no suspicious instructions/threads).

Some more info: I tried several user-mode anti-anti-debugging plugins such as ScyllaHide & TitanHide. Same result. Passing all exceptions to the debuggee does not help either, although I am pretty sure this is an exception-based anti-debug mechanism.

Edit: Stupid me should have looked at the docs. Apparently, if you pass ˋGET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS (0x00000004)ˋ, then passing in any address as the module name parameter will also get the module handle. I still have no idea why this is done, though.

Title: Weird anti-debugging mechanism


问:
Overwriting the Global Offset Table + format string vulnerability
I am trying to understand how to overwrite the Global Offset Table. On the book "Hacking: The Art of Exploitation". Following the example I get:

```<code>objdump  -R ./fmt

./fmt:     file format elf32-i386

DYNAMIC RELOCATION RECORDS
OFFSET   TYPE              VALUE
08049ffc R_386_GLOB_DAT    __gmon_start__
0804a00c R_386_JUMP_SLOT   printf@GLIBC_2.0
0804a010 R_386_JUMP_SLOT   exit@GLIBC_2.0
0804a014 R_386_JUMP_SLOT   strlen@GLIBC_2.0
0804a018 R_386_JUMP_SLOT   __libc_start_main@GLIBC_2.0
0804a01c R_386_JUMP_SLOT   snprintf@GLIBC_2.0
</code>```

The book says that if the jump instruction used for the exit() function can be manipulated to direct the execution flow into shellcode instead of the exit() function, the shell will be spawned.

For my program, the actual address of the exit(), stored as a pointer at
the memory address is : 0x0804a010.

Then the shellcode is stored in an environment variable and its actual location (e.g 0xbffffe28 ) is used to calculate <var1> <var2> for the following exploit:

```<code>\x12\xa0\x04\x08\x10\xa0\x04\x08%<val1>x%4$hn%<val2>x%5$hn
</code>```

so

```<code>$ gdb -q
(gdb) p 0xbfff - 8
$1 = 49143
(gdb) p 0xfe28 - 0xbfff
$2 = 15913
(gdb) quit
</code>```

Now, when I run the "exploit" I get :

```<code>$ ./fmt $(printf "\x12\xa0\x04\x08\x10\xa0\x04\x08")%49143x%4\$hn%15913x%5\$hn
Segmentation fault (core dumped)
</code>```

Could anyone please advise me on what I am doing wrong or missing?
Why the address of the shellcode is not written into the address of the exit() function?
Thank you


问:
How to deal with msvc runtime integrity?
After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release.

I'm actually newbie in reverse engineering so would be nice to get any advice, thanks.


问:
Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out
Following is the link to the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file.

Please help me to decode it as it is very important for me.

File


问:
PinTools Multi-threaded example (inscount_Tls.cpp): only one thread outputs
I am studying PinTools multithread example inscount_tls.cpp. When I change the number of thread to 3, only 1 thread outputs the result. Is anyone familiar with Intel Pintools instruments that can give some advice?
If I run the example inscount_tls.cpp as in the manual (i.e., numThreads set to 0), the output:

```<code>Count[0] = 1141027
Total number of threads = 1
</code>```

But if I change the numThreads to 3, there is only one thread outputs (instead of 4) its result:

```<code>Count[0] = 1141027
Total number of threads = 4
</code>```

My Linux machine has 8 cores, and the below is how I build and run Pin:

In the source file, I only change the number thread to 3, and the output log file to "inscount_tls.out"

```<code>/*
 * Copyright (C) 2004-2021 Intel Corporation.
 * SPDX-License-Identifier: MIT
 */

#include <iostream>
#include <fstream>
#include "pin.H"
using std::cerr;
using std::cout;
using std::endl;
using std::ostream;
using std::string;

KNOB< string > KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool", "o", "inscount_tls.out", "specify output file name");

INT32 numThreads = 3;
ostream* OutFile = NULL;

// Force each thread's data to be in its own data cache line so that
// multiple threads do not contend for the same data cache line.
// This avoids the false sharing problem.
#define PADSIZE 56 // 64 byte line size: 64-8

// a running count of the instructions
class thread_data_t
{
  public:
    thread_data_t() : _count(0) {}
    UINT64 _count;
    UINT8 _pad[PADSIZE];
};

// key for accessing TLS storage in the threads. initialized once in main()
static TLS_KEY tls_key = INVALID_TLS_KEY;

// This function is called before every block
VOID PIN_FAST_ANALYSIS_CALL docount(UINT32 c, THREADID threadid)
{
    thread_data_t* tdata = static_cast< thread_data_t* >(PIN_GetThreadData(tls_key, threadid));
    tdata->_count += c;
}

VOID ThreadStart(THREADID threadid, CONTEXT* ctxt, INT32 flags, VOID* v)
{
    numThreads++;
    thread_data_t* tdata = new thread_data_t;
    if (PIN_SetThreadData(tls_key, tdata, threadid) == FALSE)
    {
        cerr << "PIN_SetThreadData failed" << endl;
        PIN_ExitProcess(1);
    }
}

// Pin calls this function every time a new basic block is encountered.
// It inserts a call to docount.
VOID Trace(TRACE trace, VOID* v)
{
    // Visit every basic block  in the trace
    for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl))
    {
        // Insert a call to docount for every bbl, passing the number of instructions.

        BBL_InsertCall(bbl, IPOINT_ANYWHERE, (AFUNPTR)docount, IARG_FAST_ANALYSIS_CALL, IARG_UINT32, BBL_NumIns(bbl),
                       IARG_THREAD_ID, IARG_END);
    }
}

// This function is called when the thread exits
VOID ThreadFini(THREADID threadIndex, const CONTEXT* ctxt, INT32 code, VOID* v)
{
    thread_data_t* tdata = static_cast< thread_data_t* >(PIN_GetThreadData(tls_key, threadIndex));
    *OutFile << "Count[" << decstr(threadIndex) << "] = " << tdata->_count << endl;
    delete tdata;
}

// This function is called when the application exits
VOID Fini(INT32 code, VOID* v) { *OutFile << "Total number of threads = " << numThreads << endl; }

/* ===================================================================== */
/* Print Help Message                                                    */
/* ===================================================================== */

INT32 Usage()
{
    cerr << "This tool counts the number of dynamic instructions executed" << endl;
    cerr << endl << KNOB_BASE::StringKnobSummary() << endl;
    return 1;
}

/* ===================================================================== */
/* Main                                                                  */
/* ===================================================================== */

int main(int argc, char* argv[])
{
    // Initialize pin
    PIN_InitSymbols();
    if (PIN_Init(argc, argv)) return Usage();

    OutFile = KnobOutputFile.Value().empty() ? &cout : new std::ofstream(KnobOutputFile.Value().c_str());

    // Obtain  a key for TLS storage.
    tls_key = PIN_CreateThreadDataKey(NULL);
    if (tls_key == INVALID_TLS_KEY)
    {
        cerr << "number of already allocated keys reached the MAX_CLIENT_TLS_KEYS limit" << endl;
        PIN_ExitProcess(1);
    }

    // Register ThreadStart to be called when a thread starts.
    PIN_AddThreadStartFunction(ThreadStart, NULL);

    // Register Fini to be called when thread exits.
    PIN_AddThreadFiniFunction(ThreadFini, NULL);

    // Register Fini to be called when the application exits.
    PIN_AddFiniFunction(Fini, NULL);

    // Register Instruction to be called to instrument instructions.
    TRACE_AddInstrumentFunction(Trace, NULL);

    // Start the program, never returns
    PIN_StartProgram();

    return 1;
}
</code>```


问:
How do I hook these js methods/functions with Frida?
I want to hook these methods for the purpose to log the string variables (str) just before they are encrypted by a function (encr). I'm showing only the relevant parts for simplicity.

1-

```<code> protected static String m1a(String str, String str2, String str3) {
 ...
 String str5 = ("dev=" + URLEncoder.encode(encr.mc(C20.f50))
 ...
</code>```

2-

```<code>public final class a1c {

    public static String ma(String str) {
        return encr.m6b(str);
    }

}
</code>```

3-

```<code>private void me(String str, String str2) {
        md(encr.m6a(str.substring(4)), str2);
    }
</code>```


问:
Intel Pintools: How to count the number of static and basic blocks?
I am using Intel Pintool BBLs to count the total number of static and dynamic basic blocks.

The below is the distinguish between static vs dynamic basic blocks (bbls):

A dynamic basic block is defined as a sequential run of instructions
that starts with an instruction that is a target of a taken branch and
ends with the first taken branch in sequence. Thus, one dynamic basic
block may contain one or more static basic blocks that are defined as
follows: a sequential run of instructions that starts with an
instruction that is a target of a taken branch and ends with the first
branch in sequence

Intel Pintool User Manual  defines their basic block (BBLs) as:

Pin breaks the trace into basic blocks, BBLs. A BBL is a single
entrance, single exit sequence of instructions. Branches to the middle
of a bbl begin a new trace and hence a new BBL

I am not clear if Pintool BBLs is static or dynamic bbls?

Please advice!


问:
Yelp: getting documentId for certain operationName
Going through devtools activity for this page (reproducible for any Yelp business page), there's a reference to a GetReviewSummary GraphQL operation in a javascript file. This data shows up in the page source within a script tag's JSON near the reviewCountsByRating key, after the page fully loads. Rather than have to load the full page every time to obtain this data, it seems smarter to perform the GetReviewSummary operation and get that JSON immediately.
These operation names seem to be part of POST requests to https://www.yelp.com/gql/batch, which needs a payload looking something like this:

```<code>import requests

json_data = [
    {
        'operationName': 'GetNotRecommendedReviewsProps', # not necessary, but illustrates the operationName idea
        'variables': {
            'BizEncId': 'GX11hWfQDDqjSEJ-5R0MVQ', # id of the business in question
        },
        'extensions': {
            'documentId': 'e5375d7efbef7d828bab3b1afdd123409a8da596071f5da9e39773d462235b64', # somehow this is derived
        },
    },
]

response = requests.post('https://www.yelp.com/gql/batch', json=json_data)
</code>```

The documentId field seems to be set in javascript, but seems difficult to determine how its derived. It's a SHA256 hex digest string and has to be valid (existing?) to produce a successful 200 response. documentId:  e5375d7efbef7d828bab3b1afdd123409a8da596071f5da9e39773d462235b64 goes with operationName: GetNotRecommendedReviewsProps. I've searched for how to get the similar documentId for GetReviewSummary , but no luck.

It seems since the request is happening from a JS file, there is no corresponding response value to search through for the various network calls. It just shows up in the script section of the HTML once the page is done loading.

Is it possible to see where/when GetReviewSummary gets called and its payload?


问:
Extract assets images from a games APK
I'm trying to remove some images from an android game, but when I try to view them in a hexadecimal viewer I see that they don't contain a PNG header, so I can't view them through the python PIL library. Could someone help me to identify the pattern composed by this encryption?

I'm venturing into the field of extracting data from hexadecimal files, forgive the lack of knowledge or obvious things in the question

Title: Extract assets images from a games APK


问:
Where can I find documentation for IDA Freeware?
I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?</p>


问:
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a challenge on this particular site:

0x0539.net

Now the challenge I'm focused on at this moment in time is Very_Malicious

So far what I've gathered about this challenge is that it has some form of program obfuscation, in this case the obfuscation I've identified is a VM (Virtual Machine) which fetches and decodes a large set of opcodes. The opcodes are stored within the same function as the entry point of the program.

Now I have identified each of the custom VM instructions and have created a very short IDA Python script to extract the bytecode. It isn't ideal but it does what it is suppose to do.

```<code>dism_addr = list(FuncItems(0x1b4c))
for addr in dism_addr:
    if "mov     byte ptr [rax]," in GetDisasm(addr):
        print(GetDisasm(addr))
</code>```

After creating a disassembler for the challenge, I'm curious if there is a better way to solve this challenge rather than spending a couple of hours (2/3) reverse engineering. I've read about Symbolic Execution and my question is:

How would a reverse engineer solve a challenge like this using Symbolic Execution?

Please refrain from posting flags, I just want a thorough explanation on what I could do to solve this more efficiently and quickly.

Any help is appreciated, thank you for taking the time to read my question!

Title: Program Analysis on a Wargame Binary


问:
I trying rewrite asm to c++
This code generates an API key. I use it in an android app as .so file,
but I need to rewrite it to java from c++. How do I translate?

```<code>push    rbp
push    r15
push    r14
push    r13
push    r12
push    rbx
sub     rsp, 198h
mov     rbx, rdx
mov     rdx, rsi
mov     r12, rdi
mov     rax, fs:28h
mov     [rsp+1C8h+var_38], rax
lea     rbp, [rsp+1C8h+var_70]
mov     rdi, rbp
mov     rsi, r12
call    __Z12getSignatureP7_JNIEnvP8_jobject ; getSignature(_JNIEnv *,_jobject *)
lea     rdi, [rsp+1C8h+var_88]
mov     edx, 3
mov     ecx, 0Eh
mov     rsi, rbp
mov     r8, rbp
call    __ZNSt6__ndk112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2ERKS5_mmRKS4_ ; std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>::basic_string(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>> const&,ulong,ulong,std::__ndk1::allocator<char> const&)
lea     rdi, [rsp+1C8h+var_A0]
mov     edx, 13h
mov     ecx, 0Bh
mov     rsi, rbp
mov     r8, rbp
call    __ZNSt6__ndk112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC2ERKS5_mmRKS4_ ; std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>::basic_string(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>> const&,ulong,ulong,std::__ndk1::allocator<char> const&)
test    rbx, rbx
jz      loc_21FE3
</code>```

The full code is here.

As I understand the key generation occurs here.

To generate a key in Java after importing the library, I call the native method x01 with a string argument.

Please explain how this code works

Title: I trying rewrite asm to c++


问:
How the hash/code in url is generated
I am trying to scrape publicly available sites by urls. But the problem is I can not understand the urls needed to be accessed.

URLs are like

https://ldtax.gov.bd/ldtax-holdings/individual-rashid-print-offline/MVBDSzI4UTYzdUsydFJLZGJwT0x2Zz09

https://ldtax.gov.bd/ldtax-holdings/individual-rashid-print-offline/VGVDcGlxOERLSTV1TVA2RmVQV2RmZz09

https://ldtax.gov.bd/ldtax-holdings/individual-rashid-print-offline/T3VrSHpiRWVwRWIwS0wzSHJHT1ZXUT09

https://ldtax.gov.bd/ldtax-holdings/individual-rashid-print-offline/K21oS29VdWJ0dnpxdHBTN296SFVHQT09

Here I can not understand how MVBDSzI4UTYzdUsydFJLZGJwT0x2Zz09 [for example of the first link] is being generated. I think the server behind uses some information from the response (the response got from accessing the above url, you translate it using google translate to correlate) to generate this type of hash actually. Can anyone help me out?

P.S. My question is closed in another site being relevant to this site.

EDIT

I am adding more code expecting if there found a pattern.

SzRTRDNpTWhKUkhOTDYyOHdDemJRdz09
N0dKOUcrRWNGYzlOY3BRVTdkbHNwQT09
V0Y3UnlPS2x0cVBJeUxwUXhvbStzZz09
SGo2TS9NQmJqR1pvM0h3UFlmZ2NGZz09
Uk9VeDlDMDd6WVdGZmhyWmdRNG1TQT09
Vjh4L0tHcXU2TDJSZHdpdUZuMzVJdz09
Mko0NlA2eFE1L0JiRkl5VDgzKzR1Zz09
OWE2UGNHc0FzQ291OTJuS3lrbWpUZz09
TDFWSFBVTzc3V0wwNkNBWTJkVGRwZz09
dWd4d1RQdzloVFF4bXdNWFNhajFuQT09
ZnFYMFBWUStuQnA4Q2hVd1N6L1BMdz09
VXc1ZmxSZDFtcXdraXJKYUdOYTRhUT09
UE5sMFhUaGpVQ202dHZ2YmdDVlMrQT09
bXlRbkl6TmRZeTNQdFJZTGJ2SEgyUT09
NzBMUXBnWnRWNFZ5Y0tXQ3Z0YmpvUT09
KzZNN3Z0VVd6WFVLaTNjSXMwODQvZz09
TVZvWjJJR1R2M0VYcjRFTWRybDhndz09
aUpqYW1ONTdtZnc0MzJ5L2Z1UThqdz09
OXc2dWlzNnViUy8xenFBZmdNZmZWUT09
UGdmSFJVanNzMlVtdHBQZU5zQmlZUT09
S2ZaZDZoSmEwK2tKelJuMXpSMjZNQT09
NHZoaGhHMGRKVUlvUVJydUhBZE9qZz09
RU9TQjNjcEN3cFR2Q0xvazByc3NRZz09
Z0l1OVZaMERMajhpVGRyMHZOOFlFUT09
WXM5YldaT2Q1TFpUZ2NtRDZmeVQrUT09
b25LcnJLTUsrZSt5dnRGZGRYQVJIUT09
SmU0MW9WOXA5bitqUmV0aXh2N2dsZz09
b2xZMGxlSmR1eVlkeGZ3ZUJzODhldz09
MndpSE9KTWd2YmdNTkorZ2dOTFhQQT09
dG1Sc21QTkZJcVRmLytUZnpaSHlyUT09
TFdRNlI5VUZ4cFBldDFXak1jL3A4Zz09
RWxUWG16WXhJMmxIMGdmTDZlQm00Zz09
OVVUVGlSWmpzMkFaeWViVC9TUFZkUT09
dkhOWDhzWFFIdUVOSnR3aWVTd2dJZz09
cEJVRUxzSE9UYnVOWS9KKzJ6dkJKdz09
LzVOY2tJUDdmT25VMEhuTFYvdkxFZz09
Y0FiWU5qYjZyanFveWp1bUpTZEIwUT09
aXdPZ3F4QklUWU1RMk5IZXdHaTVXQT09
Sm9reWlKQ2lEVVhNYVJaYm1VWFF6UT09
VHF3bnZ3RW8yd1ExMHFhNmZadDl0dz09
Mkx5ZTBEUmRvZkNBYTBLRThwRFlLdz09
ZHRoOUM2MlVBMWZONURNc1FIeFROUT09
YnJ3bHlhaEFyNm4zc1BGa2hhM0lDQT09
cGtidTR1VU90MGJQS1IvMko0QnJhdz09
QTRlUy9LNTYwdzhZNnJBSWo0eitnQT09
cW9VaExjT3l0M2lkdTZtcE9raGpsUT09
SDBvWjlJdThOZytLbURWemt0eGsxZz09
Q2NEMVlHN0QvYlU2QzdmRXowMWNtZz09
Y2hybjdnVkdyak82eFZyQTlnVnhzZz09
WTZ3YTVHK0ZIL2Q3eXBhWnRQbmVQZz09
cytxQyt0OXF4aVZ6a2ZvaldYNmhodz09
eHBMNFAxSHdhR2hVR0xIbHNKMnpUQT09
c3BLdXFiUzNPV0tNSC9DRGhrUmF4dz09
Z3Z0ZlpoWkZQVmlVMEVHS0NJNlhlQT09
WnUxWFdNbExqSzNvYzliamtZUFJHdz09
TnJRbVRObThmdXRETkNWLytDNHZjQT09
OE5zSDhZUkgyWHZ2c3U3QkhDT1F2dz09
OFBnLzVOd2p0c2xFWERUUzFzMElsQT09
TWVGT3gxNXMvRUtwTHRKM3J5VWI1Zz09
R2Vkd1VWbHIrVVdOWXpSbldoRk1RQT09
ZzM5eisvblBlcnRBVVZtNWNWQS84QT09
VjFLMjVGY2FYY25DR2FhNm9BWXhKZz09
VW9VcVRPTFRiMndiV25sdGw0eEtKdz09
amhNRE14WjN6R014d3ZJa1U5UjQ5UT09
akZUaXJjUjMyRVIwUktPbHkwRWQ5Zz09
SEVuMFR0WU5UNjVWNTFQQTVycnpWUT09
Z2dLUExmaE5OWnN1TDdHU0JUSFJhdz09
L0Jib21HZHREV2poMWVyVFdxUmZSZz09
R2ZnTGNoWEw0aHFhK0tCNW53bmpHdz09
SlVXaXQ0N3ErTnI5dTd5RFpIV0trUT09
WndwVUJaMjVyL1hBeEpnbmlsNGkydz09
R0w1MU43alE4blhyUHZoR1YzUnpOZz09
UHRkbXNlSmFJMVhIcGIrZ3NZK05QZz09
UnBVeUIwRWcvN0tva3MzcVNMR1RSQT09
ek1icWVISVJla3RhcEtsTnN6dlI2UT09
eVRJS0w2OUpHbmZyR2dkZXBRS2VSUT09
Y0E1dTdqRUx5U2k2SkhNUGVQMWwyQT09
bG5wOHF1SlliMGJ6UnhWeU93cUpjQT09
RmNBY2d6Z29aN0ErdWtGZWdud3l5UT09
R3cvZTdhOGhXQURDbmptOEkwTHgvdz09
VGozZWxyaXpJdDhTNytIcTRFZmNkQT09
WmdRWXZqZ1FMTCtqL0hsRHVRaXV5Zz09
R0dpQ2JMVVBDZkxwUndFQlZ6YXVFQT09
MVp6TUhHdHNzdUUrYS81U3VjV05wZz09
a3FNOUxFUTN1Y2p1bklic0JSc0ZrZz09
UzYza1VaMmVweE5pM0pqWFp3eVUxdz09
anFaSWJuK0oxMXUvUGl2QWo0UTdUZz09
SmlHWXJFVlozUytWSTR6M240ZW1YZz09
TUZvL2dlZGJ3ajNpdDAvWHpNd0FOQT09
SXhYbGZlcDFoeFZmYm1nK3QyeGtkdz09
ZWZzRGF6MWdTYlBrK3dGRVNUbHB5QT09
aUc2eU1LOEgyS2N1MUtyV1lwQWVmdz09
cVpUR1JCazRUcWpSQmY0bFl0anNIZz09
OHZybVR5WnVHM1dCRHVqaDE3ZlJxdz09
WlpKNlBtSTJaTzRXSkVjTitvR0cyQT09
eVVIbWM0bzc5QXgxYmVZUnY0dnExZz09
Y003dmR4NXMzWDQ4SjRGS2MvYXpFUT09
cHd1VDIwUHhWV005T1FSNkVJcDJ3dz09
dnk0YnFsMTRtalFmOGl0bDBkNlk2QT09
ZFdLTWl1U3Q2L28zZmZsQjRZcEZsUT09
N25vQlhOL2NoaElGOTY0U2h5VWxlQT09
V3ViVzNCMU5IMldmUmlYVWZPWTRRQT09
WHZnUm9FWjRvOGVybTJvbFFZVjRGQT09
M2JWYmw5UWxOSmw5TFpNNEFNYUhSQT09
ZlM4R1VpWXExTCsxc1Buck1GYTZXUT09
M21pTFFPZzZlaFRXb2JSMmRPN21DUT09
Qkp6MlptVU9TY1dLVEoyc1lNS0Yxdz09
VmwrWHFPWmx5Mzd1UjcwdkhuRHhQQT09
a1ZsWVNTak5JK1k4cTlWNmNpRGkwQT09
dzdEOXVmRHdWSlVLbC90RDlZWXJpUT09
NmhhR0lJVEFxVysvV29uYUtUdGtkQT09
cy84Y1BSRXBsZzI5SHBQQ3VvWFJ4QT09
d2k1TWNON24xNzRIUUhyRk1TK0gyZz09
OXdnb3RlRUhCSlAyais3SXBEYllZUT09
NERsakI5L2tUeTNTVjVzSi9VU2dJUT09
NmMwRm4rcGJZRXRvL1h4bm9hb0Q4dz09
UHlYM3lQTXJPaTRPQ2pORnE5anY1UT09
YjBBVm9MS25RZ3N5cllkMHpxMDlMUT09
SUIxbkhiL21SWEFIa3F0SElDVEdydz09
SVJETlBPMzFMMzVyMjhYQzNxZ2N4dz09
dW5oZHVGOE1oNzA3YWVIVVJUdHJ4dz09
RlVsSWd6bE1WakF4STlHajlHeEkwZz09
eERRWjlJQjBMUW1LZm5RSzIvRzF2Zz09
aXVUMXkvamw1ZG94dVA3Ly9NRnJEUT09
Ym8wSjlBQThpTmUwYU45bkJhRk1CZz09
TmpoQTU2cTN0NVJKSVk1clZZaXJ6QT09
VGpQbWJ6a0xQaTh3YzlnMFptUEZ3dz09
MUdZL2R5akpPengyQ0tGOEpwaFRIUT09
R09oR3pCdms0emJCL3RCS2tSc1Nodz09
cldESWlvVGcxN0ZITVg4WnZ0c01oQT09
d3VQY2VKOXJvSVU4RXhmWjhnRmJjUT09
UU92UC9JQUZWdEZ5elYxazMrMEwxdz09
bFJhcFJmRUhEaXYycGdlODJmY1grZz09
SUVvUVRlcXRnVm5HVFZ0YmxpNEN0Zz09
Q2ZtTGpFRlYwbU15UlBrd0FSMmpGZz09
Z0tOV1VacjBrbHJYOHMxTEZKdmk4dz09
cU1QSkdDRzQ0c1NiUGZ5TkZOYTJVZz09
SUM5TVNjb0drRkllaGRMaUJ6U25LZz09
ejJDL0Y5ZVVMMFB3bVdFRmhhcUJPQT09
TVdhWnQxYVlzQTdpUDZ3Yk1hUG5YUT09
Wlgzc04xQU0rZWhqbnhTTEFWeUQzZz09
K25SVGR2NGhjbGUwN3ZrQ2FEV01xdz09
Rk9OSXpZZVZYYlVPZklpVnlSbnU3dz09
bXUwRXNveTF6bFJvWlF5VVA4MU9zZz09
cEtySDA4cjVEc1FldXgxSjhEekdSdz09
bmNKRStjZ2tjNURHQVZJWnNvV0JhUT09
WEZJbVI2cmt2dHVKME5JOW1mVmk4Zz09
MkdGMG5WblIyQ05YNGZVQWl6N1drQT09
UTZXTWF2STFadW1peWp4S1dCdDNRQT09
cHUyRnRWTjNKekxhRktmR1R3MzFoUT09
REtzbjVrci8vNjkwTHJWNDQ0SmxwZz09
NUZJWGRNQ0lubnB6SGFLRWt0TmhTUT09
b0xKTWpjVEFRWFVhakg5aDF2RU8xZz09
RXpaS3V4WnQ1SGJqY2ZqQnBaUEFJQT09
K2pmalJ0UFpDUzc3NmwrVTRZQzkrZz09
ZzF6cU1JbHIzWHpSMVEwQks0Nkdqdz09
OXREQWhCc0hIcmE3UlNEOUMyekhxUT09
aS94RE9yNm44MjUxVVFZV0NVS2oxZz09
ZHhQVHZYaTlpS3NpWlg2Z2xDSmNSUT09
QWtrak13TnZoa1FlYzUzd2xBcFdjZz09
Q3JhZ0Fra3VUMURGNmlkbEZQT3NUQT09
dFFPa1RHMnEzcWQ3cTBhTkxoUVc0Zz09
QWhuVW50MEYzOTBIK2krQkl2NS9Vdz09
Mk1NdWM4OWlsa3NybTBieFRFSG9CUT09
ZzdrQ2kyeDhaZjlzcitRNVlBdE91UT09
MStsZGVRSVovc2FFbnBUYWpsRGpvQT09
VUZVek9UTEdpSkxhRzFOT3owRWNmUT09
Q2ZGbGM2eGFOQVBmd3B1aDJsVjdxZz09
VnhVVWtTaHRqdnF5ZWpMamYyRiswZz09
Y09td21mWThMa3pYbHQwcWxvanNTZz09
Tm80bWM0RW5VTlU3MWhrL3pNYWZPQT09
ekMxdmRGQTlqZVVXVnRYU3poQ21Xdz09
RFFXcDFsSFNQUkV3K285MThmYXF0QT09
aDdDSUllWjRGWHZCdEFBYlRUV2U2QT09
dU01NW5LVkkzMTI2WWp0VVVvZnIydz09
MG5LZkhPL0pJN2d4ZCtWQmNDamZHUT09
dkFZNjRPQ243TXBwcWJaT25STy9uZz09
d1ZFTkIrcm13Vnp0b2JzSyttQU14Zz09
ZlYxTWc4N2laODJHejhDcVM3SGU2dz09
SGVUWXhjYjc1V0ZxOW5XaVpTNmRPZz09
aW9NQ09ORXp5RElEbEtreUVacnJDdz09
ZVVHTkUrQVlWK2s0ZG00VFd5UmVLZz09
T245dTZRQTk4NzFPQWNVdFJTSXFuQT09
bHRxaVpmalhBbEoramlUYUFUWjlTdz09
S0dtS0xKcG83ZzkyYzkzY1dwQlB4Zz09
eXlIUElFdmt5YnZpaThKMU5WSkdKUT09
bVFmZG0vemQrejd0RER5UUw2U0M5UT09
Nk8rZlQvWHpOL2RJM2d5TVA4NVNZUT09
RGZmaU1rUVRMNkpHeHhzZVpRV3J3dz09
ejc5cTNKV3FRVE5IalJaUzgxNUxGUT09
ZDk2cnpUc1E2Mm9kdC9zR1g2dmw5Zz09
clc0SmVKWmlhQllkaG9vZlRDdVM4Zz09
WFM1eDM0WG8wZUt2RC81WjJWUyttQT09
QUhZQmFqRHNRRWtyekxQbk1wTmx4UT09
aEprUm5xL1JQb2hsc0dHN2NocnNSdz09
M1RRbFJsWmR0TmtBa0VnQ3g5VVpTUT09
TFhPWUdkWFBQNU55MjJHbVNFNHhLdz09
MlozK0VnRWtBcG9tcnRGcEJDelZiUT09
alNjSytCUVRicTFvNE8rSUw1eHhWdz09
T1BYMTFOeU9Fb2liL0FIRXFvQTkyQT09
SklZekJNdjNIa1dsY2tYT1FkZEtwUT09
S20wWEl6bXlRQldVNGZtS2o0RUVQQT09
RjZSRkowRk1pZWdva1FpeEVYaGlGQT09
Q2tWeWJybENvMzRRZ0pSZ1FhR2lYQT09
TFZWTHMySWR6cFB5LzlPS0hYQzVWZz09
TGp4Slh2dy9BQjlncGd6ZjNXNllpQT09
WE5tbCtKTTEwV3ZJZnZQZ0puMkx4dz09
QmNGR21xcnpKOG1CV3VtV2R4OEs0dz09
dnkzQW1GZzVYeDBuelorZHBkWUZ1dz09

Title: How the hash/code in url is generated


问:
Bin format of H8300
I am trying to analyze some binary files that are supposedly from a H8300 processor. I found this question that mentioned objdump supports H8300 but when I use the command I get the following error:

objdump: can't use supplied machine h8300

I guess the files does not have the right format. From what I can see, they have the following format:

```<code>BeginLine
Address:HexData:ChecksumByte?
EndLine
</code>```

I also tried to export the HexData to a bin file but I still get the same error. What is the expected format?

Title: Bin format of H8300


问:
Manipulating Raw Stack Data without Local Variables and Function Parameters
Imagine a scenario where a program's stack data is corrupt and you need to diagnose the issue. How would you go about manipulating and analyzing the raw stack data without the use of any local variables or function parameters, considering the dynamic nature of memory addresses in the stack and the potential for data overwrites or corruption?

would you consider dumping the contents of the stack to a file or memory dump a useful process in analyzing the raw stack data and identifying any issues present?


问:
Ghidra view stack frame values
I'm learning reverse engineering, and I'm using Ghidra's debugger to analyze a running program. I want to view the values that are on the stack for a function, but I can't figure out how to do this.

I've tried to use the address in RSP to view the memory in the dynamic listing, but all I get is a section of memory that is grey with no values.

Example line from the dynamic listing:

```<code>      41dc0ef580 00              ??         00h
</code>```

I'm debugging a win32 application using the ghidra (v10.2.2) debugger with dbgeng locally via GADP on windows. Read visible memory is enabled in the dynamic listing, and there are no errors in the debug console.

How can I view the values for a all variables in the stack frame for a running function?

Title: Ghidra view stack frame values


问:
Is it no longer possible to re-order structures in IDA?
In older versions of IDA, you could right-click a struct in the structure view and change its position in the list, making it easier to separate "internal" vs "external" structs. In the new 8.2 version (free edition), I don't see that option anymore. Has that ability been removed, or is there a different way to do it?</p>


问:
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is KDNET.

I have mostly followed this guide: https://thecyberdung.blogspot.com/2018/10/kernel-debugging-with-windbg-and-idapro.html

I've noted that a lot of stuff isn't working properly:

net:port=<port number>,key=<enter_key_here> works, but when appending ,remote, IDA responds with "invalid connection string". That should work, though, according to IDA docs, if you choose "Kernel mode debugging with reconnect and initial break" in the debugger options. Choosing "Kernel mode debugging" and leaving the original connection string works fine.

After attaching and browsing modules, IDA does not correctly recognize some functions as code. If I force to interpret as code (pressing C) or manually define the function using "P", it messes up the whole control flow graph (every instruction becomes a basic block).

Decompilation does not work for some functions: either not able to convert to microcode or "stackframe is too big". It works fine when loading the module statically from disk.

The stack and memory dump windows only show "FFFFFFFFFFFFFFFFh" and I'm not able to synchronize them with any register (say RSP). Manual "go to address" does not work either. Locals window is always empty, no matter what function I currently breaked in. However, the general registers window shows the correct values consistently.

Stepping over a single instruction takes about ~6 seconds.

Did anyone encounter similar problems before?


问:
How to find audio loop data in Unity files?
I'm trying to extract audio assets from a Unity game. I can extract the .wav files with AssetStudio, but what I can't figure out is how to find the loop data. When I play the audio in AssetStudio's built-in audio player, the audio loops correctly, but I can't find the loop point in either the exported .wav files or the raw dump for the AudioClip files.</p>


问:
Using Hopper to flip branching instruction

Is it possible to flip branch instruction such as tbz to tbnz and b.ne to b.eq, I tried the hopper it gives syntax error

Is it possible to set a NOP on a bl or equivalent instruction using Hopper so the application stop executing.

Is it possible to do #1, and #2 using Frida runtime script?