问:
There is an implant in me, is there a way to identify the frequency it is receiving signals on?
There is an implant in me, is there a way to identify the frequency it is receiving signals on?

I don't want to share the evidence and my reasoning for believing there is an implant in me, you can either take my word for it or not.

I want to find the frequency it is receiving signals on, so far I have used dvb-t dongle to use it as an SDR, and I have manually scanned the entire frequency range provided by it, which is 24MHz to 1700MHz, which was very tiring, but I couldn't identify anything suspicious, it could be possible that as I was tuning, the frequency it was receiving signals on was not the tuned one.

I want to know if there a way to identify the frequency of the signal? How? And what equipment would I need?


问:
How to extract sound file from a small 1MB binary
I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at the sound files that the speaker uses, and replacing/deleting that data.

I had earlier asked a question about extracting this data and using the advise received, I've managed to successfully extract the memory of this speaker.

I'm now trying to analyse the extracted binary and find the sound files. But I haven't been successful.

The extracted binary is here:
https://drive.google.com/file/d/1e9yG8xMkZ331C2TOTOzo9Y93L4abxX9F/view?usp=sharing

The chip is XT25F08B. It's a 1 MB memory. I extracted the data over SPI0 and SPI3 interfaces multiple times (using an Arduino that i programmed for this purpose), and diff compared the outputs to ensure that I had the right data.

Also running strings command on the binary shows a long history of device names that I recognize as various phones / computers I use to connect to the speaker. This adds to my confidence that the extracted data isn't corrupted.

Looking at the binary in binvis.io shows:

There seem to be three chunks separated by unwritten memory.

According to binwalk(binwalk --disasm data.bin), the middle chunk (43KB starting at offset 991232) is ARM thumb code.

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
991232        0xF2000         ARM executable code, 16-bit (Thumb), little endian, at least 2500 valid instructions
</code>```

This chunk is actually filled with the device name history. I'm not sure why this would be ARM code, because the processor for the speaker is ATS2815 which is an integrated bluetooth audio processor, and it's datasheet doesn't seem to indicate any type of relation to ARM architecture, but I'm not sure.

Binwalk also thinks the last chunk (4KB starting at 1044480 and ending at the final binary address) contains ARM code about half way through.

The first chunk though is totally opaque to me. See the entropy image (also binvis):

Clearly the first chunk is either encrypted or compressed.
This is just a bluetooth speaker, what would you be protecting by encrypting though? Also the entropy isn't fully random, there are some subtle variations, indicating perhaps it's compressed. But I'm not sure.

Running binwalk -X data.bin seems to indicate that almost every second byte is a raw deflate compression stream!

```<code>...
41834         0xA36A          Raw deflate compression stream
41837         0xA36D          Raw deflate compression stream
41986         0xA402          Raw deflate compression stream
42290         0xA532          Raw deflate compression stream
42291         0xA533          Raw deflate compression stream
42300         0xA53C          Raw deflate compression stream
42510         0xA60E          Raw deflate compression stream
42543         0xA62F          Raw deflate compression stream
42758         0xA706          Raw deflate compression stream
42789         0xA725          Raw deflate compression stream
42920         0xA7A8          Raw deflate compression stream
42948         0xA7C4          Raw deflate compression stream
42967         0xA7D7          Raw deflate compression stream
43867         0xAB5B          Raw deflate compression stream
44226         0xACC2          Raw deflate compression stream
...
</code>```

And this goes on to pretty much till the last address. Does this mean that the whole file is compressed? Surely not, there are raw strings in the binary, so that can't be true.

So maybe just the first chunk is compressed?
But I haven't been able to decompress either. I've tried multiple methods to do so.
gunzip, unlzma, zlib-flate, unxz on both data.bin and an extracted-first-chunk-only bin.
But I end up with either "File format not recognized" or "Invalid header check" etc. errors.

I also tried disassembling the middle and last chunks.
https://onlinedisassembler.com/odaweb/K2AmuJIN
https://onlinedisassembler.com/odaweb/TcU2x8ZR

I chose arm as the architecture just to see, and you can see that the disassembly is peppered with " instruction: 0x...". Which likely means it's not the correct architecture and thus not the correct disassembly.

Where do I go from here? How do I penetrate the large opaque chunk of the binary. How do I decompress this? How do I disassemble the other chunks assuming they are code that the main processor loads.

Am I missing something obvious?

More than anything else though I'd like to get the sound files that the speaker uses.
I'm certain they are in this binary data here, since there is no other memory chip in the device, and the processor itself doesn't have enough ROM to keep such data.

ContentLicense: CC BY-SA 4.0


问:
How to decompile python ELF file (Compiled with Nuitka)?
I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and also tried unpyc37.

shell access to process is all I have. I can print variables and see values but how can I access functions code ?
or is there another way to extract codes ?


问:
Help me please decode the string (looks like gzip but it is not)
The software sends to the main server such string:

```<code>\x1f\xe2\x80\xb9\x08\x00\x00\x00\x00\x00\x04\x00E...\x03\x00\x00"

decode_gzip(body)
</code>```

Later I've tried to decode it through different online decoders and in python like bz2, zip and rar string - nothing.

What can I try next?


问:
What tools can be appropriate to reverse engineer a (open-source) java program?
I am very new reverse engineering, and have the below mentioned tasks to achieve on a open source program called Apache Ant. What (preferably free) tools can be appropriate to achieve these. I have been exploring Enterprise Architect for days and it has been pointed out to me it is not tool for such objectives.

Extract different source code metrics such as LOC, Comments, No of classes etc.

Extract abstract classes.

Extract function calls

Extract level of coupling between classes

Extract different type of associations in classes.

Extract different UML diagrams.

Detect Singleton and Factory Method design patterns.

Detect God Class and Lazy Class code smells.


问:
How to add Instructions (OpCodes) after a If Statement in C#?
I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement is at the end of a method and I want to add TraceUtil.TraceMethodExit(b); at the end, it ends up in the if statement, but it should be outside at the end. I use exactly the same Instructions which the compiler? produces, when I would manualy would put the TraceUtil.TraceMethodExit(b); at the end. But still mine ends up in the if statement body.

but it should look like this:

Here are what the compiler? produces:

```<code>IL_0000: nop
IL_0001: ldarg.1
IL_0002: stloc.0
IL_0003: ldloc.0
IL_0004: brfalse.s IL_0013
IL_0006: nop
IL_0007: ldstr "TEST"
IL_000c: call System.Void UnityEngine.Debug::Log(System.Object)
IL_0011: nop
IL_0012: nop
IL_0013: ldnull
IL_0014: call System.Void SEE.Utils.TraceUtil::TraceMethodExit(System.Object[])
IL_0019: nop
IL_001a: ret
</code>```

Here are what will be the output when I add the instructions:

```<code>IL_0000: nop
IL_0001: ldarg.1
IL_0002: stloc.0
IL_0003: ldloc.0
IL_0004: brfalse.s IL_001a
IL_0006: nop
IL_0007: ldstr "TEST"
IL_000c: call System.Void UnityEngine.Debug::Log(System.Object)
IL_0011: nop
IL_0012: nop
IL_0013: ldnull
IL_0014: call System.Void SEE.Utils.TraceUtil::TraceMethodExit(System.Object[])
IL_0019: nop
IL_001a: ret
</code>```

Here is the Code/Method to add the additional instructions:

```<code>private static void TraceZeroParameterMethodExit(ILProcessor iLProc, Instruction instr, MethodReference mRef)
        {
            MethodBodyRocks.SimplifyMacros(iLProc.Body);
            iLProc.InsertBefore(instr, Instruction.Create(OpCodes.Ldnull));
            iLProc.InsertBefore(instr, Instruction.Create(OpCodes.Call, mRef));
            iLProc.InsertBefore(instr, Instruction.Create(OpCodes.Nop));
            MethodBodyRocks.OptimizeMacros(iLProc.Body);
        }
</code>```

Does anyone have a idea how this could be solved? Maybe it has to do with the Offset? Thanks for any help!


问:
Cant hook into native lib with script?
im doing some practice stuff about hooking android native lib. I wrote this script:

```<code> function processJniOnLoad(libraryName) {
    const funcSym = "Java_com_mobisec_gonative_FlagChecker_helloFromTheOtherSide";
    const funcPtr = Module.findExportByName(libraryName, funcSym);

    const membase = Module.findBaseAddress(libraryName);
    console.log("Base address is " + membase);

    console.log("[+] Hooking " + funcSym + "() @ " + funcPtr + "...");

    Module.enumerateExports(libraryName, { onMatch: function(e) { console.log("type " + e.type + " name of function = " + e.name + " " + e.address); }, onComplete: function() { } });
}

function waitForLibLoading(libraryName) {
    console.log("loaded !!");
    var isLibLoaded = false;

    Interceptor.attach(Module.findExportByName(null, "open"), {
        onEnter: function (args) {
            var libraryPath = Memory.readCString(args[0]);
            console.log(libraryPath);
            if (libraryPath.includes(libraryName)) {
                console.log("[+] Loading library " + libraryPath + "...");
                isLibLoaded = true;
            }
        },
        onLeave: function (args) {
            if (isLibLoaded) {
                processJniOnLoad(libraryName);
                isLibLoaded = false;
            }
        }
    });
}
waitForLibLoading("libnative-lib.so");
</code>```

But it cant work (base address is null,...), here is the result:

```<code>loaded !!
/proc/self/cmdline
/data/app/com.mobisec.gonative-U8SZLMGh96sgK6qTGxmRqQ==/base.apk
/data/app/com.mobisec.gonative-U8SZLMGh96sgK6qTGxmRqQ==/lib/x86/libnative-lib.so
[+] Loading library /data/app/com.mobisec.gonative-U8SZLMGh96sgK6qTGxmRqQ==/lib/x86/libnative-lib.so...
Base address is null
[+] Hooking Java_com_mobisec_gonative_FlagChecker_helloFromTheOtherSide() @ null...
</code>```

But when i do that manually by typing all the command, its work:

```<code>[Google Pixel::com.mobisec.gonative]-> const membase = Module.findBaseAddress("libnative-lib.so");
[Google Pixel::com.mobisec.gonative]-> console.log("Base address is " + membase);
Base address is 0xc935a000
[Google Pixel::com.mobisec.gonative]-> Module.findExportByName("libnative-lib.so","Java_com_mobisec_gonative_FlagChecke r_helloFromTheOtherSide")
"0xc935a630"
[Google Pixel::com.mobisec.gonative]->
</code>```

So Why does my script failed ??

Title: Cant hook into native lib with script?


问:
Help with identifying 10pin chip
I've tried every possible combination of the markings of the chip but I can't seem to find anything on Google.

I think the chip is 96TI 35R but apart from that I can't find anything. It's like the chip doesn't exist :D

I think it's Texas Instruments.

Maybe the name is truncated but I only find the TI calculator

Title: Help with identifying 10pin chip


问:
where can i find decryption key inside of the dll file?
I am testing a dll file , in a C# console app , and by the looks of it the dll file sends a web request with encrypted and then encoded values to a remote server.

after intercepting and analyzing the request it seems like base64 encoding but when i try to decode it the result is totally unreadable so i am assuming that the string is first being encrypted and then encoded into base64 format and then sent to the server.

I opened the dll file in JustDecompile to find the encryption key , but i dont know where to start my search for the key , is there any hard and fast rule about the location of the key? or it could be anywhere inside the dll file? if so then whats the best possible method of finding the key or underlying encryption method ?

thanks in advance


问:
Help required to figure out the JTAG or UART pins
I have an old CDMA dongle lying around, so I thought to try to reverse engineer them, but am unable to figure out the UART or JTAG pins, I have attached a photo of the probable pins, can anyone help on how to confirm.
This is the link to the FCC website.
Thank you!
https://fccid.io/QISEC156/Internal-Photos/Internal-Photos-1419925


问:
Decompiling exe to python source code
I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part:

```<code>--- This code section failed: ---

 L. 128       0_2  SETUP_LOOP        13710  'to 13710'
              4_0  COME_FROM         13706  '13706'
                4  LOAD_FAST                'self'
                6  LOAD_ATTR                _Worker__abort
                8  LOAD_CONST               True
               10  COMPARE_OP               !=
            12_14  POP_JUMP_IF_FALSE 13708  'to 13708'
</code>```

Now my questions are:

What can cause such a decompiling error? The .exe is working.

What can I do to translate the rest of the failed decompiled byte-code to get the full source code?

Is there a place where I can find the construction of such byte-code to source code? Even though it would take a lot of time I could try to manually convert it.
Any tips or ideas?

Thanks for reading

Title: Decompiling exe to python source code


问:
Getting value of local variable in Ghidra
I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra.
So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the program to make it print the password if strcmp fails.

The password is stored in local_40

But I don't know how to patch the instruction to print out the value at local_40

Instead of MOV dword ptr [ESP],0x4b1050 what variable in this instruction should be edited? If my understanding is correct then the above instruction is loading the ESP register with the value at 0x4b1050
so how will I get the address of local_40?


问:
How can I extract working files (in the form of graphics) from these MZP executables?
There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the files, using tools such as Ravioli Explorer and Dragon Unpacker.

Here's where things get weird: Despite the files all ending in .rsc, changing the extension to .exe and opening it with various executable disassemblers (such as IDA) reveals that the files are in fact Pascal DOS executables  that match the New Executable (NE) Windows file format.

No idea why that's the case, and I have no idea what I can do with that information. I can't make heads or tails of the raw executable data, and I have no idea if it's even possible to extract working files from them. I know pretty much nothing about this topic, so help would be greatly appreciated.

I'll link a few of the files in question. If anyone wants to take a look at them and take a crack at it, I would be very grateful: RR2G.zip.


问:
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.

What is the performance bottleneck of the indexing step?

Some context:
Action in game that should take under 1 second took over 10 minutes with TT data collection, and produced over 80 GB run file. (input conditions not part of the question)

What exactly does the indexing do?

"Debug Engine Host Process" uses 37-41 % of the CPU, ~2 GB RAM, and 12-26 MB/s disk IO
It uses the all 32 CPU cores almost the same, so from that I assume it is well parallelized.
RAM usage is so low that it can be ignored, I assume.
Disk IO is also low 0-3% active time because it works on relatively fast NVME drive, with all 4 PCIe gen3 lanes directly from the CPU. This drive is less than 10% used capacity, so even if it would be in the part that is not always SLC, the cells would be in SLC mode, because of enough free space.

I am quite interested what are your thoughts about this, and if you think I can do something to make it faster, like some hidden option to use twice as many threads?


问:
The method of searching for similar code in a binary file of a new release
Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to find what a few functions from have turned into old.dll in new.dll. Below is an example of one of the functions. Please express your thoughts about my approach to finding a new version of the code: I started by using rdare2 to find all the functions in old.dll (more than 40 thousand), created a file with signatures and set it on a new file. In the end, nothing was found. I conclude that the changes are more than cosmetic. Next, I decided to search as follows:

I do a search on the pieces of the function code. I take the prologue before calling the function and look for this sequence of bytes in new.dll.

I try to find constants, strings, and other magic numbers that appear in the function and look for them in new.dll.

I analyze all the functions that call the desired function and try to find a similar set of calling functions in new.dll.

I try to determine the sequence of calling functions up to the very first (top) and find a similar sequence of calls in a new file.

I analyze all the functions that are called from the desired function and try to find a similar set of called functions in new.dll

Here I admit that all of the above did not help me. Next, I think that since there are such calls to call qword ptr [rax+18h] (there are 8 of them in the analyzed function), then these are probably calls to the methods of the object (s). You can probably find a vftable and understand what class these methods belong to and already make a set of classes.the method that is called in my function. Next, search in new.dll where such a sequence of methods from the corresponding classes is called.

You can probably try to find where the object was created and where this this came from in my function. Next, look for a similar trace in new.dll. Not sure if this method can be applied without debugging this dll. It is not clear how to run the dll because there are only three exported functions: DllGetLCID
PPMain
DllEntryPoint

Which of the listed search approaches is utopia, and which is not? Maybe there are more proven options?


问:
Reverse Engineering SNES adapter
A good "Hello world" for everybody here

I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4...
The thing is, this CLV-202 controller isn't working with the adapter, I've asked for a firmware update to Mayflash, and it seems they are not interested to update it.
I've spent a lot of money in both devices and I want to try to mod the firmware to make the controller work.
I've tested my CLV-202 in a Nintendo Wii, and its working flawless. This adapter (PC052) was made to work with a Wii classic controller (RVL-005), if you saw both pictures, you will notice that CLV-202 and RVL-005 looks very similar, mine have less 5 buttons to me to care about
*** End of my sad history ***

So, I must start from where?
How to create a "dump" file of this firmware to my PC? Is it possible to edit it (w/o the source code)?
I'm a 101% noob in this area, and have 0% idea in how to start... but I want to learn with you all

PS: I don't care if the "original intended" devices stop working after the mod, just want this CLV-202 controller working

Title: Reverse Engineering SNES adapter


问:
Reversing PYARMOR (?)

I have already decompiled an .exe file and reached to a .py but it is obfuscated using PyArmor.

I have already used ''https://github.com/nlscc/unpyarmor'' to try it, but could not figure it out how to use it correctly.
I've searched a lot for some tutorial video but could only find ways to obfuscate it. Not the reverse process.

Thx guys!

INFOS:

/ decompyle3 version 3.3.2

/ Python bytecode 3.8 (3413)

/ Decompiled from: Python 3.8.3

Title: Reversing PYARMOR (?)


问:
Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk.

Unpacking was succeed, but I can't find my target files. (CGI files in www folder)

When I connect to the web page of my router, I can see links include CGI file names.

But after unpacking, I can see only html files, I can't see CGI files.

I think only some files are unpacked with binwalk tools.

How do you think what's the problem?

Thank you


问:
How to find how a hash in generated in an iOS app
I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to hook on to general crypto functions, but nothing MD5 related seems to go on here. I've also hooked onto the CC_MD5 function, but it isn't displaying me the correct hash, so I'm guessing the app is using another library. I've had success with Android, as I can 1) see the source code with Jadx 2) Easily hook onto the MD5 class.

Any tips on how I can approach this? It would be greatly appreciated!


问:
How to find and read specific value in memory of running wine application?
How can I find and read specific values in memory of running WINE application?

I am experimenting with text editors, writing some string and trying to find it in the heap memory and changing it using a python script.

I tried using this code for finding and modifying the value in the memory of a native Leafpad (text editor) program running on Linux. and it works (the value in the heap changed).
However, when I try using the script on a WINE application (notepad.exe) it fails finding the value.

How come there is a difference between the WINE and the native Linux application?

What do I need to change in order to make the script work with WINE applications?

This is the script being used for location and modification of a value:

```<code>#!/usr/bin/env python3

from sys import argv, exit

def print_usage():
    """Print the usage string if script was used improperly"""
    print('Usage: \
        \t$ {} <pid> <string to read> <string to write>'.format(argv[0]))
    exit(1)

def read_write_heap(pid, read_str, write_str):
    """Find @read_str in the heap of @pid and replace it with @write_str"""
    try:
        maps_file = open("/proc/{}/maps".format(pid), 'r')
    except IOError as e:
        print("Can't open file /proc/{}/maps: IOError: {}".format(pid, e))
        exit(1)
    heap_info = None
    for line in maps_file:
        if 'heap' in line:
            heap_info = line.split()
            print("HEAP: ", line)
    maps_file.close()
    if 'heap' == None:
        print('No heap found!')
        exit(1)
    addr = heap_info[0].split('-')
    perms = heap_info[1]
    if 'r' not in perms or 'w' not in perms:
        print('Heap does not have read and/or write permission')
        exit(0)
    try:
        mem_file = open("/proc/{}/mem".format(pid), 'rb+')
    except IOError as e:
        print("Can't open file /proc/{}/maps: IOError: {}".format(pid, e))
        exit(1)
    heap_start = int(addr[0], 16)
    heap_end = int(addr[1], 16)
    mem_file.seek(heap_start)
    heap = mem_file.read(heap_end - heap_start)

    str_offset = heap.find(bytes(read_str, "ASCII"))
    if str_offset < 0:
        print("Can't find {} in /proc/{}/mem".format(read_str, pid))
        exit(1)
    mem_file.seek(heap_start + str_offset)

    mem_file.write(bytes(write_str + '\0', "ASCII"))

if (len(argv) == 4):
    pid = argv[1]
    search_str = argv[2]
    replace_str = argv[3]
    read_write_heap(pid, search_str, replace_str)
else:
    print_usage()
</code>```


问:
process crash handler in Frida
I'm trying to debug a crash in some process in iOS
frida-trace allows me to add handlers to specific functions, but I'd like to install a handler that prints the stack trace when the process crashes. How can I do it?</p>

Title: process crash handler in Frida


问:
RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum
I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features.
These vacuums are using the STM32F0 MCU, and when using a debugger to dump the firmware it turns out they are all using RDP1.

Through some digging, I found a public S3 bucket with various firmware images along with other resources.
Oddly, the newer generation vacuums referenced in the bucket have their firmware images without encryption/obfuscation. The binaries for the vacuums I am interested in all have a type of encryption/obfuscation that seems very weak. The thing is though, no matter how I try attacking it, I do not seem to get my rewards.

I say it is weak because there are decent size segments within the images that have 136byte strings that will repeat anywhere from 15 to 236 times depending on the image type. These repeating parts only repeat the same segment consecutively, and the string dose not occur again outside of the repeated segment. Some  of the smaller firmware images only have 2 blocks of repeating segments, other larger images may have up to six that I have seen.
Here is an example of one of the images.
Robot Vacuum Firmware

The first WORD is 0xEAAF4339, and is common to all of the images.
The second WORD seems to be a file type flag.
The third WORD is almost always equal to the image size minus 24 bytes.
The fourth WORD is always padding.
The fifth WORD is always 0x0403020F.
Starting at 0x4418 is the first segment of repeating 136 bytes.


问:
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.</p>

Title: Can i follow the invoke function?


问:
Windbg memory access error when trying to edit a string value of a button
So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using the command eb it gives me Memory Access Error. is there a correct way to do this trivial but complicated for a beginner task?
Thanks in advance

text:

```<code>
Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: E:\tests\rr\test.exe
FindTheBuild service not found
Symbol search path is: srv*
Executable search path is:
ModLoad: 00400000 0041d000   image00400000
ModLoad: 7c900000 7c9af000   ntdll.dll
ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
(6dc.43c): Break instruction exception - code 80000003 (first chance)
eax=00341eb4 ebx=7ffdc000 ecx=00000007 edx=00000080 esi=00341f48 edi=00341eb4
eip=7c90120e esp=0022fb20 ebp=0022fc94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> g
(6dc.1e8): Break instruction exception - code 80000003 (first chance)
eax=7ffdc000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120e esp=0097ffcc ebp=0097fff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:001>
0:001> s -w 00400000 0041d000 6d 66
00404042  006d 0066 0000 0042 0055 0054 0054 004f  m.f...B.U.T.T.O.
0:001> db 00404042
00404042  6d 00 66 00 00 00 42 00-55 00 54 00 54 00 4f 00  m.f...B.U.T.T.O.
00404052  4e 00 00 00 00 00 53 00-61 00 6d 00 70 00 6c 00  N.....S.a.m.p.l.
00404062  65 00 20 00 57 00 69 00-6e 00 64 00 6f 00 77 00  e. .W.i.n.d.o.w.
00404072  20 00 43 00 6c 00 61 00-73 00 73 00 00 00 70 18   .C.l.a.s.s...p.
00404082  40 00 55 6e 6b 6e 6f 77-6e 20 65 72 72 6f 72 00  @.Unknown error.
00404092  00 00 5f 6d 61 74 68 65-72 72 28 29 3a 20 25 73  .._matherr(): %s
004040a2  20 69 6e 20 25 73 28 25-67 2c 20 25 67 29 20 20   in %s(%g, %g)
004040b2  28 72 65 74 76 61 6c 3d-25 67 29 0a 00 00 41 72  (retval=%g)...Ar
0:001> eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00
                                                                 ^ Memory access error in 'eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00'
</code>```

program:

```<code>#ifndef UNICODE
#define UNICODE
#endif

#include <windows.h>
#include <windowsx.h>
#include <stdio.h>

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);

int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PWSTR pCmdLine, int nCmdShow)
{
    // Register the window class.
    const wchar_t CLASS_NAME[]  = L"Sample Window Class";

    WNDCLASS wc = { };

    wc.lpfnWndProc   = WindowProc;
    wc.hInstance     = hInstance;
    wc.lpszClassName = CLASS_NAME;

    RegisterClass(&wc);

    // Create the window.

    HWND hwnd = CreateWindowEx(
        0,                              // Optional window styles.
        CLASS_NAME,                     // Window class
        L"Learn to Program Windows",    // Window text
        WS_OVERLAPPEDWINDOW,            // Window style

        // Size and position
        CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,

        NULL,       // Parent window
        NULL,       // Menu
        hInstance,  // Instance handle
        NULL        // Additional application data
        );

    if (hwnd == NULL)
    {
        return 0;
    }

   HWND hwndButton = CreateWindow(
    L"BUTTON",  // Predefined class; Unicode assumed
    L"special_mf",      // Button text
    WS_TABSTOP | WS_VISIBLE | WS_CHILD | BS_DEFPUSHBUTTON,  // Styles
    10,         // x position
    10,         // y position
    200,        // Button width
    25,        // Button height
    hwnd,     // Parent window
    NULL,       // No menu.
    (HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE),
    NULL);      // Pointer not needed.

    Button_Enable(hwndButton , FALSE);

    ShowWindow(hwnd, nCmdShow);

    // Run the message loop.

    MSG msg = { };
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    return 0;
}

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    switch (uMsg)
    {
    case WM_DESTROY:
        PostQuitMessage(0);
        return 0;

    case WM_PAINT:
        {
            PAINTSTRUCT ps;
            HDC hdc = BeginPaint(hwnd, &ps);

            FillRect(hdc, &ps.rcPaint, (HBRUSH) (COLOR_WINDOW+1));

            EndPaint(hwnd, &ps);
        }
        return 0;

    }
    return DefWindowProc(hwnd, uMsg, wParam, lParam);
}

INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    PSTR lpCmdLine, INT nCmdShow)
{
   wWinMain(hInstance , hPrevInstance, lpCmdLine,  nCmdShow);
    return 0;
}
</code>```

compiling options with mingw:

```<code>gcc -m32 -w -mwindows test.c -o test.exe
</code>```


问:
Is this native code possible for further static analysis?
I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function works, the code of the function sUQWWyTBEs() decompiled with Ghidra:

```<code>*************************************************************
                             *                           FUNCTION
                             *************************************************************
                             undefined  __cdecl  Myapp_sUQWWyTBEs()
             undefined         w0:1           <RETURN>
             longlong *        x0:8           param_1
                             Myapp_sUQWWyTBEs XREF[2]:     Entry Point (*) , 00101350
        00100e44 08  00  40  f9    ldr        x8, [param_1 ]
        00100e48 01  00  00  b0    adrp       x1, s_c7a584936712f32773d3d0a_00101000           ; = "c7a584936712f32773d3d0a"
        00100e4c 21  60  08  91    add        x1, x1, #0x218
        00100e50 02  9d  42  f9    ldr        x2, [x8, #0x538 ]
        00100e54 40  00  1f  d6    br         x2
</code>```

in my understanding, I have made the static analysis as like following:

00100e44 08  00  40  f9    ldr        x8, [param_1 ]

load the value at memory address param_1 into register x8.

0100e48 01  00  00  b0    adrp       x1, s_c7a584936712f32773d3d0a_00101000

sets register x1 to 0x101000.

00100e4c 21  60  08  91    add        x1, x1, #0x218

adds 0x218 to x1, so it sets x1 to 0x101218.

00100e50 02  9d  42  f9    ldr        x2, [x8, #0x538 ]

loads the value at x8 + 0x538 into x2.

00100e54 40  00  1f  d6    br         x2

and finally branches to the  address stored in x2.

with that being said, Here I don't know the memory at address at x2, obviously it initially  depends on the value param_1 holds. is there way or how can I refer where param_1 was initialized? I don't know very much about usage of Ghidra or other reverse engineering tools. any one might help would be appreciated.

Edit: This function returns a string like this 47fjlkj843h9asjklj94kljfsad93j4l2715943hasd... but what I wanted is that how this value was generated or returned.


问:
ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)
As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. However, I'm determined to see this through, by god.

Here's what I've got so far:

The brain of the device is a NuMicro NUC126 (Cortex-M0) microcontroller. (datasheet)

The device also houses a BY25Q64ASSIG SPI NOR Flash (irrelevant?) (datasheet)

The firmware download is a single .bin file (available if requested).

The firmware is loaded to the device over USB via the (custom?) device-in-question vendor's ISP tool. (official non-vendor tool). Even the source is available for the ISP tool.

Output of binwalk -B: 97640 0x17D68 CRC32 polynomial table, little endian. Nothing else.

binwalk -E indicates no compression/encryption:

as does binvis.io:

strings indeed finds strings visible when using the device

dfu-util -l and dfu-util -d <VID:PID> doesn't appear to be able to find the device, which tells me that it does not utilize DFU. Even more likely, I'm just using it wrong. Perhaps the ISP tool puts it into DFU mode before flashing? I was hoping to perhaps extract the firmware this way.

Applied segment maps in IDA, aligned vectors, analyzed at reset vector, ???, no profit (yet).

My intentions:

The device comes with 3 "themes". I either want to replace/edit, or add more. The problem is, while I (think I) have disassembled the firmware correctly, as noted above, I don't know where to go from there.

Questions:

Since I feel like I'm (somewhat) close to a solution, is there something I'm missing? Reading assembly, sure. But I mean, are the themes simply bitmap style images? Are they vector? How would I know? After scanning the file using a resource extractor, it didn't find any embedded images. Though I'm curious as to whether disassembling the downloaded firmware would yield the same results as if I were to actually pull the firmware from the chip and disassembling it that way.

Is JTAG/UART absolutely necessary? The reason I ask is because practically all guides I've found utilize something similar. I've looked into OpenOCD, Segger, etc. and I'm really trying to avoid purchasing extra stuff, but will if necessary.

Thank you all for the help! If you require more information, please ask!


问:
Repacking vmlinux into zImage/bzimage
While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get over repacking the vmlinux into zImage/bzImage.

I extracted the kernel using extract-vmlinux (modified to show offset here):

```<code>$ ../../extract-vmlinux zImage > vmlinux
Found valid magic - decompressed using unlzma (tail -c+15967 "zImage" | unlzma)
Header at: head -c15966
Compressed at: tail -c+15967

$ binwalk zImage

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
15966         0x3E5E          LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: -1 bytes
</code>```

Next, without any modifications, I wanted to recompress it back and keep the header, as to my knowledge it has the decompression code:

```<code>$ cat <(head -c15966 zImage) <(lzma -z < vmlinux) > zImage-repacked
$ ls -l
-rw-r--r-- 1 user user 3032080 Jun  5 22:32 zImage
-rw-r--r-- 1 user user 3024065 Jun  6 00:04 zImage-repacked

$ binwalk zImage-repacked

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
15966         0x3E5E          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
</code>```

The image came ~8k short, which didn't worry me (as my compression might have been more aggressive). However the image is now broken:

```<code>$ ../../extract-vmlinux zImage-repacked > /dev/null
extract-vmlinux: Cannot find vmlinux.
</code>```

I also found that the extract-linux script pipes everything after the offset to unlzma but there's 9441 bytes of something which unlzma ignores. When removed I'm getting a pure archive which matches the size saved just after it:

```<code>$ tail -c+15967 zImage | head -c-9441 | unlzma > /dev/null ; echo $?
0
$ tail -c+15967 zImage | head -c-9441 | unlzma | wc --bytes
13871216
$ tail -c+15967 zImage | head -c-9437 | tail -c4 | od -i --endian=little
0000000    13871216
0000004
</code>```

I know the classical wisdom is "you have to recompile" but we're on RE - this is not possible ;)

How can I approach re-packing of the modified vmlinux back to LZMA-zImage?

Title: Repacking vmlinux into zImage/bzimage


问:
Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile
I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
20005546      0x13142AA       Uncompressed Adobe Flash SWF file, Version 50, File size (header included) 492522729
29002559      0x1BA8B3F       gzip compressed data, ASCII, has header CRC, has 19451 bytes of extra data, has comment, last modified: 2020-12-09 15:06:36
151223348     0x9037C34       LZMA compressed data, properties: 0x5D, dictionary size: -1091371008 bytes, uncompressed size: 2629435300301145041 bytes
154662425     0x937F619       Uncompressed Adobe Flash SWF file, Version 84, File size (header included) 692587800
157747503     0x967092F       MySQL MISAM compressed data file Version 10
158766212     0x9769484       MySQL MISAM index file Version 1
190759179     0xB5EC10B       LZMA compressed data, properties: 0x5D, dictionary size: -1956052992 bytes, uncompressed size: 1941629611387946799 bytes
203769284     0xC2545C4       Uncompressed Adobe Flash SWF file, Version 59, File size (header included) 1680641900
207505633     0xC5E48E1       Uncompressed Adobe Flash SWF file, Version 48, File size (header included) 1781182940
226976766     0xD8763FE       LZMA compressed data, properties: 0x5D, dictionary size: 603127808 bytes, uncompressed size: 2626171271486306996 bytes
237346339     0xE259E23       LZMA compressed data, properties: 0x5D, dictionary size: -1186856960 bytes, uncompressed size: 5193331955517265233 bytes
243780541     0xE87CBBD       Qualcomm device tree container, version: 1230904524, DTB entries: 2855478585
253201947     0xF178E1B       Uncompressed Adobe Flash SWF file, Version 67, File size (header included) 2522853576
267473318     0xFF151A6       Uncompressed Adobe Flash SWF file, Version 19, File size (header included) 2472055891
291443759     0x115F142F      Uncompressed Adobe Flash SWF file, Version 1, File size (header included) 1874015997
292915366     0x117588A6      Uncompressed Adobe Flash SWF file, Version 11, File size (header included) 3162630366
308191417     0x125EA0B9      Cisco IOS experimental microcode, for ""
319599114     0x130CB20A      Uncompressed Adobe Flash SWF file, Version 15, File size (header included) 3526619997
326306949     0x13730C85      LZMA compressed data, properties: 0x5D, dictionary size: -2117468160 bytes, uncompressed size: 163227338804047963 bytes
346510442     0x14A7546A      LZMA compressed data, properties: 0x5D, dictionary size: -851968000 bytes, uncompressed size: 2692117331713841249 bytes
350481505     0x14E3EC61      LZMA compressed data, properties: 0x5D, dictionary size: -1255473152 bytes, uncompressed size: 2851849894619330354 bytes
352437944     0x1501C6B8      LZMA compressed data, properties: 0x5D, dictionary size: -747634688 bytes, uncompressed size: 5173880095999022411 bytes
361964804     0x15932504      Uncompressed Adobe Flash SWF file, Version 32, File size (header included) 2191480467
392279284     0x1761B4F4      LZMA compressed data, properties: 0x5D, dictionary size: 753664000 bytes, uncompressed size: 5960100682697462886 bytes
402652160     0x17FFFC00      Linux EXT filesystem, blocks count: 59463283, image size: 60890401792, rev 1.0, ext4 filesystem data, UUID=9c665de0-9d83-42e0-bd1d-34377c027c02, volume name "data"
61339173326   0xE481981CE     Uncompressed Adobe Flash SWF file, Version 47, File size (header included) 2210144418
61566954532   0xE55AD2C24     Uncompressed Adobe Flash SWF file, Version 74, File size (header included) 4195364806
61684479138   0xE5CAE74A2     LZMA compressed data, properties: 0x5D, dictionary size: 1182859264 bytes, uncompressed size: 2804843589326703007 bytes
61968602376   0xE6D9DD508     Uncompressed Adobe Flash SWF file, Version 116, File size (header included) 3412781761
61975025774   0xE6DFFD86E     Uncompressed Adobe Flash SWF file, Version 68, File size (header included) 4194399919
61989984097   0xE6EE41761     LZMA compressed data, properties: 0x5D, dictionary size: -1768292352 bytes, uncompressed size: 6412360571714312808 bytes
62127752762   0xE771A463A     Uncompressed Adobe Flash SWF file, Version 59, File size (header included) 1211029814
62128958366   0xE772CAB9E     LZMA compressed data, properties: 0x5D, dictionary size: -732168192 bytes, uncompressed size: 8252619256980203060 bytes
62157149472   0xE78DAD520     Uncompressed Adobe Flash SWF file, Version 63, File size (header included) 196400005
62243597604   0xE7E01ED24     LZMA compressed data, properties: 0x5D, dictionary size: -1077280768 bytes, uncompressed size: 3052131975490100006 bytes
62291518645   0xE80DD24B5     Uncompressed Adobe Flash SWF file, Version 3, File size (header included) 3875421330
62297677360   0xE813B1E30     Uncompressed Adobe Flash SWF file, Version 32, File size (header included) 1215234504
62307467273   0xE81D08009     LZMA compressed data, properties: 0x5D, dictionary size: 73138176 bytes, uncompressed size: 4064746276382930044 bytes
62352081571   0xE847942A3     Uncompressed Adobe Flash SWF file, Version 15, File size (header included) 3906852731
62360383829   0xE84F7F155     LZMA compressed data, properties: 0x5D, dictionary size: -919535616 bytes, uncompressed size: 365108043805695494 bytes
62361701650   0xE850C0D12     LZMA compressed data, properties: 0x5D, dictionary size: -1233387520 bytes, uncompressed size: 9192010719985262417 bytes
62422697376   0xE88AEC5A0     Certificate in DER format (x509 v3), header length: 4, sequence length: 2135
62433792502   0xE895811F6     LZMA compressed data, properties: 0x5D, dictionary size: 1457455104 bytes, uncompressed size: 7640232335065180936 bytes
62442101297   0xE89D6DA31     LZMA compressed data, properties: 0x5D, dictionary size: -311820288 bytes, uncompressed size: 5017487224196718706 bytes
62454930003   0xE8A9A9A53     Uncompressed Adobe Flash SWF file, Version 67, File size (header included) 1982155663
62481583475   0xE8C314D73     Uncompressed Adobe Flash SWF file, Version 16, File size (header included) 842444556
62491210704   0xE8CC433D0     LZMA compressed data, properties: 0x5D, dictionary size: -847577088 bytes, uncompressed size: 4510595403222360816 bytes
62501270919   0xE8D5DB587     MySQL MISAM compressed data file Version 1
62509780600   0xE8DDF8E78     LZMA compressed data, properties: 0x5D, dictionary size: -1386545152 bytes, uncompressed size: 6470833901798277711 bytes
62512418763   0xE8E07CFCB     LZMA compressed data, properties: 0x5D, dictionary size: -1303838720 bytes, uncompressed size: 4354983803664832655 bytes
62521989084   0xE8E99D7DC     LZMA compressed data, properties: 0x5D, dictionary size: 1809252352 bytes, uncompressed size: 2877649210087158927 bytes
62557848557   0xE90BD03ED     TROC filesystem, 2142186800 file entries
62560802663   0xE90EA1767     Uncompressed Adobe Flash SWF file, Version 107, File size (header included) 1682702198
62570028905   0xE9176DF69     MySQL MISAM compressed data file Version 3
62622483906   0xE949745C2     LZMA compressed data, properties: 0x5D, dictionary size: 1844379648 bytes, uncompressed size: 2510853224060172728 bytes
62652341955   0xE965EDEC3     Uncompressed Adobe Flash SWF file, Version 76, File size (header included) 3659229454
62685042534   0xE9851D766     Uncompressed Adobe Flash SWF file, Version 82, File size (header included) 4015553640
62697798679   0xE99147C17     LZMA compressed data, properties: 0x5D, dictionary size: 146669568 bytes, uncompressed size: 4573553652826860487 bytes
62699810002   0xE99332CD2     PARity archive data - file number 20158
62710018947   0xE99CEF383     MySQL MISAM compressed data file Version 7
62712764124   0xE99F8D6DC     LZMA compressed data, properties: 0x5D, dictionary size: 65732608 bytes, uncompressed size: 7597355933296428476 bytes
62752875144   0xE9C5CE288     Uncompressed Adobe Flash SWF file, Version 14, File size (header included) 1623226578
62765338649   0xE9D1B1019     Uncompressed Adobe Flash SWF file, Version 73, File size (header included) 356137353
62796056623   0xE9EEFC82F     Uncompressed Adobe Flash SWF file, Version 75, File size (header included) 830595849
62818403584   0xEA044C500     MySQL MISAM index file Version 1
62826019514   0xEA0B8FABA     LZMA compressed data, properties: 0x5D, dictionary size: 289013760 bytes, uncompressed size: 8561962619585991282 bytes
62843673533   0xEA1C65BBD     Uncompressed Adobe Flash SWF file, Version 63, File size (header included) 1673895529
62861352275   0xEA2D41D53     MySQL ISAM index file Version 6
62865711780   0xEA316A2A4     Cisco IOS experimental microcode, for "H"
62871809229   0xEA373ACCD     Broadcom header, number of sections: 1811879010,
62872352509   0xEA37BF6FD     Uncompressed Adobe Flash SWF file, Version 46, File size (header included) 311816449
62912766971   0xEA5E4A3FB     HPACK archive data
62953561969   0xEA8531F71     LZMA compressed data, properties: 0x5D, dictionary size: 1124859904 bytes, uncompressed size: 6030422991665520964 bytes
62965416645   0xEA90802C5     LZMA compressed data, properties: 0x5D, dictionary size: -2059272192 bytes, uncompressed size: 9218576816601013656 bytes
62969008871   0xEA93ED2E7     LZMA compressed data, properties: 0x5D, dictionary size: -439615488 bytes, uncompressed size: 9125414184307085061 bytes
62973814276   0xEA9882604     Uncompressed Adobe Flash SWF file, Version 89, File size (header included) 4082792510
62988436106   0xEAA67428A     Uncompressed Adobe Flash SWF file, Version 106, File size (header included) 3241855911
</code>```

i did not know where this data is included... It may be here -    402652160     0x17FFFC00      Linux EXT filesystem, blocks count: 59463283, image size: 60890401792, rev 1.0, ext4 filesystem data, UUID=9c665de0-9d83-42e0-bd1d-34377c027c02, volume name "data"
So how can i extract it with binwalk or any other tool ? Did this block contains my data ?
Thanks in advance


问:
How to maintain function ordering in an executable when replacing machine code with C step by step?
I am working on reversing a DOS game consisting of 16-bit MZ EXE files. I was able to determine the exectuables were generated by Microsoft C v 5.10, and loading the signatures from the static libraries shipping with that compiler into IDA allowed me to identify standard C library functions within the executable.

I started out trying to rewrite the game in C++ on the side while analyzing the executables in IDA and the DOSbox debugger, but I ditched that approach due to the fact that it will take a long time before I have something operational, and I will probably make many mistakes along the way which will mean my implementation will either diverge from the original, or (more likely) be completely broken by the time I'm done.

The idea now is to reassemble the disassembly into working exe-s and replace the functions with equivalents written in C, which will keep me on track and also allow me to verify if my code is a 1:1 replacement for the original.

Question is, I understand that functions can move around in the executable both during building as well as the final linking. For GCC, I think it should be possible to enforce a specific layout of the binary with linker scripts, but the MSC compiler has no such feature, so my question is, is there some way of making sure my reassembled/recompiled binary puts the functions in the same order as the original, or is there a different approach I can take to verify conformity with the original despite the ordering discrepancies?


问:
Reversing Logitech G933 Battery Charge Values
I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give audible "low" and "critical" notifications every few minutes.

This notification goes on for several hours and I'd like to re-calibrate the software so that "low" and "critical" are properly defined at around 5% and 2% respective of the new battery's remaining capacity.

My google fu brought me to a configuration file (%AppData%\Local\Logitech\Logitech Gaming Software\settings.json) where these values are defined, but I cannot find anywhere that tells how to interpret the values (are they a standard unit of measurement?) or how to read them from the device manually:

```<code>"Critical" : 1623032924
"Low" : 1623022186
</code>```

I'm hoping there's some sort of USB reverse engineering techniques I can use to retrieve current values from the headset; this would enable me to get a full range of values from the new battery as reported by the headset, and I could then adjust the notification values accordingly.

If it helps, I'm familiar with Python but have zero experience with hardware or drivers.

Update: Upon some further thinking, my brain matter somehow deduced that these values might be Unix Epoch timestamps. I checked the current Unix Epoch time ('1623079890'), and sure enough, it fits right in...

I'm going to guess that these values are updated every time the headset is turned on? I'm not sure, but more testing is required. I'll keep this updated as I find out more.


问:
How can I flash unpacked firmware into Alcatel MiFi?
I bought Alcatel MW40V from Vodafone Shop some weeks ago and I can't access USSD Codes within Web UI.

```<code>Bus 001 Device 008: ID 1bbb:0195 T & A Mobile Phones Alcatel OneTouch L850V / Telekom Speedstick LTE

Software Version:   MW40_00_02.00_25
Device Name:    MW40
IMEI:   352491109846647
MAC Address:    f0:51:36:3d:2e:18
IP Address:     192.168.1.1
Subnet Mask:    255.255.255.0
</code>```

I'm facing annoying issues with preinstalled firmware and somehow I can't update normally and I know there were supposed to be updates pending.

Recently I unpacked firmware from IMG file with help of another post, but now I'm stuck and don't know what to do afterwards.

I tried to flash it with Alcatel TPST TPW like on Youtube video, but didn't work (Maybe because of ID mismatch).

Please help!


问:
C# Console Application can't load file or assembly, but needs a dll which doesn't exists?
I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the entry and exit of every method.

After I embedd it (the IL doesn't have any errors or warnings in it, when I inspect it with ILSpy) and try to run the Console Application it throws:

Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly   'System.Runtime
.Extensions, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its depende
ncies. The system cannot find the file specified.

Which is really strange, because Version = 4.2.2.0 doesn't even exists? Does anybody have a idea how this could be solved?

So when I try to give that Application any other Version of System.Runtime.Extensions this is thrown:

Unhandled Exception: System.IO.FileLoadException: Could not load file or assembly 'System.Runtime.Ext
ensions, Version=4.2.2.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencie
s. The located assembly's manifest definition does not match the assembly reference. (Exception from
HRESULT: 0x80131040)

I'm stuck and would be thankful for every help or idea to resolve this problem.


问:
Bypass Javascript Debug Prevention in Firefox
I've looked around, and can't find an answer for my specific question. The closest I could find was this.

I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger statement, preventing any meaningful use of breakpoints. The question linked above describes some methods for Chrome, but I was curious if this was possible in Firefox?


问:
How can I get a value from a memory address that changes almost every millisecond?
After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond.

ScreenShot:

I did a hardware breakpoint on that line MOV ecx, [DOSBox.exe+210BF4].

When the turn comes to that line, this memory address DOSBox.exe+210BF4 becomes holder to the target value and then the ECX register takes that value from it.

I am sure that the target value comes from this address but I don't know how can I get the value from that strange address. Is there a solution?


问:
Decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt?
Can I decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt? I am getting these packets from wireshark. I know that the IV might be at the front of the encrypted text and its size is probably 12 bytes but I don't know how to get it from the encrypted text.</p>


问:
Understanding the leap of logic in "Secrets of Reverse Engineering"
In Chapter 5 of the book "Secrets of Reverse Engineering" (by Eldad Eilam), the author goes about reversing an undocumented "table" API functions in the NTDLL library. The logic behind his reasoning in one particular function bothers me. Here is the relevant portions of the function:

```<code>RtlGetElementGenericTable:
7C9624E0        PUSH EBP
7C9624E1        MOV EBP, ESP
7C9624E3        MOV ECX, DWORD PTR [EBP+8]
7C9624E6        MOV EDX, DWORD PTR [ECX+14]
7C9624E9        MOV EAX, DWORD PTR [ECX+C]
7C9624EC        PUSH EBX
7C9624ED        PUSH ESI
7C9624EE        MOV ESI, DWORD PTR [ECX+10]
7C9624F1        PUSH EDI
7C9624F2        MOV EDI, DWORD PTR [EBP+C]
7C9624F5        CMP EDI, -1
7C9624F8        LEA EBX, DWORD PTR [EDI+1]
7C9624F8        JE SHORT 7C962559
7C9624FD        CMP EBX, EDX
7C9624FF        JA SHORT 7C962559
....
7C962554        ADD EAX, 0C
7C962557        JMP SHORT 7C96255B
7C962559        XOR EAX, EAX
7C96255B        POP EDI
7C96255C        POP ESI
7C96255D        POP EBX
7C96255E        POP EBP
7C96255F        RET 8
</code>```

From some other "table" functions, he surmises that the structure of the table must look like this:

```<code>struct Table {
    unknown_ptr    member1;    // This is non-zero when table has elements
    unknown_ptr    member2;
    unknown_ptr    member3;
    unknown_ptr    member4;
    unknown        member5;
    ulong          numberOfElements;
    unknown        member7;
    unknown        member8;
    unknown        member9;
    unknown        member10;
};
</code>```

Looking at the last 10 lines before the big jump (so from 7C9624EC to 7C9624FF), he comes up with the following conclusion:

Recall that EDX was loaded from offset +14 in the structure, and that
this is the member that stores the total number of elements in the
table. This indicates that the second parameter passed to
RtlGetElementGenericTable is an index into the table. These last two
instructions simply confirm that it is a valid index by comparing it
against the total number of elements. This also sheds some light on
why the index was incremented. It was done in order to properly
compare the two, because the index is probably zero-based, and the
total element count is certainly not.

It is this conclusion that I fail to understand, this leap of logic. I fail to see how the second argument is an index into the table. All I can see is that the final two lines of the code chunk translate into if (arg2+1 > numberOfElements) { return 0; } . Looking at it backwards it makes sense (i.e. a confirmation of the conclusion), but looking at it forwards makes no sense to me (i.e. from premise to conclusion). How was simply that conditional on line 7C9624FF indicate that the second argument must be an index and not something else? In other words, how did the author piece the evidence together into a logical high-level conclusion?


问:
Getting all instances of Local type in Ida
I create a local type in Ida and put in some places this local type.

How can I got all the references to dhat Local type?


问:
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.

```<code>int __fastcall SUB_XXXX(int a1)
{
  int result; // r0
  int (__fastcall *v3)(int); // r2

  result = 0;
  if ( *off_BD2561B0 )
  {
    v3 = *(int (__fastcall **)(int))(*off_BD2561B0 + 36);// off_BD2561B0 DCD dword_BD277D84
    if ( v3 )
      result = v3(a1);
  }
  return result;
}
</code>```

So,
v3 = dword_BD277D84 + 0x24 = 0xBD277DA8
Or
v3 = ValueAt(dword_BD277D84) + 0x24 ?

I'm kinda confused with off_* and dword_* thing.

Title: Understanding Hex-Rays syntax


问:
Checksum verification of an apk does not the same as my java program
I'm from the sysadmin side of the IT and have not much experience in programing.

I have an app that lets me screen share Android apps on my car's display.
Sadly there is a whitelist baked into the app, which prevents other apps (e.g. NewPipe) from running.
I tought I would try reversing it. The modification of the whitelist is easy (.json) but there is some checksuming of the whitelist involved.

I did a decompilation with jadx-gui and backsmali, tried to modify the smali code and recompile it again.
I did not know what exactly to change in the smali code, because I am not really familiar with it.
The method was try and error, but I always got errors.
So I thought I could alter the checksum for my modifyed whitelist, but that also did not work as intended.

I have extracted the code to run locally but the hash of the original file does not match the one, compiled into the apk and I'm not shure why

This is the jadx-gui reversed code snipped (exceptions removed):

```<code>    private boolean j() {
    InputStream inputStream = null;
    try {
        if (!"whitelist/whitelist".equals("whitelist/whitelist")) {
            throw new IllegalArgumentException("the whitelist path has to be \"whitelist/whitelist\", to access the dexguard encrypted file.");
        }
        InputStream open = this.b.getAssets().open("whitelist/whitelist");
        byte[] bArr = new byte[ACRAConstants.DEFAULT_BUFFER_SIZE_IN_BYTES];
        MessageDigest instance = MessageDigest.getInstance("SHA-256");
        while (true) {
            int read = open.read(bArr);
            if (read <= 0) {
                break;
            }
            instance.update(bArr, 0, read);
        }
        if (!String.format("%64s", new BigInteger(1, instance.digest()).toString(16)).replace(' ', '0').equals(this.b.getString(o.h.whitelist_checksum))) {
            Log.e("MS-LL:LiveServiceFact.", "Invalid whitelist!");
            if (open != null) {
                try {
                    open.close();
                } catch (IOException e2) {
                }
            }
            return false;
        } else if (open == null) {
            return true;
        } else {
            try {
                open.close();
                return true;
            } catch (IOException e3) {
                return true;
            }
        }
</code>```

The ACRAConstants.DEFAULT_BUFFER_SIZE_IN_BYTES is 8192 and the o.h.whitelist_checksum is 2131689879, which is not a SHA-256 string.

My checksum checker looks like this:

```<code>import java.io.File;
import java.io.IOException;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.InputStream;
import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

class checksum {

public static void main(String[] args) {
    try {
        InputStream inputStream = null;
        File file = new File("whitelist");
        int DEFAULT_BUFFER_SIZE_IN_BYTES = 8192;
        int whitelist_checksum = 2131689879;

        if (!"whitelist/whitelist".equals("whitelist/whitelist")) {
            throw new IllegalArgumentException("the whitelist path has to be \"whitelist/whitelist\", to access the dexguard encrypted file.");
        }
        InputStream open = new FileInputStream(file);
        byte[] bArr = new byte[DEFAULT_BUFFER_SIZE_IN_BYTES];
        MessageDigest instance = MessageDigest.getInstance("SHA-256");
        while (true) {
            int read = open.read(bArr);
            if (read <= 0) {
                break;
            }
            instance.update(bArr, 0, read);
        }
        System.out.println(String.format("%64s", new BigInteger(1, instance.digest()).toString(16)).replace(' ', '0'));
        if (!String.format("%64s", new BigInteger(1, instance.digest()).toString(16)).replace(' ', '0').equals(Integer.toString(whitelist_checksum))) {
            System.out.println("Invalid whitelist!");
        } else {
            System.out.println("correct whitelist!");
        }
    }
    catch (FileNotFoundException ex){System.out.println("File not found");}
    catch (NoSuchAlgorithmException ex){System.out.println("Algorythm not found");}
    catch (IOException ex){System.out.println("IOException");}
}
}
</code>```

But gives me d9821f5190db1b21aabc58da45a802b529148bb8a952760c0ca4a6330817f174 as checksum of the extracted whitelist and not 2131689879.
Where am I missing something?

Thanks in advance, Simon


问:
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:

```<code>mov     ecx, 11h
lea     edi, [esp+1208h+StartupInfo]
rep stosd
lea     eax, [esp+1208h+ProcessInformation]
lea     ecx, [esp+1208h+StartupInfo]
push    eax             ; lpProcessInformation
push    ecx             ; lpStartupInfo
push    0               ; lpCurrentDirectory
push    0               ; lpEnvironment
push    8000000h        ; dwCreationFlags
push    1               ; bInheritHandles
push    0               ; lpThreadAttributes
lea     edx, [esp+1224h+CommandLine]
push    0               ; lpProcessAttributes
push    edx             ; lpCommandLine
push    0               ; lpApplicationName
mov     [esp+1230h+StartupInfo.cb], 44h ; 'D'
call    ebx ; CreateProcessA
jmp     loc_100010E9
</code>```

However, when I use Radare I can't see the pushed arguments of the function called with ebx (on IDA I can see that it is CreateProcessA, but on Radare it is not displayed):

```<code>│ ╎╎│││││   0x10001179      b911000000     mov ecx, 0x11               ; 17
│ ╎╎│││││   0x1000117e      8d7c2434       lea edi, [var_44h]
│ ╎╎│││││   0x10001182      f3ab           rep stosd dword es:[edi], eax
│ ╎╎│││││   0x10001184      8d442424       lea eax, [var_54h]
│ ╎╎│││││   0x10001188      8d4c2434       lea ecx, [var_44h]
│ ╎╎│││││   0x1000118c      50             push eax
│ ╎╎│││││   0x1000118d      51             push ecx
│ ╎╎│││││   0x1000118e      6a00           push 0
│ ╎╎│││││   0x10001190      6a00           push 0
│ ╎╎│││││   0x10001192      6800000008     push 0x8000000
│ ╎╎│││││   0x10001197      6a01           push 1                      ; 1
│ ╎╎│││││   0x10001199      6a00           push 0
│ ╎╎│││││   0x1000119b      8d9424290200.  lea edx, [arg_195h]
│ ╎╎│││││   0x100011a2      6a00           push 0
│ ╎╎│││││   0x100011a4      52             push edx
│ ╎╎│││││   0x100011a5      6a00           push 0
│ ╎╎│││││   0x100011a7      c744245c4400.  mov dword [var_44h], 0x44   ; eflags
│ ╎╎│││││                                                              ; [0x44:4]=-1
│ ╎╎│││││   0x100011af      ffd3           call ebx
│ └───────< 0x100011b1      e933ffffff     jmp 0x100010e9
</code>```

I've tried Googling it but haven't found any solution to this. Am I missing some configuration or Radare practice that would display the argument and function names?

Edit: In case anyone wants to recreate it, I am trying to analize Lab7-03.dll from Practical Malware Analysis book, which labs can be found in the github:

https://github.com/mikesiko/PracticalMalwareAnalysis-Labs

Thanks in advance! =)


问:
Firmware RE (Beginner)
I'm trying to learn RE, and I thought I'd look at some firmware that interests me.  I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website

I found a few guides to get me started, and most seem to recommend binwalk.  Unfortunately, binwalk doesn't seem to return anything when I run it against the firmware file.  I ran the entropy analysis, and from what I've been reading, the firmware doesn't seem to be encrypted.

Running strings, I can find strings in the firmware image as well.  And binwalk -Y returned:

```<code>1189309       0x1225BD        ARM executable code, 16-bit (Thumb), little endian, at least 779 valid instructions
</code>```

I'm also looking at Ghidra, but I'm not sure where to start.  Should I try to unravel some of the instructions in Ghidra?  I don't think Ghidra is identifying the functions properly.  Is there a way to identify the entry point of the firmware program?  What are some avenues I should explore to get a starting point in analyzing this firmware?

Title: Firmware RE (Beginner)


问:
Decrypting .PNG files from Chinese mobile game
Amateur here.

I'm working on decrypting a couple of .PNG files extracted from an .apk of a Chinese One-Punch Man mobile game. They're identified as .PNGs by Windows, but can't be opened by any software. HxD shows me that they have no .PNG IDs such as "IHDR" or "IDAT", so I assume they're pretty encrypted (or they're not even PNGs???). Each one says "SSKOSISNIUBILITY" at the top, not sure what it means.

53 53 4B 4F 53 49 53 4E 49 55 42 49 4C 49 54 59

18 1C 18 1C 1C 1C 01 00 06 06 0B 13 09 02 11 00

I've tried a couple BMS scripts with quickBMS to no avail. Since the game is made by FingerFun I tried using a BMS script for one of their other games (KOF'98 UM OL) to no avail. Looks like I need to figure out what kind of encryption it is before I start throwing things to see what sticks.

Here's a few example files:
https://www.dropbox.com/s/imy674lcnzqcl9s/135.zip?dl=0

Any help would be appreciated. I'm pretty amateur when it comes to decryption, so just a BMS script or a name for the encryption style would suffice.


问:
Decompiling dll file to extract a function (subroutine)
I have a university project, and my professor gave me a DLL file which I need to extract a subroutine from, and it is not clearly defined as a subroutine. The purpose is to translate the code to C++ or C.

I opened the code with IDA Pro and searched for the name acalcul:

```<code>CODE:00470C9C aCalcul:                                ; DATA XREF: CODE:00470C0F↑o
CODE:00470C9C                 text "UTF-16LE", 'calcul',0
CODE:00470CAA                 align 4
CODE:00470CAC
CODE:00470CAC loc_470CAC:                             ; CODE XREF: CODE:0047094C↑j
CODE:00470CAC                 push    ebp
CODE:00470CAD                 mov     ebp, esp
CODE:00470CAF                 push    ebx
CODE:00470CB0                 push    esi
CODE:00470CB1                 push    edi
CODE:00470CB2                 push    dword ptr [ebp+8]
CODE:00470CB5                 xor     eax, eax
CODE:00470CB7                 push    ebp
CODE:00470CB8                 push    offset loc_470CDC
CODE:00470CBD                 push    dword ptr fs:[eax]
CODE:00470CC0                 mov     fs:[eax], esp
CODE:00470CC3                 mov     eax, ds:off_474634
CODE:00470CC8                 mov     eax, [eax]
CODE:00470CCA                 mov     edx, [ebp+0Ch]
CODE:00470CCD                 mov     [edx], eax
CODE:00470CCF                 xor     eax, eax
CODE:00470CD1                 pop     edx
CODE:00470CD2                 pop     ecx
CODE:00470CD3                 pop     ecx
CODE:00470CD4                 mov     fs:[eax], edx
CODE:00470CD7                 pop     eax
CODE:00470CD8                 xor     ebx, ebx
CODE:00470CDA                 jmp     short loc_470CE1
CODE:00470CDC ; ---------------------------------------------------------------------------
CODE:00470CDC
CODE:00470CDC loc_470CDC:                             ; DATA XREF: CODE:00470CB8↑o
CODE:00470CDC                 jmp     @System@@HandleAutoException$qqrv ; System::__linkproc__ HandleAutoException(void)
CODE:00470CE1 ; ---------------------------------------------------------------------------
CODE:00470CE1
CODE:00470CE1 loc_470CE1:                             ; CODE XREF: CODE:00470CDA↑j
CODE:00470CE1                 mov     eax, ebx
CODE:00470CE3                 pop     edi
CODE:00470CE4                 pop     esi
CODE:00470CE5                 pop     ebx
CODE:00470CE6                 pop     ebp
CODE:00470CE7                 retn    8
CODE:00470CE7 ; ---------------------------------------------------------------------------
CODE:00470CEA                 align 4
CODE:00470CEC ; [00000057 BYTES: COLLAPSED FUNCTION Mtsrdm::TMtsDataModule::AS_GetProviderNames(System::OleVariant &). PRESS CTRL-NUMPAD+ TO EXPAND]
CODE:00470D43                 align 4
CODE:00470D44
</code>```

I need to discover the inputs and the algorithm to do my project.
Now My Question is how can I extract a function by knowing its behaviour in IDA Pro with existing code?

Edit1: What I show from the code is an example, and I do not really know which part of code is really responsible for the functionality I am assuming.

Edit2:https://www.delicad.com/dl/FlashPolygons_32bits_en.zip
The link gives the whole  dll which I  want to find the part which draws a line using two points.


问:
Attempting to understand non-XZ file signatures within PBZX chunks
After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us that we're dealing with non-xz chunks.

I've tried to slowly rewrite Jonathan Levin's first pbzx extractor in Rust, the code I've written so far just reads out the flag of the file and each chunk's flag, length and signature (which for the most part should be the XZ header magic).

```<code>use std::io::{self, BufReader, Read, Seek, SeekFrom};
use std::fs::File;
use std::path::Path;
use binread::{BinRead, BinReaderExt};

#[derive(Debug, BinRead)]
pub struct block {
    flg: u64,
    len: i64,
    sig: u64
}

#[derive(Debug, BinRead)]
#[br(magic = b"pbzx")]
pub struct pbzx  {
    flag0: u64,
    chunk: block
}

fn main() -> io::Result<()>  {
    // Read file
    let file = File::open("payload.008")?;
    let mut reader = BufReader::new(file);
    // Apply it
    let header: pbzx = reader.read_be().unwrap();
    println!(" {:#04x}", header.flag0);
    // Zeroth block
    println!(" {:#04x}, {}, {:#04x}", header.chunk.flg, header.chunk.len, header.chunk.sig);
    reader.seek(SeekFrom::Current(header.chunk.len-8)).expect("Could not get current position!");
    // All the other blocks
    while (true) {  //
                    // I should actually be using "chunk.flg & ((1 << 24) | (1 << 23)) != 0" but I don't know
                    // where that's come from
                    // How does someone exactly calculate these bitshifts?
                    //
        let chunk: block = reader.read_be().unwrap();
        println!(" {:#04x}, {}, {:#04x}", chunk.flg, chunk.len, chunk.sig);
        reader.seek(SeekFrom::Current(chunk.len-8)).expect("Could not get current position!");
    }

    Ok(())
}
</code>```

Running it makes it behave as expected, showing us a majority of chunks being XZ but some others, especially at the beginning, show non-repeating values that don't seem to make much sense.

```<code>kitty@kitty ~/Projects/pbzx
> $ ./target/debug/pbzx
 0x800000
 0x800000, 8386152, 0xfd377a585a000000
 0x800000, 8388608, 0xf5278dda2c95573c
 0x800000, 8387764, 0xfd377a585a000000
 0x800000, 8388608, 0x7ec3ca75b21ecca8
 0x800000, 8377552, 0xfd377a585a000000
 0x800000, 8387576, 0xfd377a585a000000
 0x800000, 8388608, 0x2cb02061c42ec23b
 0x800000, 8388608, 0x94f8a22d86b5b145
 0x800000, 8388608, 0x7cf626aff7e56be6
 0x800000, 8388608, 0xd053c8e78ee64674
 0x800000, 8388608, 0xafac0d53e933e247
 0x800000, 8388608, 0xcc6c78f45ab958a5
 0x800000, 5815664, 0xfd377a585a000000
 0x800000, 3505580, 0xfd377a585a000000
 _____________repeating_______________
 0x800000, 4876720, 0xfd377a585a000000
 0x800000, 4761144, 0xfd377a585a000000
 0x800000, 4905372, 0xfd377a585a000000
 _____________repeating_______________
 0x51e0b5, 4568784, 0xfd377a585a000000
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Io(Custom { kind: UnexpectedEof, error: "Out of bytes in reader" })', src/main.rs:35:45
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
</code>```

Searching for them in Hex Fiend, they are confirmed to be non-repeating, adjacent to a valid chunk (see YZ end signature) and don't match any known signatures. I tried converting between endians and got nothing, just in case.

I can go out on a limb and say they're encrypted but that begs the question but then that begs the question, how do I confirm that it is encrypted before exploring that path?

Pudquick's version, modified with the new flag, goes ahead and treats it like a decompressed cpio chunk but gives me some valid chunks and some chunks containing unknown or no data, Levin's updated version, which I used about a year ago skipped those chunks altogether

```<code>-rw-r--r--  1 kitty  staff  388745580 May 12 19:10 payload.008
-rw-r--r--  1 kitty  staff    8386152 Jun 21 02:30 payload.008.part00.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part01.cpio
-rw-r--r--  1 kitty  staff    8387764 Jun 21 02:30 payload.008.part02.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part03.cpio
-rw-r--r--  1 kitty  staff   16765128 Jun 21 02:30 payload.008.part04.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part05.cpio
-rw-r--r--  1 kitty  staff          0 Jun 21 02:30 payload.008.part06.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part07.cpio
-rw-r--r--  1 kitty  staff          0 Jun 21 02:30 payload.008.part08.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part09.cpio
-rw-r--r--  1 kitty  staff          0 Jun 21 02:30 payload.008.part10.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part11.cpio
-rw-r--r--  1 kitty  staff          0 Jun 21 02:30 payload.008.part12.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part13.cpio
-rw-r--r--  1 kitty  staff          0 Jun 21 02:30 payload.008.part14.cpio.xz
-rw-r--r--  1 kitty  staff    8388608 Jun 21 02:30 payload.008.part15.cpio
-rw-r--r--  1 kitty  staff  288096620 Jun 21 02:30 payload.008.part16.cpio.xz
</code>```

How do you tell that a chunk of data is encrypted?

How did the original PBZX decompression tools figure out the binary operations to be performed on a flag to signal the archive's end? I couldn't figure out the relationship between 0x51e0b5 and 0x800000

If it was just a matter of comparing the flag, then wouldn't a while (flag == 0x800000) be enough, why bother with those values in the first place?

What would be a good next step in understanding what those magic values mean?


问:
How can I decode this Malicious php code?
I found this backdoor on a client's website.

https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)

I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?

Thanks!


问:
HTTPS post request not showing up in http debuggers
There is this program I'd like to debug of which I already have the source code.

When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http debuggers. I have tried Fiddler 4 and HTTP Debugger Pro so far. It also doesn't connect to any proxies. Also, the debuggers capture everything else, so they probably work.

Here is the C# code responsible for the request (the code itself works, but I may have modified some parts to post it here):

```<code>WebRequest webRequest = WebRequest.Create("url");
webRequest.Method = "POST";
webRequest.ContentType = "application/json";
byte[] bytes = Encoding.UTF8.GetBytes(("JSON DATA"));
using (Stream requestStream = webRequest.GetRequestStream())
{
  requestStream.Write(bytes, 0, bytes.Length);
  requestStream.Close();
}
WebResponse response = webRequest.GetResponse();
webRequest.GetRequestStream();
Stream responseStream;
using (responseStream = response.GetResponseStream())
{
  string end = new StreamReader(responseStream).ReadToEnd();
}
</code>```

Why are none of the http debuggers capturing the request? Any help is appreciated!


问:
How to find references for a string (where it is being called) in Go binary
I have a Go binary and I have this string:

When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references:

It might be because it is being load dynamically? If yes, is there a way to find the location statically?


问:
Tapping into Ford SCP BUS
I'm looking to tap into the Ford SCP BUS to display text onto my dashboard on my '01 Jaguar S-Type.

This car has a two row screen that displays the odometer, average fuel consumption - amongst other things. The radio also can display to this; when changing radio stations from the steering wheel controls it displays the frequency and (if supported by the radio station) the name of the station.

(not my photo, but this shows the cluster for reference. The screen is at the bottom in the middle.)

From what few things I have read online (as information about this infotainment system, or any from Ford in regards to this system), this uses the SCP BUS to communicate to the dashboard. Reading the electrical wiring manual for it, it shows all the possible codes that the SCP system can support, and it does show that command number 90 is "Download block to display command" sent from "AUDIO" ("Radio Head Unit" in the manual) to "MC" ("Message Center (part of instrument cluster)" in the manual).

My question is; how would I go about intercepting this data stream/command (using a Raspberry Pi, as this will be used in the final solution). Can I just splice two cables onto the existing harness and have them attach to the Pi, or would I have to include the Pi in the chain and forward any commands to and from the head unit to the rest of the network. Or,  better yet, does anyone know of any resources that I can find to construct these messages myself to save me from interpreting these messages and just directly attaching the Pi to the network, like it will be in the final setup.

(also don't be confused about me mentioning a Ford system in a Jaguar, this car was manufactured when Ford owned them, and it has a Ford motor, sound system etc.)

Title: Tapping into Ford SCP BUS


问:
Is it possible to Direct3D 9 debug DLL in an app using the release version
I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight.

Since online tools I have found are incompatible with my app (32-bit d3d9),
is it instead possible to use the d3d9d.dll (debug version), or somehow wrap the calls?


问:
WRT54GL firmware extraction via JTAG with OpenOCD and Raspberry Pi as interface. Can not dump because the device is not halted
Good day!

Sorry to come up with something very old. Since I am currently teaching myself hardware hacking, I wanted to use my old router for this. I soldered pins to the JTAG interface and connected them to my Pi2 GPIO. I connected them as follows:

Unfortunately, I cannot dump the firmware because the device does not want to switch to halt. Only time-out for halt request appears.

I have changed the freq, checked for cold solder joints. (I don't have any errors)

```<code>init
reset halt
JTAG tap: bcm5352e.cpu tap/device found: 0x0535217f (mfg: 0x0bf, part:
0x5352, ver: 0x0)
Halt timed out, wake up GDB.
timed out while waiting for target halted
TARGET: bcm5352e.cpu - Not halted
</code>```

Any ideas?


问:
Unknown binary format (.scp) - No Header
I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem to find any header to identify if it's compressed, etc. I'm no professional at reverse engineering and was wondering if anyone could help me decode this file, or maybe help get me started. Thank you, and help is appreciated!

Link to some example files, try anyone that you think would be a good start:
.SCP Files

Here is what it looks like in IDA if you are wondering:


问:
Improving Ghidra's Auto-Structure creator
I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed everywhere and has ~216 fields to it. It's far too large to manually figure out the structure of the struct (with my current ability), so I had Ghidra "Auto create structure" to define it.

The problem now is, I'm seeing weird behavior where the struct is used. For the initialization of the mutexes that it holds for example, prior to retyping, this is how the code looks in the decompilation window (__arg is a pointer to the newly calloced God-object):

```<code>undefined4 *god
. . .
pthread_mutex_init((pthread_mutex_t *)(god + 2),(pthread_mutexattr_t *)0x0);
pthread_mutex_init((pthread_mutex_t *)(god + 0x39),(pthread_mutexattr_t *)0x0);
pthread_mutex_init((pthread_mutex_t *)(god + 0x1c00f2),(pthread_mutexattr_t *)0x0);
</code>```

Which is ugly, but mostly makes sense. I'm assuming god + 0x39 is a reference to a field (although, god + 0x1c00f2 is a rather huge field offset) . The problem is, when I retype the field to be of type God (the auto-generated type), it changes to this:

```<code>God *god;

pthread_mutex_init(&god->mutex1,(pthread_mutexattr_t *)0x0);
pthread_mutex_init(&god[1].mutex1,(pthread_mutexattr_t *)0x0);
pthread_mutex_init((pthread_mutex_t *)&god[0x8258].field_0x28,(pthread_mutexattr_t *)0x0);
</code>```

My best guess as to this weird result is the struct was created improperly. If I go around to different functions where it's used and have Ghidra attempt to create a struct, the size of the struct changes every time (although, it's always around 210-230 fields).

Is there anything I can do to improve Ghidra's auto-creation of the struct? And am I correct that the array-access notation suggests an improper creation of a struct?


问:
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:

Any idea how to unpack it?


问:
Patches are not applying after saving in X64dbg
I'm new to this and I used X64 debugger for a short while

The thing is , I was testing the security for some software (for educational purposes only!) and finally I found a way break into it , but when I save the work and changes don't apply !

The part where the arrow points in the image never change form je to jne:

Any idea why ?


问:
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:

I set a breakpoint in IDA debugger

the program stop at the breakpoint

deactivated the breakpoint

IDA keep receiving SIGTRAP or SIGSEGV

( program stop at breakpoint as expected ) :

( deactivated the breakpoint and continue execution ) :

( and the SIGTRAP or SIGSEGV goes on and on till program stop, and the adb shell shows)  :

```<code>Error: Oops! internal error 30060 occurred.
</code>```


问:
Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?
I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary.

The reason is I'm trying to understand what sort of sensitive information can be extracted from the binary other than just running strings on it. I know the header files used to compile the binary contain information that is sensitive but I can't determine if that information is visible (or even included?) or not when the binary ships out.


问:
Handle Ioctl call while running with qemu
I am using qemu to emulate a binary like this

qemu -strace XXXXX .

I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages

```<code>Get and set terminal attributes
      TCGETS Argument: struct termios *argp
              Equivalent to tcgetattr(fd, argp).
              Get the current serial port settings.
</code>```

And after those 2 syscall the process got SIGSEGV.

Is there any simple way to handle those syscall so the process continues without a segfault?


问:
How does one go about reverse-engineering obfuscated/minified JavaScript in a browser like you would code in an IDE?
I am trying to figure out how some minified and possible highly-obfuscated JavaScript works. There are thousands of lines spanning multiple JS files. I have had a lot of success debugging it in my Chromium browser using dev tools and local overrides where I can refactor code without losing it on the next page load.

What's giving me problems are all the anonymous functions and types that look they were transpiled from TypeScript. They look like this:

```<code>var main = {
    someFunction: function(a,b,c,d,e) {
        //do a ton of stuff here
    },
    anotherFunction: function(d,e,f,g,h,i) {
        //even more stuff
    },
    someProperty: { json object with more members }
}
</code>```

If that were a class/object in .NET in the Visual Studio IDE, I would have all kinds of tools to help me figure out how such an object is built, all the places its members are referenced, etc. With a dynamic language like JavaScript, though, regular browser debuggers lack the information needed to give me that kind of insight into the code. Therefore, when I need to see where a property is initially set, there's no way to look for all the places it's referenced. You can use CTRL+F, but, if there are multiple objects with the same property names, it's not a very effective approach.

If I had the debugging power of an IDE such as Visual Studio, it would make reverse engineering this code so much easier. How can you make debugging JavaScript just as straight-forward?


问:
Basic Block generated by IDAPython code are different compared to BN generated output file
I have a query regarding different BB count using two different tools.

I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to produce the same result as number of BB's and number of instruction in each BB etc. and address as well.

When I compared my result with the one already generated by the BN tool, they are different. Number of BB's are almost 1000 less compared to BN.

May anyone guide me to understand the issue? Regards.


问:
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version.  I was very eager to see the 64-bit version, but sadly that never came to pass.  I abandoned reverse engineering for a while, but now I would like to pick it up again and continue learning.  So my question to the experts is whether there is a 64-bit successor to the 32-bit Ollydbg.

Alternatively, what tools do you all use to reverse engineer 64-bit programs?

Title: Is there a clear Ollydbg successor?


问:
Need help understanding the flow of a python script on github repository
OpenDroneMap is an open source command line toolkit to generate maps, point clouds, 3D models and DEMs from drone, balloon or kite images, here's their github link OpenDroneMap/ODM

Was pointed out to a file ODM/blob/master/stages/odm_app.py, which seems to have the Initializes the application and defines the ODM application pipeline stages.

How to I go about understanding the the entire process flow of the entire pipe line?

I understand that UML (Unified Modelling Language) can be used as a first step.

What would be the best approach?


问:
Capturing created and deleted files from a Java file
I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java file.

I am using Flare7 and am not able to import any tools due to how we have the environment set up.
Are there any tools that can capture these files?

I know DirWatch can save on modification but these are not being modified, also the source code is encrypted or encoded so I can't just search for the file string.

If anyone could help that would be appreciated! Thank you!


问:
ZKM 15 Deobfuscation (Jar file)
Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me.
I am willing to pay money for this.

I mostly just need Strings from the jar file. It doesn't need to be perfect.

Add me and message me on discord:
Bryside#0001

Title: ZKM 15 Deobfuscation (Jar file)


问:
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't really make out what is going on. For example, the output of uf nt!KiSystemService has this in the middle of it:

```<code>nt!KiSystemService+0x10b:
fffff803`66e07acb e80e010000      call    nt!KiSystemService+0x21e (fffff803`66e07bde)
fffff803`66e07ad0 4883c408        add     rsp,8
fffff803`66e07ad4 e80e010000      call    nt!KiSystemService+0x227 (fffff803`66e07be7)
fffff803`66e07ad9 4883c408        add     rsp,8
fffff803`66e07add e8eeffffff      call    nt!KiSystemService+0x110 (fffff803`66e07ad0)
fffff803`66e07ae2 4883c408        add     rsp,8
fffff803`66e07ae6 e8eeffffff      call    nt!KiSystemService+0x119 (fffff803`66e07ad9)
fffff803`66e07aeb 4883c408        add     rsp,8
fffff803`66e07aef e8eeffffff      call    nt!KiSystemService+0x122 (fffff803`66e07ae2)
fffff803`66e07af4 4883c408        add     rsp,8
fffff803`66e07af8 e8eeffffff      call    nt!KiSystemService+0x12b (fffff803`66e07aeb)
fffff803`66e07afd 4883c408        add     rsp,8
fffff803`66e07b01 e8eeffffff      call    nt!KiSystemService+0x134 (fffff803`66e07af4)

Goes on for many many more lines...

</code>```

I'm pretty sure anyone who has poked around ntoskrnl.exe has seen these types of calls before, but I'm not really sure as to what's happening. Is there any explanation as to what kind of C code can cause this kind of ASM code to be compiled, or is this something else from handwritten ASM that's been linked into the executable?


Title: Cocos2d xxtea game lua decrypt

Body:
How can I use the 16 byte xxtea byte as python
I found the password directly but I want to change the bytecode of the password with 16 bytes as in the picture

```<code>_BYTE *__fastcall sub_D4CA64(__int64 a1, unsigned int a2, __int64 a3, _DWORD *a4)
{
  unsigned int v4; // w25
  unsigned int v5; // w27
  int v6; // w22
  _BOOL4 v11; // w26
  _DWORD *v12; // x20
  __int64 v13; // x8
  __int64 v14; // x9
  __int64 v15; // x13
  char v16; // w12
  int v17; // w11
  _QWORD *v18; // x0
  _DWORD *v19; // x21
  int v20; // w8
  __int64 v21; // x9
  int v22; // w10
  __int64 v23; // x12
  int v24; // w10
  __int64 v25; // x8
  unsigned int v26; // w9
  unsigned int v27; // w12
  unsigned int v28; // w13
  __int64 v29; // x14
  __int64 v30; // x15
  unsigned int v31; // w16
  int v32; // w0
  __int64 v33; // x1
  int v34; // w16
  int v35; // w17
  __int64 v36; // x24
  _BYTE *v37; // x23
  _BYTE *v38; // x0
  __int64 v39; // x8
  __int64 v40; // x8
  int v41; // w9
  __int64 v42; // x10
  unsigned int v43; // w11
  _BYTE *v44; // x13
  unsigned int v45; // w12
  unsigned int v46; // w11
  int v47; // w9
  char v48; // w11

  v4 = a2 >> 2;
  if ( (a2 & 3) != 0 )
    v5 = v4 + 1;
  else
    v5 = a2 >> 2;
  v6 = 4 * v5;
  v11 = (a2 & 3) != 0;
  v12 = malloc(4 * v5);
  memset(v12, 0, 4 * v5);
  if ( a2 )
  {
    v13 = 0LL;
    v14 = 0LL;
    do
    {
      v15 = (unsigned int)v14 >> 2;
      v16 = v13 & 0x18;
      v13 += 8LL;
      v17 = (*(unsigned __int8 *)(a1 + v14++) << v16) | v12[v15];
      v12[v15] = v17;
    }
    while ( 8LL * a2 != v13 );
  }
  v18 = malloc(0x10u);
  v19 = v18;
  v20 = 0;
  v21 = 0LL;
  *v18 = 0LL;
  v18[1] = 0LL;
  do
  {
    v22 = *(unsigned __int8 *)(a3 + v21);
    v23 = 4LL * ((unsigned int)v21++ >> 2);
    v24 = (v22 << (v20 & 0x18)) | *(_DWORD *)((char *)v18 + v23);
    v20 += 8;
    *(_DWORD *)((char *)v18 + v23) = v24;
  }
  while ( v21 != 16 );
  v25 = v5 - 1;
  if ( v5 != 1 )
  {
    v26 = -1640531527 * (0x34 / v5) - 1253254570;
    if ( -1640531527 * (0x34 / v5) != 1253254570 )
    {
      v27 = *v12;
      do
      {
        v28 = (v26 >> 2) & 3;
        v29 = v4 + v11 - 2;
        v30 = v5 - 1;
        do
        {
          v31 = v12[v29];
          v32 = ((v31 >> 5) ^ (4 * v27)) + ((16 * v31) ^ (v27 >> 3));
          v33 = v30;
          v34 = v19[v30 & 3 ^ v28] ^ v31;
          v35 = v12[v30--];
          v27 = v35 - (v32 ^ (v34 + (v27 ^ v26)));
          --v29;
          v12[v33] = v27;
        }
        while ( (_DWORD)v30 );
        v27 = *v12
            - ((((v12[v25] >> 5) ^ (4 * v27)) + ((16 * v12[v25]) ^ (v27 >> 3))) ^ ((v19[v28] ^ v12[v25]) + (v27 ^ v26)));
        v26 += 1640531527;
        *v12 = v27;
      }
      while ( v26 );
    }
  }
  v36 = (unsigned int)v12[v25];
  v37 = 0LL;
  if ( (unsigned int)v36 >= v6 - 7 && (unsigned int)v36 <= v6 - 4 )
  {
    v38 = malloc((int)v36 + 1);
    v37 = v38;
    if ( !(_DWORD)v36 )
    {
      v40 = 0LL;
LABEL_27:
      v38[v40] = 0;
      *a4 = v36;
      goto LABEL_28;
    }
    if ( (_DWORD)v36 == 1 )
    {
      v39 = 0LL;
    }
    else
    {
      v41 = 0;
      v42 = 0LL;
      v39 = (unsigned int)v36 & 0xFFFFFFFE;
      do
      {
        v43 = v12[(unsigned int)v42 >> 2];
        v44 = &v38[v42];
        v42 += 2LL;
        v45 = v43 >> (v41 & 0x10);
        v46 = v43 >> (v41 & 0x10 | 8);
        v41 += 16;
        *v44 = v45;
        v44[1] = v46;
      }
      while ( v39 != v42 );
      if ( v39 == v36 )
        goto LABEL_26;
    }
    v47 = 8 * v39;
    do
    {
      v48 = v47 & 0x18;
      v47 += 8;
      v38[v39] = v12[(unsigned int)v39 >> 2] >> v48;
      ++v39;
    }
    while ( v36 != v39 );
LABEL_26:
    v40 = v36;
    goto LABEL_27;
  }
LABEL_28:
  free(v12);
  free(v19);
  return v37;
}
</code>```