问:
beginner hardware sniffing question
this is not going to be a specific question but here goes.

Ive just started reading about reverse engineering for the 3ds. Is it possible to open the 3ds up and connect a probe somewhere on the chip and dump the RAM contents? Im looking for data on game mechanics etc.

Im new to this so I could have wrongly understood the process. If anyone could perhaps explain the process to me for a general system not a 3ds (if that is easier), what equipment I would need and what exactly I would need to do to dump the ram contents.

Also if there are any resources for beginners that you recommend can you post them here please?
I should say that I program in c and I am looking to learn reverse engineering as a hobby.

Title: beginner hardware sniffing question


问:
Unpacking Inno Setup installers with InnoExtractor?
I want to know how to use the application InnoExtractor to unpack/extract the files of Inno Setup installers. Some good tutorial/video to learn?

I get this application from here.

ContentLicense: CC BY-SA 3.0


问:
How to change the export function name of android so file (ELF format)
Here are my .so files:

libJlcVideoEncoder.so

java_so_change.exe

Below are export functions inside .so files:

Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit

Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcVideoEncoder

In Java project, I define the function like this and call (using JNI call):

```<code>package com.jlc.BubbleChat;

public class libJlcVideoEncoder
{
   static {
      System.loadLibrary("JlcVideoEncoder");
   }
   private native int JNIJlcInit();
   private native int JNIJlcVideoEncoder(byte[] camdata,byte[] stream,int qp);

   public int JlcInit() {
       return JNIJlcInis();
   }
   public int JlcVideoEncoder(byte[] camdata,byte[] stream,int qp) {
       return JNIJlcVideoEncoder(camdata, stream, qp);
   }
}
</code>```

But, I want to change the export function:

Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit to myInitFunc.

Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcVideoEncoder to myEncoderFunc.

So, I opened any so file and edited the function name in winhex.
But it does not work.

And, there are no other files that import this so file. the problem is that after changing the function name, loadlibrary is success but can't find address of export function.

Editing export function name does not work. Do you know the reason ?

Or, somewhere there is checksum check when android load so files ?

I do not want  decompile or modifying. My final aim is to call the original function with different name.


问:
IDA Signatures for OpenSSL
This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through OpenSSL. For the ones who are familiar, sometimes is even possible to identify which version of OpenSSL implements these algorithms (example string: RAND part of OpenSSL 0.9.7 31 Dec 2002).

IDA Pro seems unable to identify such functions as library function and this complicates the analysis because you can't distinguish between interesting code and OpenSSL library code.

Is anyone aware about FLIRT signatures or IDA scripts that can ease this job?

Title: IDA Signatures for OpenSSL


问:
How is the tp-link switch firmware obfuscated?
I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.

There are three versions available on their webseite: 2012, 2013, and 2014 variants. The first thing one notices: The 2012 and 2013 versions are about 4 MB, while the 2014 is 2 MB. So we have to assume, that the 2014 one is compressed (or compressed with something better).

binwalk does not show anything useful, really. All the firmware blobs are incompressible, so they're likely obfuscated/encrypted.

Comparing the (hopefully alike) 2012 and 2013 ones with xdelta3 shows, that only a very few 4byte thingies are identical in the two blobs (they're at different positions though). And they don't seem to be of any use.

Is there any information available on the obfuscation employed?


问:
crackme binary crashing on Raspberry pi
I was trying out a basic ARM crackme here. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is there some gdb/ARM quirk that I should be aware of? This has happened on an earlier occasion too with another CTF challenge.

I do get the feeling that my questions is incomplete -- however, I'm not sure what additional information I could provide to help diagnose the problem. If you could let me know what additional information is required, I could update the question with that.

Some output :-

```<code>$ file arm_crack1
arm_crack1: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, BuildID[sha1]=0xbb39a930c55e6d62c7cc083bb94567adcfe5cc3b, stripped
$ ldd arm_crack1
    not a dynamic executable
</code>```

Title: crackme binary crashing on Raspberry pi


问:
IDA Pro not showing structures, even when they're defined
I have this kind of code:

I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of:

```<code>if(mainStruct->something & 2)
</code>```

I see:

The offsets 0x364, 0x370, and 0x374 are also reversed and each one has the size that IDA wants (0x374 is a db, 0x364 and 0x370 are dd)

Is there any way to fix it? Thanks!


问:
Set up an interrupt handler at kernel mode
I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to run some code, and then resume the operating system execution, letting me access information on the pre-interruption context afterwards.

Following some advice, I've tried the well-known Intel Pin (a binary instrumentation framework), only to discover that in fact, it can only operate at user-level, while I need to access kernel mode. After some research, I've then found some interesting threads in this group, namely this and this. Currently, my doubt is which tool is best suited for my needs. I'm leaning towards DynamoRio Kernel (DRK), but besides the other frameworks/tools mentioned in both threads, I found some more that seem to somewhat relate to what I'm looking for, namely Valgrind, GILK (although this is pretty deprecated, so it's not an option) or QEMU.

The thing is, I'm a newbie in the area, so probably some of the tools I've mentioned in the last paragraph don't even apply to what I'm looking for. Can someone help me in choosing the best framework for my purposes?


问:
Flashing NVRAM with U-Boot 1.2.0
I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write:

```<code>tftp 0x80000100 nvram.bin
cp.b 0x80000100 0x007b0000 0x00050000
</code>```

There is no error shown after cp.b command, just not allow to write. What can be the problem?
Flash memory structure, from U-Boot 1.2.0 printenv:

```<code>Serial Flash [Bus:0 CS:0] : s25fl064a 8192KB, 128 sectors each  64KB
7 cmdlinepart partitions found on MTD device spansion
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }
partitions[1] = {.name = env1, .offset = 0x00020000,.size = 0x00010000 (64K) }
partitions[2] = {.name = env2, .offset = 0x00030000,.size = 0x00010000 (64K) }
partitions[3] = {.name = firmware_EH, .offset = 0x004a0000,.size = 0x002d0000 (2880K) }
partitions[4] = {.name = nvram, .offset = 0x007b0000,.size = 0x00050000 (320K) }
partitions[5] = {.name = UBFI1, .offset = 0x00040000,.size = 0x003b0000 (3776K) }
partitions[6] = {.name = UBFI2, .offset = 0x003f0000,.size = 0x003b0000 (3776K) }
Creating 7 MTD partitions on "spansion":
0x00000000-0x00020000 : "U-Boot"
0x00020000-0x00030000 : "env1"
0x00030000-0x00040000 : "env2"
0x004a0000-0x00770000 : "firmware_EH"
0x007b0000-0x00800000 : "nvram"
0x00040000-0x003f0000 : "UBFI1"
0x003f0000-0x007a0000 : "UBFI2"
</code>```

Title: Flashing NVRAM with U-Boot 1.2.0


问:
CRC with OR but seed differ every time the protocol restart
It's some days I'm trying to understand how this protocol works without any success. I need some help.

Basically I'm sniffing an UART signal. 115200 8N1
I understood what's happening under the hood of the protocol. It is based on xor. Here are a couple of examples:

```<code>A0 82 00 01 02 14 81 6A 76
A0 82 00 02 02 14 81 6A 75
</code>```

As you can see the 01 to 02 change is reflected to 76 to 75. The data is xor-ed nibble to nibble.

Here's come the problem. The day after I turn on the system and I made another acquisition. Surprise the Checksum change. Apparently also the way the crc is calculated differ because not the bit to change are 2 and 3 of last byte.
the data changes from D0 => DC while before it was from 76 to 75.

```<code>A0 82 00 01 02 14 81 14 D0
A0 82 00 02 02 14 81 14 DC
</code>```

Actually, I discovered that in the full transmission I have a single message that is changing every time. It is a 5 byte message in the format:

```<code>A0 07 0B 40 44
A0 07 EA 1B 58
</code>```

The 2 messages just posted was taken from the 2 transmission taken before.

I think that the two A0 messages sends some type of CRC feed and some way for calculating it. Second strange thing, I don't understand what kind of CRC is applied in the first message. It looks strange that the message who need to fix a CRCc base seed is non CRC'ed.

Do somebody have some idea on what protocol could be? Something similar?


问:
Is there any technique called "DLL Replacement"?
I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) with a malicious DLL.

How does this work and are there any other techniques to do it?


问:
How to get frame sync signal from a GoPro Dual HERO System sync cable?
I need to frame sync a GoPro Dual HERO System with an external data logger. So the main problem is to get the HERO frame synchronization signal (I guess there must be one in the cable) from their system. Can someone help here?

I guess some degree of reverse engineering could be done just by listening to the cable wires when both cameras capture synced video? I am a very new to electronics so please excuse my simplicity. There is a forum thread about GoPro Dual Hero cable reverse engineering.


问:
Where can I find ollydbg 2.1
I've seen a few references to ollydbg 2.1.0.4, but the official ollydbg website only has version 2.01. Can someone point me to a download for it? Can't find it googling either...</p>

Title: Where can I find ollydbg 2.1


问:
What are the commercial anti reversing techniques?
I am interested in knowing about what are the latest commercial packages that are out there that deter reverse code engineering. And how do I work around them if necessary ? To be more specific I am talking about ASProtect how do I work around it ?</p>


问:
Merging static library into mach-o executable
I got a mach-o executable and a static library that has a few __attribute__((constructor)) functions.

Is there a (least painful) way to merge the static library into the mach-o executable ?


问:
Creating shared object library to switch out loaded methods
Is it possible to create a dynamic library libXXX.so with android ndk that has a function that switches out methods in loaded classes in the dvm and call it from any apk ?

There are functions within libdvm.so to find loaded classes that could be used. Is this not as useful as I think it is or am I missing how difficult it is ?

The only example I found of someone doing this is explained in this blog post:

Android hacking: replacing system classes methods with your own, by Andrey Petrov.


问:
Suddenly unable to load exe into OllyDbg - process terminates before execution
A week ago, I've loaded an app into Olly, as an exercise and out of curiosity. It has been successfully loaded and I've found out that there's no protection of any kind applied (all strings are "plaintext", no anti-debugging techniques, simply nothing).

Today, I wanted to come back to said program and suddenly I'm unable to load it into Olly - even before Olly starts its analysis (the bar in the bottom of the window), the process terminates and I land in ntdll.dll.
If run without a debugger, the exe works fine - there seem to be no problems.

I'm really puzzled because since then I've made two changes to my PC:

Installed Nod32 4 (disabled it, nothing changed)

Downloaded WDK 8.1 from this page:
http://msdn.microsoft.com/en-us/windows/hardware/gg454513.aspx (uninstalled, didn't help either)

I've also tried this on another PC which hasn't been even powered on for the last month and is basically a clean Win7 install, still to no avail.

At the first glance, this probably looks like battling a TLS Callback protection, but as I said, I'm certain the exe has no protection at all, as I've been able to play around with it a couple days ago.

Are there any 'common' causes for such behavior?


问:
IDA sp analysis failed
I am trying to reverse engineer a DLL file, but I am getting this warning when it's loaded:

As well, then on some of the functions error appears sp analysis failed like on this picture:

Is it possible to get code from that function ?

Once in pseudo code, there is only ";" inside the function. Parameters do match.

Title: IDA sp analysis failed


问:
VLAs in C++ - seemingly nonsential compiler code
I've been wondering, why all the hassle with variable length arrays (such as int x[n])? Theoretically, it's just another local variable, so it's merely a matter of subtracting the appropriate value from ESP.
This question - and excellent answer - at StackOverflow: https://stackoverflow.com/questions/1887097/variable-length-arrays-in-c has cleared things up a bit.

However, I was curious to see what code would be generated by compilers. I've tried MSVC 2013 and MinGW 4.8.1, with the latter successfully compiling the code and the former refusing to cooperate. The C++ (well actually C, but compiled with g++) code is as follows:

```<code>#include<stdio.h>

int main()
{
    int size;
    scanf("%d", &size);

    int array[size];
    array[0] = 0xBEEF;

    printf("Done with the arrays!\n");
    return 0;
}
</code>```

This will be compiled to the following assembly code (diassembled with Olly 1.10, but also tried IDA and got the same results):

```<code>(some main( ) initialization)
LEA EAX,[LOCAL.5]
MOV DWORD PTR SS:[ESP+4],EAX
MOV DWORD PTR SS:[ESP],tesst.00403064        ;"%d"
CALL <JMP.&msvcrt.scanf>
MOV EAX,[LOCAL.5]
SUB EAX,1
MOV [LOCAL.3],EAX
ADD EAX,1
SHL EAX,2
LEA EDX,DWORD PTR DS:[EAX+3]
MOV EAX,10
SUB EAX,1
ADD EAX,EDX
MOV ECX,10
MOV EDX,0
DIV ECX
IMUL EAX,EAX,10
CALL tesst.00401C60
SUB ESP,EAX
LEA EAX,DWORD PTR SS:[ESP+8]
ADD EAX,3
SHR EAX,2
SHL EAX,2
MOV [LOCAL.4],EAX
MOV EAX,[LOCAL.4]
MOV DWORD PTR DS:[EAX],0BEEF
MOV DWORD PTR SS:[ESP],tesst.00403067
CALL <JMP.&msvcrt.puts>
MOV EAX,0
MOV ESP,EBX
LEA ESP,[LOCAL.2]
POP ECX
POP EBX
POP EBP
LEA ESP,DWORD PTR DS:[ECX-4]
RETN
</code>```

To me, this code looks redundant and absurd, at times, to be honest. Why do we LEA EAX+3 to EDX just to add it a couple lines later, without altering EDX in any way? Why MOV EAX to ESP-0C (LOCAL.3) if it's not used at all later? And, of course, what's with the MOV ESP, EBX and then LEA ESP,EBP-8 immediately after?

And most of all, why all the hassle? Wouldn't it just have been enough to do something like this:

```<code>LEA EAX,[LOCAL.5]
MOV DWORD PTR SS:[ESP+4],EAX
MOV DWORD PTR SS:[ESP],tesst.00403064     ; "%d"
CALL <JMP.&msvcrt.scanf>
MOV EAX,[LOCAL.5]
SHL EAX,2       ;multiply times 4 - sizeof int
SUB ESP,EAX    ;memory is allocated, all done
</code>```


问:
Weird self-modify instruction
Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address:

```<code>DD address1
DD address2
DD myfunction
DD adress4
.. AND SO ON
</code>```

Where addressN are other function. Thinking that it was the routine that bother me I just fill with NOPs DD myfunction, but after restarting the process (and loosing the NOPS) Olly show me.

```<code>DD address1
DD address2
POP ESP
INC EBP
...others instruction like the one above
DD address4
DD address5
... so on
</code>```

And, when I hit F9 it just return to the DD myfunction shape ... I cannot understand what's going on, hope you can help me.

Title: Weird self-modify instruction


问:
Page Fault Handler in Windows
Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.

When a Page Fault occurs and nt!KiTrap0E comes to save the day, the CPU saves the current state, then it pushes the EIP of the faulting instruction and an error code on the stack (32 bits on x86, 64 bits on x64, but only bits 0, 1 and 2 are relevant here) and loads CR2 with the referenced virtual address?

So, when we are in KiTrap06 the stack looks like this:

```<code> EIP of faulting instruction

 error code
</code>```

Is this right?

So if I have the following code in user mode:

```<code>LPVOID address = VirtualAlloc(NULL,
        1024,
        MEM_COMMIT,
        PAGE_READONLY);
*(PDWORD)address = 12;
</code>```

When the EIP will reach *(PDWORD)address = 12 (well, actually it will probably be mov address, 0x0B, but let's simplify things) a Page Fault will occur, the CPU will save the current state, will push the EIP of that assignment, then an error code will be pushed on the stack (bits 2, 1 and 0: 1 (user process) 1 (tried to write a page) 1 (and caused a protection fault) ), and load CR2 with the address allocated with VirtualAlloc? The handler will check the error code and the Read\Write byte from PDE (upper 10 bits of CR2) and/or (??) PTE (middle 10 bits of CR2), see that an attempt to write to a read only page was made and will terminate the faulting process?

If the page was writable but not loaded (last 3 bits of error code: 110) the handler will use the value from CR2 to bring the page into memory and the faulting instruction will be re-executed?

ContentLicense: CC BY-SA 4.0

Title: Page Fault Handler in Windows


问:
How does iOS hash and salt passwords on its secondary-storage?
I bought a used iPhone from someone, but I accidentally got a lock screen on the phone and can't figure out what the passcode is. Long story short, how does iOS hash the passcodes for entry, what kind of salt/etc. does it use, where would it store it, and is it possible to mount the internal drive (I'm guessing SSD?) where it stores the passcode?

Anyone familiar with iOS reverse engineering? Coding/development? Can one mount the whole filesystem and copy the files/decrypt/reverse engineer/view them/hex edit them/etc. (the files of the hashed/encrypted passcode)? I am all up for this 100%; just need some people more familiar with iOS to set me in the right direction.

Why other alternatives aren't good enough:

Can't factory restore; all very important data will be lost that was not backed up.

There's no way to bypass the lock-screen on this iOS version. Only way would be to determine where it stores the hashed/cryptographic passcode on the disk and figure out what it is to re-gain entry.

To be blunt, I'm striving to password crack my own device. On Android this is easy, but I have heard of absolutely no one getting this done with iDevices/iOS.


问:
Debug Android Native Code without source
Id like to debug (to log function calls) native ARM Android Code in a shared library. So far I got no source and tried to disassemble it with IDA, but its hard to track all the calls down to a specific function.

So I came up with IDA's android_server, which didnt work(not breaking on breakpoints, pausing takes me always to the same loop, cant step through) and Android NDK's gbdserver using as remote GDB Debugger in IDA based on that http://forum.xda-developers.com/showpost.php?p=35602033&postcount=5 which results in the same. Using NDK's gdbserver and cli gdb didnt work, cause it requires the (source) project folder.

Thats why Id like to ask if there is  a way to debug native code w/o source or tracking down the calls is possible?

(in this case nearly all of the app runs on native code/the funcs Id like to track arent called directly over JNI)


问:
Accessing debug log on Java application
I'm currently reverse engineering a JSP applet running through JBoss. Decompiling the code it looks like there are a bunch of Logger.debug() calls in the code that aren't guarded. A quick read through the API and I didn't see where this output actually goes or if it's even accessible, but since I'm pretty new at REing Java stuff I figured being able to see the log messages being printed as the application is running would go a long way to figuring out code flow.

Is there an easy way to read debug output from the running application? I saw JavaSnoop referenced in another Stack Exchange post and I'm probably going to explore that but I didn't know if there was an easier way. All I want to do for now is try to get a handle on how to interact with the parts of the application.

Or if there's a better way to go about it that would be appreciated as well. What I'm looking at is a Java SE binary so tracing that to the servlets is the end goal.

Thanks.

Title: Accessing debug log on Java application


问:
How to include these exception handle symbols in x86 assembly code?
The test is on 32bit x86 Linux, with g++ 4.6.3.

So basically I use a IDA pro script to recover the .gcc_excpt_table and .eh_frame sections from binary compiled from C++ language.

Basically I want to reuse the dumped information of these two exception handling tables in a new assembly code disassembled from this C++ ELF binary.

I put these two tables into the assembly code produced by disassembler, solving all intra-module address issue (basically translate concrete addresses into symbols) and re-compile it like this:

```<code>g++ final.s
</code>```

However, there are three symbols that can not be found or I just don't know how to define it.

_Unwind_Resume are undefined

__FRAME_END__ are undefined

It seems that eh_frame requires the beginning address of .plt table, but is there anyway to get the beginning address of .plt table during compiling? I know I can use the symbol _GLOBAL_OFFSET_TABLE_ to represent the beginning address of table .got.plt, but after a quick search, I just don't know whether there is a similar symbol representing .plt table.


问:
Map virtual addresses to physical addresses
I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it to a right physical address?

Let's take for example VA 0x30000 on an x86 non-PAE Windows system. Splitting it into 3 groups we have

0000000000 | 0000110000 | 000000000000

Page Directory Index = 0x0

Page Table     Index = 0x30

Physical Offset      = 0x0

We get PD's physical address from CR3 and discover that it's PDE has the Present bit cleared.
Is it possible to write in physical memory (at pd[pdi]) a valid PDE (in essence, set the Present bit) and then traverse all the tables (marking entries as present) and finally had the VA to be valid for a certain PA so that future attempts at translating it will be successful?
Can one even write directly to a physical address from a kernel module?


问:
Basic Concept misunderstood?
First of all, it may be that I am just not getting how things work. Stultus sum.

I am using a Mac with OSX (10.9), therefore with x86_64 architecture.

I wanted to play around a bit with compilers and decompilers. I grabbed a random application from my computer and decompiled it using Hopper Disassembler.

Well, nice. I now got my assembly code. First thing I noticed was that you can't just "edit" this code from within Hopper. I guess that's because, if I would edit something, the addresses would go wrong altogether - which would damage the application.

From this point, I tried some different things:

I exported the code ("File > Produce Assembly Text File").

I extracted nearly the same code with gobjdump.

I decompiled the executable using otool.

However, the code I received with these techniques is more or less the same. How do I recompile that assembly code so I got my modified executable? Being able to read the assembly code is sure an interesting thing, but a bit useless, no? :/

So, what do I need to do to get compile-able assembler code?! Is this even possible or do I need to patch the existing executable?

Title: Basic Concept misunderstood?


问:
Unknown game data compression method (Gamecube)
I got some game compression data which I couldn't find any clue.
All compressed file signature start with: [SK_ASC] and unknown compression method.

I got some information from RAM/Executive file but still didn't work.
I think the compression is the lossless format (But it's not a LZO nor ZLIB).
Can anyone help me figure out the compression, and how to decompress?

All of example file above can be found here: http://goo.gl/JJQfl4

=== 10.25.14 ADDED ===

The list below compression method that I tested, but doesn't match:

LZ10

LZ11

LZ77

LZO1x-1

LZO1x-999

LZSS

LZW

LZMA

HUFF blocksize 4 & 8 byte

RLE

ZLIB

=== 10.26.14 ADDED ===

Today I analysis something via memory dump.

First of all, compressed EMnMenu.cmp file could be loaded when I enter the main menu by guessing it's file name. and there are very similar files which is unused. (EKisokMenu.cmp, EE3Menu.cmp)

So I try to check memory dump by replacing file each other. and I got dump_menu.ram, dump_e3menu.ram, dump_kioskmenu.ram. By comparing three different ram dump data,
I found out only specific offset data is changed.

By using this method, I finally got a decompression data dumped via offset: 0x80CA6980. Decompressed data is well known texture which was first 4 byte signature  start with 0x00 0x20 0xAF 0x30. (check texture format here: http://goo.gl/UqLz3m)

I try to find compression algorithm by compressing the decompression data and compare with original data. but non of algorithm that I test above doesn't match.

Anyway, I uploaded several decompressed data via ram dump and compressed data so you can check here: goo.gl/JJQfl4

CMP is a compressed data which always start with SK_ASC.

BIN is a same as CMP.

DCMP is a instant copy from memory file, which was extracted from offset 0x80CA6980.

DMP is a data value correction by subtracted 0x80CA6980 because there so many memory scrapping dummy (so this is the cleaned decompressed data if I guess right)

ADDED Didn't work with regular deflate/zlib all compress level.

== 11.09.14 ==

I posted several forum to help, but no clue for weeks :(

http://zenhax.com/viewtopic.php?f=9&t=313&sid=3172c154c5da95476795ac742501fec1

http://encode.ru/threads/2074-Identifying-compression-method?p=41188&posted=1#post41188

== 11.15.14 ==

Other forum user said to me there are Gamecube DOL (executive file) plugin for IDA.
So I use them and now I've found decompression main/algorithm subroutine.
Would anyone help me find out describe how it works?

(I'm not well in dis-assembly, So I'm learning now)

http://goo.gl/2bQNfj

Power PC based Dis-Assembly skill Required


问:
How to turn a .dll file into a .exe file for ollydbg?
I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears :

```<code>    File 'C:\..........\Conficker.exe' is a Dynamic Link Library. Windows can't
    execute DLLs directly. Launch LOADDL.EXE ?
</code>```

(notice: as you can see, the mentioned dll file is a sample of Conficker)
In a analysis paper about Conficker, they wrote the following:

```<code>    After unpacking, we find that the UPX packed binary file is not the original code
    but incorporates an additional layer of packing. We use IDA Pro to remove this
    second layer of obfuscation and dump the original code from memory.
    To do so, we first run the Conficker service, snapshot the core Conficker library
    as a memory image, and from this code segment reconstruct a complete Windows
    executable program. The program requires a PE-header template,
    and we compute an entry point that allows the program to enter Conficker's code
    segment.
    (source : http://mtc.sri.com/Conficker/)
</code>```

Honestly, although I want to learn all that things, I didn't understand what they try to explain or how one can reach that. The only thing what I understand, that they somehow turn the dll into a "complete Windows executable program".
So, I search in the inet and I found this:

```<code>   We all have our own methods for debugging DLLs, and my personal choice is to modify
   the DLL bit flag to turn it into an EXE to the eyes of the debugger
   Among other PE editors, CFF Explorer from ntcore is a tool that allows to do that.
   (source: http://blog.fortinet.com/post/the-art-of-unpacking-conficker-worm)
</code>```

So, I have downloaded CFF Explorer but I dont know how to "modify the DLL bit flag to turn it into an EXE." Although I search in the inet for that I couldnt find anything about that.

Can somebody help me?

best regards,


问:
Why the extracted content differs?
I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I got the same squashfs-root directory. I compared content of both squashfs-root directories and find, that the squashfs-root dir extracted with binwalk have www and www_safe folders, whereas in squashfs-root dir extracted with sasquatch that folders are missing. Why the extracted content differs?

Title: Why the extracted content differs?


问:
WinDbg is unable to communicate with the target after some time
Host and target are both Windows 7 x64.
The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it can not take commands. Also, when I attempt to break into the target (ctrl + break)  I am told that I can't communicate with the target:

Wrote 0 of 1 bytes of the breakin packet.
  Failed to write breakin packet to target.  HRESULT 0x80004005
  WARNING: The HOST cannot communicate with the TARGET!

If I am quick to catch the moment, the first errors are different: Win32 error 0n23 and Win32 error 0n121. I looked around for this error, but I could not find something related to WinDbg.

The only way I can resume my session is to shut down the target by pressing it's power button.

At first I thought this has something to do with the target entering stand by, but I modified the power options so it should never enter in a sleep state and I started to actively use it.

I thought this was my driver's fault (although it just iterates through some LIST_ENTRYs and displays some addresses with DbgPrint) so I restarted the target and never loaded my driver.

I noticed that right before this happens the target display goes black for a moment. Any place where I should start looking?


问:
IDA pro crashes when trying to open a dos.ldw
Whenever I try to load a malware executable in IDA pro 6.4 it crashes with message "IDA has encountered a problem".It creates a mini dump and exits. The malware file is shown as dos.lbw. Olly dbg is able to open and so is IDA pro version 5. Please help as to what should I do to resolve the issue </p>


问:
Reversing raw byte storage scheme on BusyBox-based network video recorder
I have a network video recorder - the Swann NVR8-7085.  It had telnet enabled and I managed to figure out the user/pass to get in (I downloaded the firmware from the site, extracted the squashfs filesystem, and set John the Ripper on /etc/passwd).  Once telnet'd in, I started poking around and looking at the mounted partitions.  It seems like the disk has a small partition at /dev/sdb1 that holds the BusyBox OS.  The rest of the disk is held in /dev/sdb2, which is not mounted nor has any identifiable file system as far as I can tell.  It's roughly 992GB, so I think the video files are stored there.  Since the device doesn't have a file system nor is it mounted, I'm guessing the DVR software writes raw byte streams to it from the cameras.  On /dev/sdb1 there are files that correspond to timestamps of captured video I think:

```<code># pwd
/mnt/sdb/00/2014/10/26
# ls -1
0020141026005959
0020141026020000
0020141026025959
0020141026040000
0020141026050000
0020141026054108
etc...
</code>```

Those files seem to be where some record of the recorded videos are.  But they're not easily readable.  I opened them up in a hexeditor and I'm not sure what to look for.  I'm happy to share one but it's a few KB.  Not sure if I should copy-paste it here.  Any suggestions where to go from here?


问:
How to hack a digital photo frame to remove JPEG compression?
I have purchased this digital photo frame:

http://www.globalshiping.com/en/usb-24-tft-16mb-digital-photo-frame-flash-can-store-32-of-your-favorite-photos.html?language=en&currency=USD[1]

I am not sure whether it's the software or the hardware that is doing the JPEG compression, but it's absolutely terrible, especially for text, makes things unreadable.

I would like to either completely remove the compression or lessen it, and it would be perfect. Does anyone have any advice on how to achieve this?

Or do you know someone that could do it for me? I would be willing to send you one of them to do so and pay you for your time.

UPDATE: I have done more research on this, apparently some people have hacked this particular type of photo frame with the APPOTECH AX205 Chipset for various functions.

Below are links referring to this:

hxxp://bastel.dyndns.info/~dockstar/lcd/

hxxp://flux242.blogspot.com/2012/02/digital-picture-frame-as-router-status.html

hxxps://forum.openwrt.org/viewtopic.php?id=34133

hxxp://picframe.spritesserver.nl/wiki/index.php/DPF_with_AppoTech_AX206

http://openschemes.com/2011/08/23/our-turn-with-the-ax206-digital-photo-frames/2/

The last link provides a development handbook for it: hxxp://openschemes.com/wp-content/uploads/2011/08/ax206_dh_v0.0.2_en_working.pdf

The last section shows compression rates. So it seems like this is done in hardware, and since others have downloaded, modified, and then uploaded firmware back to the device, is there a way for me to change the compression rate to 0, and upload new firmware to it? I don't even need to store alot of images, 10-15 would be enough. Even at 100% quality in photoshop, a 320x240 image is roughly 100KB so it would be plenty. Please advise. Thank you.

EDIT 2: I've downloaded the firmware from the device, and disassembled it. Unfortunately I do not know how to interpret/read the output to change what I need to.

;2008-09-26
DB 0,0 ; Max photo supported is 0, i.e. no limit. First digit is
; low byte. Second digit is high byte.
DB 1 ; Photo format in 4:1:1 or 1:1:1
DB 92 ; Compression quality: 1 – 100

That is the section with the pertinent information. So all I would need now is to change the pertinent section, recompile the bin, and upload back onto the device. Anyone?


问:
Olly hangs and lags
For some reason whether I open a program or attach to it, sometimes Olly 2 will behave really weird. It will either freeze and hang forever when I do things like placing a breakpoint, or more commonly, I will be able to see the screen render. When Olly jumps to a code area out of reach of the screen, I will be able to see how the screen is drawn over 0.5 second or so, from the top and downwards. If I put on single step animation, Olly will stay around 1 second on each line before moving onto the next, as if something is lagging terribly. Even clicking on another line takes a considerable amount of time before the line gets selected.  I restart the program over and over in Olly and suddenly it just works. Any ideas what might be the problem? I have tried to delete the .udd files and sometimes it works, other times it won't. Needless to say this is extremely annoying and doing simple things like placing a breakpoint keeps me waiting, so it makes it impossible to do real-time debugging. This has not been a problem with Immunity and Olly 1 as much, but I want to use Olly 2.</p>

Title: Olly hangs and lags


问:
How to know the C++ try/throw/catch block size and address from machine code?
I'm doing a project that reorders basic blocks inside a function at runtime in C++ under 64-bit Linux. The reordering process includes updating instructions like "jmp". One problem is that if the compiler (clang++ or g++) determines the try{...} block using a range, i.e., from address1 to address2; the reordered code would have problems (some basic blocks are out of range and some new basic blocks are swapped in).

My question is: Does the compiler/program determines the try{...} block using a range? If so, or not, how can I know and modify the corresponding determinants, through which I can recover the try/throw/catch blocks and let the program execute normally; when the program has been already loaded into memory?


问:
Is it possible to Reverse engineer digitally signed Windows Phone 8 apps (WP8 APPS)?
I have researched a lot about reverse engineering WP8 apps but nothing seems to work for apps that are digitally signed (Yes, I am talking about Apps from Windows App Store)

XAPSpy works with Windows Phone 7 only and may be, with unsigned WP8 apps(but I am not sure on this part).

Some answers of StackExchange says that Tangerine and Windows Phone App Analyzer can be used, but it doesn't seem to work with digitally signed apps.

Question :

Is it not possible at all, to reverse engineer WP8 apps collected from Store and perform security audit?
TIA.

Regards,


问:
IDA: How to automatically resolve references to Imports in modules loaded manually?
every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) because all code is undefined. how can I resolve references ( imports, data), detect functions automatically?</p>


问:
Create key generator algorithm from validation algo
I understand that this question will be rather vague, but I'm unsure how to process from here.

I'm trying to see how a key generator can be made.

I have been toying with IDA and managed to reconstruct an application key checking functions into C up to a point that I can check if a key is valid or not. This process uses a lot of bitwise operations such as shifting and masking which leaves me wondering how I can reverse that algo.

The validation steps are as follow :

From the serial key, use a associative table that maps chars to other values

From those values, use a block hashing with bitshift|bitmasks so that char[n] depends on char[n-1].

Generate a key from hard coded values.

Generate 2 tables with the result from 2. Table1 = Step2 encoded with Step3. Table2 is Table1 encoded with Step3

Encode Step2 with tables from Step4, depending on some bitmasking.

So this whole thing is rather complicated. Furthermore there is constant loss of information so writing code with exact reverse order of operations is not possible (or I don't know how).

I put myself in the shoes of someone who wants to create this protection scheme. Generating serials from decoded output MUST be possible. Either this whole process is reversible, or there is a function that can act as a backdoor like thing to reverse it right away, which I strongly doubt.

Any idea on things that I should look for at this point?


问:
What are these blue indexes in the disasm output?
I'm working on a binary that has a lot of FPU operations, and even though IDA (Hex rays) decompiles properly most of them, there's cases like this:

Which "decompile" to:

Is there any way I can fix that?

I tried undefining the function (U) and then defining it again (C -> P), but sadly it doesn't work.

P.S. If I open the executable in another instance of IDA (without my IDB), it decompiles just fine:


问:
How to remove SimplePack signature so it won't be detected by AVs
I've tried SimplePack, which is an open-source file packer for windows,
now, for some reasons, when I check via online virus-checkers, lots of alerts are being popped saying the file is crypted using SimplePack, though the file is innocent.

I realize this is somehow related to a header SimplePack adds or to its algorithm, but I'm not quite sure what to do to fight that, because I'd like to use this for myself.

Suggestions are always welcome!
Thanks.


问:
Well-known JSON obfuscator that puts the string "Salted12" in front of obfuscated files?
I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be encrypted/obfuscated. The files that get downloaded now seem to be base64-encoded; decoding them leads to binary files that have the String Salted12 plus 8 more ascii characters in front of them.

Examples:

```<code>Salted12OBWfTKpl<B4>{J<E0> <D1>...
Salted12DPEPlodlks^Q^H]^Q<88><A6><D5>...
Salted12WeuyYPkh<D6>"<F9>^I^_6^Q<AB><ED>^Y
Salted12hJhPiiUX<E7>Yu<D9><DB><9F><D9><BD>
</code>```

I assume the 8 extra bytes are some kind of encryption key (or, maybe the 16 leading bytes are the key, and the devs chose fixed the first 8 bytes)

Comparing the size of old versions of the json files with the new ones suggests the new ones are uncompressed, and have a 1:1 character encryption after the header bytes:

```<code>File       old size      new size
1.93.json     10999         10864
edit.json      2135          2160
next.json       252           976
</code>```

(The change in number of bytes isn't the same for all files, but as the contents have probably changed with the new version, this is to be expected).

Now my question is: Is there a standard, "well-known", library/framework that obfuscates JSON like this, or will i have to reverse the application to find out how the encryption works?


问:
How can one debug a program that can only be started by other processes?
I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger.

The program starts by using a bash script wrapper to process input parameters, and then execute an encrypted perl script, which somehow starts another process which is a binary executable and cannot be started independently(even if I add all the parameters as seen using ps au when it is running normally, it still says some .so file is missing).

Now suppose one wants to debug this binary using something like IDA, how do you set it up? Take IDA as an example, in the "process option" I have used the bash wrapper in "App path", the binary as "input file path", and it turns out the debugger would not go into the binary's space, and just stays in the exceptions inside glibc library and none of the breakpoints set in the binary would be reached. (However the program was running fine, just that debugger cannot go inside.)

Any thoughts about what is happening and the right way of doing it?


问:
Search hex dump in IDA pro remote debugger
I am using IDA Pro to debug an ELF binary remotely.

While debugging, I want to search for a specific address in the hex dump. In Olly debugger, we have the option to follow any address or register in the hex dump. Is there a similar option in IDA Pro?

I noticed that IDA Pro has an option to synchronize the hex dump with a specific register. However, I need to search for a specific address, how do I do that?

I checked the Jump menu in IDA Pro and there was no option. The "Jump to address" or G option is to search in the code section. Is there a similar option for searching in hex dump as well?

Thanks.


问:
How to dump iPhone arm64 memory?
Since GDB is no longer supported on arm64 devices i can't figure any alternative except lldb with debugserver, but unfortunately i can't dump memory with read command always giving me different errors, so my question is there any tool to make a memory dumps for games/apps?</p>

Title: How to dump iPhone arm64 memory?


问:
How to find maximum and minimum process boundaries while debugging?
If I'm using GDB or any other debugger, I just want to know where the respective images are loaded for a given process.

Say I create an executable HelloWorld, and it just prints hello.

It has a maximum and minimum bounds in memory.

I am asking this question because I'm looking for certain bytes in memory; I'm going to call gdb's find with these values as parameter.

Thanks in advance, I apologize if it seems novice, but I've not read the entire GDB manual.


问:
Attach to specific process using IDA + WINDBG in kernel debugging
I asked this question at the StackOverflow website and they referenced me here.

(Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-debugging?noredirect=1#comment44253284_27917592 )

I want to debug a specific process on a remote system and the only way i can do that is to use the kernel debugging method.
It works pretty good with just WINDBG, but i think ida can give me the extra edge i need for a better reversing experience.

So far debugging with windbg was successfull but now when i am using the windbg plugin in ida:

what i am actually experiencing is that i cant get the extra analysis from ida, all i can do is attach only to the  process it self (only one available to attach to). and in the Modules window all i can see is the ntkrpamp.exe, which i assume is the kernel process.

i can use all WINDBG regular commands like !process 0 0, etc.. and can debug normally but nothing shows in the IDA window

I have never debugged dynamically using IDA but i can see it is possible..

could it work aswell in a kernel debugging session?

I also noticed it is possible to analyze a model if i set a breakpoint with the windbg plugin and when IDA hits that breakpoint, this module is added to the IDA Modules windows.

It would be a lot easier if i could just analyze it without pre-putting a breakpoint on the specific module and waiting for it to hit.


问:
Emulate TP-Link WR841N using Qemu
I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points.

Following instructions from devttys0 and their great blog, used binwalk to unpack the firmware.

Following some details picked up from this previous question [Emulate TP-LINK WR740N with QEMU I've attempted to bot using the Malta debian kernel.

The issue I've had with the previous question was that there was never a final example of the arguments supplied to Qemu.

```<code>qemu-system-mips -M malta -kernel '/media/sf__share/vmlinux-2.6.32-5-4kc-malta' -nographic -append "init=/sbin/init root=/dev/sda console=ttyS0,115200" -hda 'myFileSystem.img'
</code>```

as well as (init=/bin/sh):

```<code>qemu-system-mips -M malta -kernel '/media/sf__share/vmlinux-2.6.32-5-4kc-malta' -nographic -append "init=/bin/sh root=/dev/sda console=ttyS0,115200" -hda 'myFileSystem.img'
</code>```

In almost all cases I get:

```<code>Warning: unable to open an initial console.
</code>```

I'm happy to accept some pointers on what I might be missing?

My objective is to create an emulated MIPS Linux instance with the rootfs extracted from the firmware image. I then have further plans, but outside the scope of my initial issues.

Title: Emulate TP-Link WR841N using Qemu


问:
Recovering .ipa file for TestFlight app on iOS 8 (not jailbroken)
Normally if I want to see the binary and resources for an app, I connect my iPhone to my Macbook, sync with iTunes, and then all of my apps are in /Users/cybergibbons/Music/iTunes/iTunes Media/Mobile Applications as .ipa files which I can extract as zips.

I have recently been given access to a beta version of an app via TestFlight. Whilst TestFlight is in the above location, there is no evidence of the beta app.

How do I go about getting the .ipa for the TestFlight app?


问:
Extracting .ovl and .aux files?
I recently got a copy of a space game and id like to be able to extract the audio/models from the game.

I've attached an example .ovl file and a .aux file below.
I have no knowledge on reverse engineering file formats.
So I'm sorry if I'm not the best at learning things.
However i will try to do the best that I can.  I was able to gather a bit of information on the web. However no one has archived this yet.

'The OVL and OVS files are compressed with zlib. OVL files make up
  parts of a virtual serialized filesystem, and are partially
  compressed. OVS files are completely compressed and contains most of
  the bulk data. Can't give you more info than that at the moment as I'm
  at work and I've not looked at them for a while.'

Here is the top of the .aux file in hex workshop.

Here is the .ovl file.

Quick Update: I was able to extract some of the files and get the proper name. However, I'm not able too play them. They're corupt.

I used this quickbms script.

http://forum.xentax.com/viewtopic.php?f=13&p=74664#p74664

OVL FILE DOWNLOAD:
/mega.co.nz/#!Cx5nHLTa!JgTCENPHMY4MD1LeOLFhwwt8DcZr8pngforLIdPibqs

AUX FILE DOWNLOAD:
/mega.co.nz/#!60YAkQ5Q!6M_aexZSx8JyE7GQAKi1K1qD17n9ULOMGKM7t26BaUs

Title: Extracting .ovl and .aux files?


问:
Emulating a sentinel c-plus security dongle to attach to a virtual machine
My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called THEOS.

We've run into a bit of a snag. The operating system depends on a security dongle being present to install and run. The device is a sentinel C-Plus A (see below). It connects to a parallel port and acts a passthrough device for a parallel printer.

I've been exploring options on how to virtualise this dongle. My plan is to somehow emulate the dongle, attach the virtual device to VMware machine and install THEOS as a VM (I already know THEOS is compatible with VMware).

So far, I've managed to find this forum which is hosting a dumper and emulator for this dongle, but I'm not able to download it as I'm not a member (and cannot join without an invite code).

I've also found this business that claims to be able to create an emulator for this dongle, and am in the process of contacting them about it. However, we would prefer to do this ourselves rather than go through someone else.

Does anyone have any advice or experience for a situation like this? Or perhaps information on how we can access the tools hosted on the exeforums site?


问:
DirectX debugging
Any suggestions how can I track visual changes performed through an win32 process? I have almost no knowledge how they are done. I'm currently debugging an application which uses it's own custom FONT files to drawn letters, however I can only trace the drawing at a very high-level and can't connect it with DirectX API for example. I'm also curios if it is possible to use the VS new Graphics Debugger to attach into a running process.

Any clues about how to achieve this? I have no source code of the target application and I'm using IDA Pro + API Monitor.

I'm especially interested in drawing letters.

Title: DirectX debugging


问:
Define new code section in assembly code to compile ELF binary
I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86.

I use the linker scripts to assign a specified address for this new code section, it works. However, I noticed that this new section does not be loaded to the memory, after some debugging!

I use readelf and figure out that there is no "execution" privilege of this new section:

```<code>[15] .trampoline       PROGBITS        080483d0 004020 000117 00      0   0 16
</code>```

Then I did this:

```<code>objcopy --set-section-flags .trampoline=alloc,code a.out
</code>```

However, I got this warning:

```<code>BFD: stQWykoH: warning: allocated section `.trampoline' not in segment
</code>```

Now I realize that I didn't explicitly assign a segment information to my new section!!

So here is my question:

How to assign a segment information to a new code section I defined? I double-checked the linker script (follow instruction here to dump), and I have no idea how to modify the script...

I just want to add a new executable section to my assembly program, and assign a fixed address to this new section. So am I on the right way now?


问:
Static binary instrumentation tools for android .so libraries?
I'm trying to statically inject code into an android app.
The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk modifying is not feasible, and injecting code into the .so file the apk uses would be pretty much the way to go.

So I've been searching for hours for ARM binary instrumenting tools, and I've come across a lot of dynamic instrumenting tools, but not any static ones.
What I'm trying to achieve is, injecting code into a codecave or overwrite ARM code into an existing function in a library that resides in /data/data/com.appname/libs/. So when the app is launched, the corresponding library get loaded and the code gets executed. The device is rooted of course so I can modify the library, but the app requires the device to be unrooted when the app is actually running. I can use SuperSU to modify/overwrite existing app libraries, then unroot the device when before launching the app.

If there are any existing tools or blog posts out there, it would be grateful if you could point me to some links. If there's nothing, then I'd probably just use the code in dynamic instrumentation tools and create a small tool to do the task.

Any help would be appreciated.

Thanks! :)


问:
Bypassing Enigma loader
Currently I'm trying to get past Enigma's loader, which asks you for a name & key, as an excercise.

I have very little progress, as I haven't worked too much with packers.

What I did was breakpoint on CreateWindowExA, and then I put random data at key / name, and then click Register, which effectively breaks at CreateWindowExA.

From there, I'm able to check the stack and go back a few calls, but I'm really lost as there's a lot of bloat code (short functions with x87 instructions), and I don't know where to continue.

I also know that the routine that checks the serial is virtualized, so I should patch the places which check the return of the function that checks the serial instead of the function itself, but then again, I get lost when looking at the stack.

Here's my progress so far:

The breakpoint on CreateWindowExA, which gets called when you input an invalid serial

The function that calls it:
http://screenshotuploader.com/i/1502/t_q0c.png

And that function, before and after calling CreateWindowExA, calls these two weird x87 functions:

the function that is marked in the previous screenshot

this one gets called a few instructions after CreateWindowExA

After going one more function back, I see:

The problem with that function is that it's using some tricks to change the return address (I guess), like this:

Which then leads to weird code which expects a function pointer in edx returned by a funtion that is dereferencing a pointer to a word (2 bytes)!

Here's the code that calls the function that returns a pointer to a function:

And here's the function that returns a pointer in edx:

It is really weird, as it 1) derefs a word (2 bytes, not enough for a function pointer!), and 2) FLDCW loads a x87 FPU control word... what's happening here?!

Also, that's the last return I can see in the stack, as the rest of the values are zeroed, and there's no branch which checks the serial at this depth, so I don't know where to continue looking at.

And if not enough, the program closes each time I input an invalid serial, which makes it harder, because the next time the offsets are totally different and I can't find the code so I breakpoint a bit before, so I'm really lost!

Dumping the executable at runtime does absolutely nothing, as it's still packed as it was before, it just makes it 4x bigger (50MB -> 200MB), and doesn't help at all.

Any help would be great, even a simple idea, like a hint on what to do next, where to breakpoint, where to look at, or whatever you can think of, would help a lot.

Title: Bypassing Enigma loader


问:
Rva to raw file offset in PE
What is really correct translation algorithm to get an offset in portable executable file from relative virtual address of some byte in the image?

I see next cases:

RVA points into the header part of image

RVA points into a section part presented in file

RVA points into a section part not presented in file (some loadtime initialized data)

RVA points out of image

For the first case it's like RVA is equal to offset in a file. (If all parts of file are mapped to the image. I'm not sure about DOS header.)

Further, mapped section can be biger than section in a file so some RVAs jast have no offset like RVA that points out of image.

And last things that I does not undestand at all. Are the values of fildes SizeOfImage, VirtualSize, VirtualAddress, PointerToRawData, SizeOfRawData already take into consideration file alignment and section alignment?

I saw some realizations of RvaToRaw full of black magic that made a correction for alignments, but without any explanation.

If no more alignment is needed so for case 2 it's

```<code>raw = rva - rvaOfSection + SectionRaw
</code>```

Title: Rva to raw file offset in PE


问:
Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or potentially something more sinister? Is the next best course of action to run reshack in a debugger and watch what happens?

UPDATE

I manually saved the potentially offending bitmap in question by right clicking and pressing 'save'. I will analyze the bitmap independently.


问:
Hooking the BootClassLoader
According to Wikipedia, there are 3 class loaders.

The Boot Class-Loader which loads everything in RT.jar and /../jre/lib

Then the extensions class loader and the system class loader.

I'm only interested in the Boot class loader because I want to hook it and redefine a class in RT.jar without all the legality issues that come with -Xbootclasspath:/p.

Docs: http://docs.oracle.com/cd/E13150_01/jrockit_jvm/jrockit/jrdocs/refman/optionX.html

Note: Applications that use this option to override a class in rt.jar
  should not be deployed. Doing so would contravene the Java 2 Runtime
  Environment binary code license.

And the license here: http://www.oracle.com/technetwork/java/javase/downloads/jre-6u21-license-159054.txt

states:

C.  Java  Technology  Restrictions.  You may not  create,  modify,  or
  change the behavior of, or authorize your licensees to create, modify,
  or change the behavior of, classes,  interfaces, or  subpackages  that
  are in any  way  identified  as  "java",  "javax",  "sun"  or  similar
  convention   as   specified   by  Oracle  in  any  naming   convention
  designation.

So I'm thinking that if I can hook the boot class loader from native code via C++, I can replace a class in by hooking the JVM_DefineClass function from JVM.dll without any legal trouble.

The function has the signature:

JNIEXPORT jclass JNICALL JVM_DefineClass(JNIEnv *env, const char *name, jobject _loader, const jbyte *buf, jsize len, jobject pd)

1: Does this function actually get call when a JVM is starting up?

2: Would I still be breaking the license if I hook it?

3: Am I hooking the right function or should I be doing something else(better method maybe?)?

Title: Hooking the BootClassLoader


问:
IDA: Inconsistency between mouse-over value and stored value?
I'm trying to RE a program which has a limit of n iterations.
I already found the interesting part in the disasembled code with static analysis and analysis with the local win32 debugger.

There seems to be a correlation between being BELOW / ABOVE the limit
and a number.

While I'm below the limit the value is set to 1.0.
If I go above the limit of the value keeps being 0.0

A mouseover tells me the "magic" value.

Now I have two problems:

I would like to find out WHAT writes to that address. My idea was to set a write-trace on it - but see no. 2

I cannot find the value in memory.
Right click -> "jump in new window" leads me to 0x0072EB88
The stored value there is 0 altrough IDA is showing me a 1.0 (see first image)

Manual check

ESP = 0x0072EB40

var_838 = -0x838

putting it all together:
0x0072EB40 + 0x880 - 0x838 => 0x0072EB88

Can someone help me out please and tell me what my error is?

Thanks in advance.


问:
StrongOD Driver missing
Rather short question.

So i've taken to using StrongOD for Ollydbg and I noticed that the fengyue0.sys doesn't exist, I had googled around and restarted my computer in hopes it would be created, yet no dice.

Does anyone know how to aquire this?

Title: StrongOD Driver missing


问:
Changing the argument number in a macro in IDA Pro
Can I change argument number to macro in IDA pro Hex-rays?

```<code> fd = open("a", 513, 0644);
</code>```

Like this.

```<code>fd = open("a", O_WRONLY|O_CREAT, 0644);
</code>```

Is this possible?


问:
Name for simple character encoding (where '0' is 0x00; 'A' is 0x0A)?
Some old games have a very simple text encoding in which:

```<code>0x00 = '0'
0x01 = '1'
...
0x09 = '9'
0x0A = 'A'
0x0B = 'B'
0x0C = 'C'
...
0x22 = 'Y'
0x23 = 'Z'
...
0xFF = string terminator
</code>```

I figure this encoding must be pretty common due to its extreme simplicity so I was wondering if there's a correct/de facto name for it.


问:
Packers that partially decrypts contents on-the-fly
I'm on the lookout for packers that I could use/read the source for, that don't decrypt the contents of the original binary in one go and jump to it. Do you know of any packer that decodes/decrypts a functions contents on the fly(when it is called) and jumps to it? Or of any packer/protector that does anything similar?</p>


问:
Reverse Engineering a 8 bit CRC checksum
I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am pretty sure the CRC is the last byte because the rest of the data only changes when I change something in the settings).

So what I need to do now is to be able to reverse engineer the process on how to come up with this CRC

```<code>A802000000001F5D0000000073
A802000000001E5D0000000070
A802000000001D5D0000000071
</code>```

In the data above I purposely changed 1F -> 1E -> 1D and as you can see the value of last byte changed from 73 -> 70 -> 71.

I tried different on-line CRC calculators but still had no luck.

I managed to capture more data samples:

```<code>A80300000004045D0000000045
A80300000004055D0000000044
A803000000040F61000000004A
A802000000040F61000000004B
A81200004004169A00000000FB
A81200004004159A00000000F8
A81200004004149A00000000E5
A81200084000149C00000000E7
A83200084000149C0000000087
A85200084000149C00000000A7
</code>```

Any help would be greatly appreciated.


问:
Shellcode alignment problem
I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux.

In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly in the shellcode. My idea is to load the code, then manipulate it with add/sub and such in a first stage, then execute the decoded instructions later on.

The decoding however does not always work properly. Mostly, when I try to use pointers like [rax], the content read during runtime is not the same as the one read by gdb. Here is a simplified version of what I am trying to do :

```<code>decrypt:
  cmp byte [rax], 0x66
  jae no_change
  cmp byte [rax], 0
  je no_change
    add byte [rax], 0x3f

no_change:
  inc [rax]
  loop decrypt
</code>```

This does not work. Usually [rax] is not read properly. However when I add a few NOP instructions in front of the no_change label then it works correct. I just don't get why I can't use [rax] to point to any location.

Title: Shellcode alignment problem


问:
Constructing a mesh from triangle data (plane, svec, tvec)
I am trying to obtain some mesh data from a game which stores its collision surfaces for props/models in an array of "CollTri" structures which looks like this (taken from the limited source code I have access to):

```<code>struct CollTri
{
  vec4_t plane;
  vec4_t svec;
  vec4_t tvec;
}
</code>```

It's parent structure for reference is "CollSurf".

```<code>struct CollSurf
{
  CollTri *collTris;
  int numCollTris;
  vec3_t mins;
  vec3_t maxs;
}
</code>```

How would I go about interpreting these "CollTri" structures and converting them into a triangle list for easy mesh creation? It's unclear to me what "svec" and "tvec" is and I'm not great at 3D math. The game is based off the Quake III engine so that might help.

I have dumped some of the data here for reference:
http://pastebin.com/UABAjDQP


问:
USB not showing up on QNX in Qemu
I have spent some time reverse engineering a QNX 6.5.0 based system. I am pretty new to the Linux (Ubuntu) world and definitely new to QNX, Qemu, and embedded systems.

Since the hardware is fairly closed, the closest I could use is a Beagleboard-XM.   Since I didn't want to purchase one, I decided to use Qemu.   I have set it all up using the Linaro builds, etc.   I have a system booting.

My issue is that I cannot, for the life of me, get the emulated QNX system to show a USB drive.  I am using Ubuntu 14.04 LTS and am booting from an SD card.  I don't card if I can actually load a USB drive, but it seems like the simplest solution to be able to get files off the QNX system.   I have tried quite a bit.   I am unable to get networking up and running and am unable to get QNX to recognize any devices.

Here is my working Qemu command line (version 1.7.0 (qemu-linaro 2014.01))

```<code>sudo qemu-system-arm -M beaglexm -m 512 -serial stdio \
                     -nographic -monitor pty -usb -sd /dev/mmcblk0
</code>```

I have tried tons of command lines with -device, -drive, etc, etc.  For example.

Nothing.   One thing to note is that I have attempted to use the EHCI bus but am unable to get that working because I keep getting a

```<code>qemu-system-arm: -device usb-ehci,id=ehci: No 'PCI' bus found for device 'usb-ehci'
</code>```

using the command line

```<code>sudo qemu-system-arm -M beaglexm -m 512 -serial stdio \
                     -nographic -monitor pty -usb -sd /dev/sdd \
                     -drive if=none,id=usbstick,file=/dev/sdb1 \
                     -device usb-ehci,id=ehci \
                     -device usb-storage,bus=ehci.0,drive=usbstick
</code>```

Also, the emulated system tries to load an mmcsd driver and is looking for a raw /dev/mmc0.   I have been unable to figure out how to get my SD card (or any other device) to show up with that mount name.

Any suggestions for being able to get files off the emulated system?   I know that the system can use these two specific USB to ethernet adapters, but I don't have one.   Maybe I could simulate one of those?   My attempts at setting up a fake USB to serial connection also have failed.   Basically, anything that requires USB support I am unable to get working.

This is what shows on the emulated QNX system when I query the usb host.

```<code>USB 0 (OMAP3530) v1.10, v1.01 DDK, v1.01 HCD
USB 1 (EHCI) v1.10, v1.01 DDK, v1.01 HCD
</code>```

Any help would be greatly appreciated!

Title: USB not showing up on QNX in Qemu


问:
Scanning memory accessed by a DLL
I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to run.

Are there any tools like this?

Title: Scanning memory accessed by a DLL


问:
How to set a breakpoint on GetProcAddress in IDA Pro?
I'm usibng IDA 6.5.140116 and cannot seem to get a breakpoint to break.

My workflow is:

Open the Imports subview

Double click on the Name column for the row representing GetProcAddress. This jumps to the IDA View-EIP window.

With the GetProcAddress line selected, I press F2 to set a breakpoint

When I run the application, these breakpoints NEVER get hit.  The application isn't using ASLR.  I'm wary about the breakpoint being in .idata when perhaps I need it on the first instruction of GetProcAddress in kernel32.  I'm not sure how to set that exactly.

I just want to have a breakpoint thrown whenever a certain API call (in this case GetProcAddress... but also RegQueryValueExA for example)  but the press F2 on the address obtained via the Imports window doesn't seem to be working.  What am I missing?  How can I improve my workflow for this?


问:
How can I have IDA replace an offset with the label of the function the offset points to?
I keep seeing the same pattern in the code I'm analyzing. A call instruction is using a label "off_" which is just a pointer to the real address of the call (in this case: GetWindowTextW).  It would be much more convenient for me to see call GetWindowTextW (or user32_GetWindowTextW).  This much be an option I can set somewhere or a way to reanalyze the application... but I can't seem to find it.  How can I achieve this?


问:
Ollydbg Instructions Are Splitted
When I am trying to reverse ZeroAccess rootkit, ollydbg shows instructions as seperated like;

it should be e874010000 as a single instruction which is a call to some routine but it shows them like the picture above,

before the EIP jumps shown place there are instructions which are below,

I think int 2Dh (anti debug) is probably related to this situation. Can somebody enlighten me ? Or show some source to read and learn what is exactly going on here ?

OK I have managed to solve this problem by clicking right, then Analysis then Remove object scan for module. I think Olly is misinterpreted the code for some reason, even if I did not understand why this solved my problem. Anyway If there is somebody to explain why Olly did this, is welcomed.

Title: Ollydbg Instructions Are Splitted


问:
Trying to run MIPS ELF with a cross toolchain but sigbus error
I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with :

mipsel-none-elf-run myelf

i get the following error :

```<code>mips-core: 4 byte read to unmapped address 0x400670 at 0x400670
program stopped with signal 10 (User defined signal 1).
</code>```

(the adresse 0x400670 points the first instructions of the main function.

Specifying the endianess to the tool gives me the same error.

I tried to run it with

```<code>mipsel-none-elf-gdb myelf

GNU gdb (GDB) 7.5.1
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=x86_64-unknown-linux-gnu --target=mipsel-none-elf".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...

warning: A handler for the OS ABI "GNU/Linux" is not built into this configuration
of GDB.  Attempting to continue with the default mips:3000 settings.

Reading symbols from /home/ashkan/Crack/crackme200...(no debugging symbols found)...done.
(gdb) target sim
Connected to the simulator.
(gdb) load
Loading section .interp, size 0xd vma 0x400154
Loading section .note.ABI-tag, size 0x20 vma 0x400164
Loading section .reginfo, size 0x18 vma 0x400184
Loading section .note.gnu.build-id, size 0x24 vma 0x40019c
Loading section .dynamic, size 0xd8 vma 0x4001c0
Loading section .hash, size 0xa4 vma 0x400298
Loading section .dynsym, size 0x160 vma 0x40033c
Loading section .dynstr, size 0xdf vma 0x40049c
Loading section .gnu.version, size 0x2c vma 0x40057c
Loading section .gnu.version_r, size 0x30 vma 0x4005a8
Loading section .init, size 0x90 vma 0x4005d8
Loading section .text, size 0x490 vma 0x400670
Loading section .MIPS.stubs, size 0xa0 vma 0x400b00
Loading section .fini, size 0x4c vma 0x400ba0
Loading section .rodata, size 0x40 vma 0x400bec
Loading section .eh_frame, size 0x4 vma 0x400c2c
Loading section .ctors, size 0xc vma 0x410c30
Loading section .dtors, size 0x8 vma 0x410c3c
Loading section .jcr, size 0x4 vma 0x410c44
Loading section .data, size 0x1b0 vma 0x410c50
Loading section .rld_map, size 0x4 vma 0x410e00
Loading section .got, size 0x5c vma 0x410e10
Loading section .sdata, size 0x4 vma 0x410e6c
---Type <return> to continue, or q <return> to quit---
Start address 0x400670
Transfer rate: 26592 bits in <1 sec.
</code>```

I used target sim and load to configure gdb. But when i want to run the program. I get :

(gdb) r
Starting program: /home/ashkan/Crack/crackme200
mips-core: 4 byte read to unmapped address 0x400670 at 0x400670

Program received signal SIGBUS, Bus error.
0x00400670 in ?? ()
(gdb)

So i've read that the error comes from unaligned adresses. Is there a way to fix it ? Here is the link to the elf file: link If anybody has an idea.. Thanks have a good day.


问:
Load multiple modules in one IDA database
I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and switching between tabs I wanted to load all the modules together as if they were 1 executable. I looked at this :

http://www.hexblog.com/?p=6

and when I tried the script it had a syntax error, which I later fixed. Once I "fixed" it (by merely commenting the function call out) I tried running the script again and ended up with this :

It then loads the segment but doesn't load strings, imports etc. because as the error stated the main structure in the PE file format was not found..

Does anyone have any solutions to this or any alternative ways of loading all the DLLs in one database?


问:
Work out packet structure from usb capture
Im hoping to understand the way a auto diagnostics tool is reporting data over usb.
I've made a usb capture to look for changes according to known changes to the input it measures.
The measurement is of throttle position, and is reported from 0.000000% to 100.000000% (6 decimal shown)

```<code>Here as a full packet, throttle 100%
    41 05 2B C0 FF 15 01 00 AA 00 00 00 00 00 FF 15
    16 00 01 AA 00 00 00 00 01 08 11 00 05 61 C6 00
    6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2
</code>```

Here is a sequence of packets, only showing the last line which changes, along with the times in a row that same packet was recieved

```<code>Throttle ~50%
6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x3
6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x3
6D C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 72 x5
6C C3 67 52 4C 49 2D 7F 00 00 00 00 55 00 73 x1

Throttle 100%
6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x2
6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x4
6C C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F3 x3
6D C3 67 52 4C 49 2D FF 00 00 00 00 55 00 F2 x3

Throttle 0%
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x2
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x1
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
6D C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F1 x3
6C C3 67 52 4C 49 2D 00 00 00 00 00 55 00 F2 x1
</code>```

So initially I noticed the 8th byte and thought it might correlate to a ADC reading of 0 - 255 that is then displayed as 0 - 100%. But then i found in the logs that it saves percentage readings to 6 decimal places with _TYPE="FLOAT" .

Ive also noticed that within a group of similar packets that correlate to the same throttle position, there is an alternating pattern of changes to the first and last byte (for that line)

Ive also noticed that the packets are nearly all the same, except for what seem like small differences but which must make larger differences to the stored data than seems.

So can anyone see how it might be stored ?


问:
How to set-up GDB debugging in IDA Pro on Linux via Wine?
I tried running on linux via root terminal:

```<code>gdbserver --multi localhost:23947
</code>```

And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port:

However when I start debugging I think registers receive wrong values:

Any ideas how to fix this?

I'm running latest version of Opensuse Tumbleweed and IDA PRO 6.6 x64 Win32 under Wine.


问:
Where to identify and access the main object/closure in a JavaScript web app?
I want to add missing functionality to a web app's front end code JavaScript code.

I can find the code in the browser's developer tools by setting breakpoints and stepping through.

But in a large app with lots of modules, obfuscated or at least minified code, and layers of self-executing anonymous functions, how do I then begin to intercept / hook / patch the function I want from a user script?

Looking through the call stack and closure hierarchy doesn't seem to tell me everything I need.


问:
recompiling android app - native method not found
Been trying at this for over a week, and I'm able to modify the needed sections, however I'm running into a major issue while trying to recompile the APK that is making the whole task atrocious. So I've sucked up my pride and am asking for help from other people.

I've been tasked with RE'ing an android app that has been giving me issues. To date, I've been able to decompile and recompile the app into an "almost working" apk. Without modifying anything, recompiling the app is fine, but when I try to run it on the AVM or an actual test device, it crashes repeatedly with a stack trace due to the following:

```<code>2173-2173/com.[removed].[removed] E/[removed]﹕ java.lang.UnsatisfiedLinkError: Native method not found: com.[removed].crypto.openssl.OpenSSLWrapper.GenerateSeedHash:([BLjava/lang/String;)[B
</code>```

I've removed the apk name as it is work-related information and hopefully not necessary to solving the issue.

Right before I get the stack trace, I've noticed a bit more of information that might be helpful:

```<code>    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ CPU -- Arch same ? -> true
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] : libcrypto.so.1.0.0 already exists
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ CPU -- Arch same ? -> true
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] ﹕ libssl.so.1.0.0 already exists
    04-27 12:00:07.599    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Trying to load lib /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0
    04-27 12:00:07.609    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Added shared lib /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0
    04-27 12:00:07.609    2173-2173/com.[removed].[removed] D/dalvikvm﹕ No JNI_OnLoad found in /data/data/com.[removed].[removed]/files/libcrypto.so.1.0.0 0xb310e1f0, skipping init
    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Trying to load lib /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0
    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ Added shared lib /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0
    04-27 12:00:07.619    2173-2173/com.[removed].[removed] D/dalvikvm﹕ No JNI_OnLoad found in /data/data/com.[removed].[removed]/files/libssl.so.1.0.0 0xb310e1f0, skipping init
</code>```

Any help is extremely appreciated as it's been quite some time tinkering, googling, etc. and I've had no success of getting the APK to run without issue.

Thanks all


问:
Why does calling the original function from my hook fail?
I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below.

The hook works fine until I call the original function. It crashes each time I do. I think it may have something to do with the return type of the function. Since I am new to reversing, I am having trouble determining the correct return type. I tried several different return types ranging from void to int. After the function returns, EAX points to a unicode string but the value isn't used. From what I read, EAX is where a returned variable would be stored.

Update:

I now see that this exception is occurring.

```<code>System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at ServerDLL.Injector.DoSomeThingDelegate.Invoke(Int32 argument1, Int32 argument2)
   at ServerDLL.Injector.DoSomeThing(Int32 argument1, Int32 argument2)
</code>```

Calling the function:

```<code>Address   Hex dump          Command                                  Comments
00425373  |.  894424 04     MOV DWORD PTR SS:[ESP+4],EAX             ; /Arg2
00425377  |.  8B45 A8       MOV EAX,DWORD PTR SS:[EBP-58]            ; |
0042537A  |.  890424        MOV DWORD PTR SS:[ESP],EAX               ; |Arg1
0042537D  |.  E8 8EC3FFFF   CALL DoSomething;
00425382  |.  8B4D 8C       MOV ECX,DWORD PTR SS:[EBP-74]
00425385  |.  8B45 A8       MOV EAX,DWORD PTR SS:[EBP-58]
</code>```

```<code>static string DoSomeThing(int argument1, int argument2)
{
    Log.WriteLine(argument1);
    Log.WriteLine(argument2);
    DoSomeThingDelegate del = Marshal.GetDelegateForFunctionPointer(new IntPtr(0x421810), typeof(DoSomeThingDelegate)) as DoSomeThingDelegate;
    if (del == null) return "";
    return del(seatnumber, stack);
}

[UnmanagedFunctionPointer(CallingConvention.Cdecl, SetLastError = true, CharSet = CharSet.Auto)]
delegate string DoSomeThingDelegate(int argument1, int argument2);

public void Run(RemoteHooking.IContext InContext, String InArg1)
{
    CreateRecvHook = LocalHook.Create(new IntPtr(0x421810), new  DoSomeThingDelegate(DoSomeThing), this);
    CreateRecvHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
}
</code>```


问:
Connecting to mac_server with IDA Pro on Windows
I can't get IDA to connect with a debugging server on OS X. This is what keeps happening:

```<code>$ ll ~/.bin/mac_server*
-rwxr-sr-x  1 Ron  procmod   657K May  5 22:29 mac_server*
-rwxr-sr-x  1 Ron  procmod   666K May  5 22:29 mac_serverx64*
$ mac_serverx64
IDA Mac OS X 64-bit remote debug server(MT) v1.17. Hex-Rays (c) 2004-2014
Listening on port #23946...
=========================================================
[1] Accepting connection from 172.16.91.129...
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
Current group=procmod
[1] Closing connection from 172.16.91.129...
</code>```

I'm running IDA Pro 6.6 on Windows and mac_server on OS X Yosemite 10.3. Did I miss something crucial?


问:
How to store a string securely inside your app?
Let's say you have an Android or iOS app, how can you store a web API key (a string) in your app securely, making it impossible or harder to reverse engineer.

Some solutions I have thought about :

Storing, along with the web API key a 1000 other fake keys with the same length so that the when trying to reverse your app it will be hard to determine the right one.

I am sure there are better solutions to do this. Thank you !


问:
Remotely debugging Android native ARM library running in Bluestacks
I want to debug a native library loaded by JNI on Android. I have set up the debugging environment to debug native code running on Bluestacks.

I got gdbserver installed on rooted Bluestacks, running in Windows environment, and I have gdb obtained from Adroid NDK on my Windows box.

I found out though that I am not able to debug ARM native code running on Bluestacks as the OS is running in i686 architecture and ARM is very likely emulated somehow by Bluestacks engine.

I can get a connection from gdb to gdbserver running on i686, but I can't set the architecture to arm (set architecture arm) afterwards and the debugger wants to operate with i686 registers.

Is there any way to actually set up gdb and gdbserver to switch to ARM architecture while the android is compiled for i686 arch and it does run on i686 which is my Windows box? I heard about gdb-multiarch, but I'm not sure if it is what I need. I tried gdb 7.6 from MinGW package, but it also didn't help.


问:
How allocate memory on Kernel mode by windbg?
How allocate memory on Kernel mode by windbg?
I use .dvalloc on user mode but not working on kernel mode

thanks.


问:
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:

Local variables on stack of different types, including types defined in local types window

Local variables of different types mapped to registers

Function parameters of different types

I have 2 IDBs with the same function based on the same binary and I want to pass this data from one IDB to another.
Let's also assume that I have a solution of passing related data types between databases.

I know that I can iterate the local variables in decompiled function by using  user_lvar_visitor_t class.
I also know that there is a function save_user_lvar_settings these variables by using of the same iterator class user_lvar_visitor_t.

I have the following questions regarding this:

Which data should I gather from the first database to create these variables in second database correctly (with IDAPython, IDA version is 6.8)?

How can I create these variables in the second database to make use of save_user_lvar_settings or restore_user_lvar settings (with IDAPython, IDA version is 6.8)?

Update: Before asking this question I reviewed the following IDA collaboration solutions:

Collabreate

ida2sql

IDA toolbag

IDAsynergy

IDAsync

One more update

Diaphora

And was not able to find solution for my problem in any them.


问:
How to get opcodes for assembly using ppc processor (IDAPython)
In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function.

Here is an example using a PE-file / x86 processor type:

```<code>Python>Assemble(FirstSeg(), 'asdf')
Invalid mnemonic -> OK
(False, 'Assembler failed: asdf')
</code>```

As we can see, the Assemble call returns False and prints a error message for a invalid mnemonic when using an incorrect assembly instruction like asdf.

With a valid assembly instruction, the correct opcode is returned:

```<code>Python>Assemble(FirstSeg(), 'ret')
(True, '\xc3')
</code>```

Here is the same function using a PPC-ELF/ppc processor type:

```<code>Python>Assemble(FirstSeg(), 'asdf')
(True, '\x00')
</code>```

As we can see, no error message is printed and a \x00 is returned as resulting opcode.

The valid sc instruction and any other valid ppc instructions return the same (wrong) value of \x00:

```<code>Python>Assemble(FirstSeg(), 'sc')
(True, '\x00')
</code>```

How can I get IDAPython's Assemble(ea, line) to return the proper opcodes when using a PPC-ELF/ppc processor type?

This is the trace the the function takes:

Assemble(ea, line)

_Assemble(ea, line)

idaapi.AssembleLine(ea, cs, ip, use32, line)

And a usage example of Assemble(), if it wasn't clear:
https://code.google.com/p/idapython/source/browse/trunk/Scripts/FindInstructions.py


问:
How does my S62 engine utilize MAF sensors to convert voltage to mass flow?
We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This sensor is critical for correct engine operation and people often replace the sensor without knowing for sure if it needs to be replaced. By understanding how the ECU utilizes the sensor, one can devise a simple test with a multimeter to confirm or disprove whether a new sensor is needed.

Someone has access to the disassembled instructions for the ECU (Motorola M68000) and has shared screenshots of the two subroutines which he believes are relevant to mass air flow evaluation.

MAF Curve (this is what tbls uses):

sub_12D96:

sub_1AA3A:

There are a few schools of thought as to what is happening here:

The average of the two MAF sensor voltages is being used. I don't see that in this particular set of instructions.

The result from the lookup table is halved.

The two results are computed separately and then added together. This however conflicts with the field data collected.

Only one sensor is being used (in other words, the sense of the S62 check is inverted, but it physically makes no sense)

Could someone help me to make sense of what the instructions are doing? Here is my stab at it, I just cannot "piece" it all together to make sense of it:

```<code>sub_12D96:
move.l  a2, -(sp)                  ; Push long value at address a2 to stack
movea.l #SYS_TIMERTICS_COUNTER, a2 ; Move SYS_TIMERTICS_COUNTER address to a2
btst    #7, (PSYNC_ST).l           ; Bit-test on something, not sure how this works
beq.s   loc_12E02                  ; If true, go to loc_12E02, else continue

move.b  (ZUSTAND_MOTOR).l, d0      ; Move a byte from ZUSTAND_MOTOR address to data register d0
andi.b  #$1C, d0                   ; Bitwise-and 0x1C with data register d0
                                   ; [to check if engine is running]
beq.s   loc_12DEE                  ; If binary-equal, go to loc_12DEE, else continue

pea     (1).w                      ; Push effective address onto stack (does this set stack pointer?)
move.w  (HFM1_AD).l, d0            ; Move word value from HFM1_AD to data register d0 (why move.w and not move.l?)
move.l  d0, -(sp)                  ; Push long value to stack
jsr     sub_1AA3A                  ; Jump to subroutine sub_1AA3A
addq.l  #8, sp                     ; Add 8 to stack pointer (move stack pointer address by 8?)
move.b  (K_MOTORTYP).l, d0         ; Move byte from K_MOTORTYP to data register d0
andi.l  $#EF, d0                   ; Bitwise-and 0xEF with data register d0
moveq   #$20, d1                   ; Move 0x20 to data register d1
cmp.l   d0, d1                     ; Compare d0 with d1
bne.s   loc_12DEE                  ; If binary-not-equal, go to loc_12DEE, else continue

pea     (2).w                      ; Push effective address onto stack (does this set stack pointer?)
move.w  (HFM2_AD).l, d0            ; Move word value from HFM2_AD to data register d0 (why move.w and not move.l?)
move.l  d0, -(sp)                  ; Push long value to stack
jsr     sub_1AA3A                  ; Jump to subroutine sub_1AA3A

sub_1AA3A:

arg_2=  6                          ; define constant (arg_2 = 6)
arg_7=  $B                         ; define constant (arg_7 = 11)

clr.l   d0
clr.w   d1
move.w  arg_2(sp), d0              ; move a word 6 places after stack pointer to d0
lsl.w   #3,d0                      ; left-shift the word at d0 by 3 bits (multiply by 8)
tbls.w  (KL_HFM_ML_V_b).l, d0      ; lookup word from KL_HFM_ML_V_b table with d0 as input
</code>```


问:
Decompress NAND dump (custom LZ77/LZSS?)
I'm trying to to reverse engineer a very old STB (it was in service between 2005 and 2014). I successfully dumped the NAND of the box but I'm struggling with the compression used.

Here is an extract of the NAND dump which contains the NT loader (it's not being actually used, they use a modified FAT filesystem on the harddrive so guess it was easier to modify something existing)

```<code>003E9C80  C3 4E 54 4C  44 52 06 A0   3C 6E E2 98  AC C5 20 00   .NTLDR..<n.... .
003E9C90  60 0D 0A 52  65 6D 6F 76   65 20 64 69  73 6B 73 20   `..Remove disks
003E9CA0  6F 72 4C 74  68 65 20 8F   6D 65 32 61  2E FF 6B 44   orLthe .me2a..kD
003E9CB0  A1 51 20 E9  72 23 94 09   50 72 65 73  4C 90 61 6E   .Q .r#..PresL.an
003E9CC0  79 20 6B 65  47 74 6F 20   9A 09 74 61  72 74 23 6B   y keGto ..tart#k
003E9CD0  83 AC CB D8  07 53 B9 1F   74 11 64 A1  FF 07 3D FC   .....S..t.d...=.
</code>```

On the actual harddrive the following can be found:

```<code>00000170  4E 54 4C 44  52 20 20 20   20 20 20 00  00 00 00 00   NTLDR      .....
00000180  55 00 00 00  00 00 00 00   00 00 00 00  00 00 00 00   U...............
00000190  00 00 00 00  00 00 00 00   00 00 00 00  00 00 00 00   ................
000001A0  00 00 00 00  00 00 00 00   00 00 00 00  0D 0A 52 65   ..............Re
000001B0  6D 6F 76 65  20 64 69 73   6B 73 20 6F  72 20 6F 74   move disks or ot
000001C0  68 65 72 20  6D 65 64 69   61 2E FF 0D  0A 44 69 73   her media....Dis
000001D0  6B 20 65 72  72 6F 72 FF   0D 0A 50 72  65 73 73 20   k error...Press
000001E0  61 6E 79 20  6B 65 79 20   74 6F 20 72  65 73 74 61   any key to resta
000001F0  72 74 0D 0A  00 00 00 00   00 AC CB D8  00 00 55 AA   rt............U.
</code>```

Now I've been reading a lot lately on all kinds of compression and I've been trying really hard to get my head around the compression used but just can't figure it out. It looks like a LZ77 or LZSS compression but I just can't figure out how the length/offsets are calculated.

For example on the 3rd line you have "me2a" which should be decompressed to "media" but there is only a single byte used (0x32) that should contain both the marker bit(s), offset and length. I presume it's referring to the "di" from "disks" in the line above, but as stated, I just can't figure it out (yet).

Any help would be greatly appreciated!


问:
Getting "Access violation executing location" error
I am trying to execute this assembly function. But after calling Test_init function, I am getting "Access violation executing location"  error at line "add     esp,4".

```<code>sub_402110  proc near       ; CODE XREF: _main+37p

var_AC      = dword ptr -0ACh
var_A8      = dword ptr -0A8h
var_A4      = dword ptr -0A4h
var_A0      = dword ptr -0A0h
var_9C      = dword ptr -9Ch
var_95      = byte ptr -95h
var_94      = byte ptr -94h
Dest        = byte ptr -38h
var_14      = byte ptr -14h
var_4       = dword ptr -4

        push    ebp
        mov ebp, esp
        sub esp, 0ACh
        xor eax, ebp
        mov [ebp+var_4], eax
        mov [ebp+var_A4], offset aHelloWorld ; "Hello World"
        lea eax, [ebp+var_94]
        push    eax
        call    ds:Test_Init
        add     esp,4
        mov ecx, [ebp+var_A4]
        mov [ebp+var_A0], ecx
        mov edx, [ebp+var_A0]
</code>```

Can anyone please help me to way out from this problem. Thank you for your time.


问:
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in cpu.esp is being updated after this code is getting executed, while I need it to happen before.

```<code>class TraceRegisters(DBG_Hooks):
    def dbg_bpt(self, tid, ea):
        fn = GetFunctionName(ea)
        if fn.startswith("Read"):
            print "%s(0x%x)" % (fn, Dword(cpu.esp+4))
        elif fn.startswith("Write"):
            print "%s(0x%x, 0x%x)" % (fn, Dword(cpu.esp+4), Dword(cpu.esp+8))
        return 0
</code>```

I'm feeling sorry for doing it in a callback that is intended for deciding if the debugger should stop, but I just couldn't find anything better.

Is there a way to do what I want with just the power of IDAPython and/or plain IDA?

Title: Tracing function call args with IDA Pro


问:
"Sound Box" Custom Message
I am trying to put a custom message on a "sound box" in a stuffed animal. Here is a picture of the circuit board:

The blue wires lead are connected to the speaker. I am thinking that those pads coming out of the chip that are not connected to anything might be used to put a new message on there. This board was in an "animal" and was not originally supposed to be modified so there is no microphone. Would this be possible? Any ideas on how I would do it?

Title: "Sound Box" Custom Message


问:
OpenOCD, Buspirate JTAG reads fail after short time
I have a board that I'm reversing - and attempting to dump the image out of the NAND flash.

Board has a SAMSUNG s3c2440 SOC CPU, and there's a SAMSUNG k9f1g08u0d 128 MB NAND flash device.

I'm using a BusPirate through JTAG to connect. I am able to run OpenOCD and view the chip, dump registers, etc.

However, the whole setup is unstable. I'm running on a Linux host PC. Steps are:

power up the target

power up buspirate

start openocd daemon

start telnet into openocd daemon

enable debug_level 3

just watch the debug messages flow on the openocd daemon window.

the flow of messages stops after 15 seconds or so with the following error:

```<code>Error: 7399 146854 bus_pirate.c 1091 buspirate_serial_read() should have read = 15 actual size = 0
Error: 7399 146854 bus_pirate.c 1091 buspirate_serial_read() Error treading data timeout = 10, len = 0, size = 15
</code>```

I have a Buspirate 3, with the latest version 6.1 firmware.
Openocd is version 0.9.0

Any suggestions to get a setup to be more stable is welcomed.


问:
Finding the h.264 stream in a bytestream
I have a bytestream that contains h.264 bytestream packets in it. How can I find it?

Output from stream:
https://mega.co.nz/#!3llAnLaQ!pc1JPDpDOP6948F2x44LqeYm-p5CDnb91Da334rt4fY

The first 13 bytes don't have anything to do with the data, the next one always starts with 0x01, then 0x0000, then four unknown bytes, then 0x000000, the sequence number again, four more unknowns, and finally 0x00. This is being transmitted a UDP packet. The data seems to always be 1460 bytes long. The extra 0's at the end are an issue with my code and can be ignored.

There's a h.264 bytestream in there somewhere, I just don't know where/how to find it. It might be wrapped in a container or protocol or protobuf (unlikely but possible). Does anybody either see how to pick out the stream or recognize this as some known protocol? I can provide my code if needed but right now its a disgusting mess, more of a proof of concept.


问:
How to call DebugActiveProcessStop from disassembled code?
I am debugging an application. Another process is debugged by this application.

Here is the call

```<code>00705435  FF15 C0007500  CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>]
</code>```

I want to change call to DebugActiveProcessStop, what should I do ?