问:
Some more questions related to C++ exceptions (catchHigh)
I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start to end and comparing the ranges of the tryLow and tryHigh fields to the current state.

I mean I understand that catchHigh is simply the max state that the catch handlers can reach (inclusive?) (from here ehdata.h:140:

```<code>__ehstate_t     catchHigh;          // Highest state index of any associated catch
</code>```

) but I don't understand when this field can be actually useful.

However it seems that this value is used by the CRT anyway (vs2019 - frame.cpp:693):

```<code>/////////////////////////////////////////////////////////////////////////////
//
// GetRangeOfTrysToCheck - determine which try blocks are of interest, given
//   the current catch block nesting depth.  We only check the trys at a single
//   depth.
//
// Returns:
//      Address of first try block of interest is returned
//      pStart and pEnd get the indices of the range in question
//
RENAME_EH_EXTERN(__FrameHandler3)::TryBlockMap::IteratorPair RENAME_EH_EXTERN(__FrameHandler3)::GetRangeOfTrysToCheck(
    RENAME_EH_EXTERN(__FrameHandler3)::TryBlockMap &TryBlockMap,
    __ehstate_t                                    curState,
    DispatcherContext                              * /*pDC*/,
    FuncInfo                                       * pFuncInfo,
    int                                            CatchDepth
) {
    TryBlockMapEntry *pEntry = FUNC_PTRYBLOCK(*pFuncInfo, 0);
    unsigned start = FUNC_NTRYBLOCKS(*pFuncInfo);
    unsigned end = start;
    unsigned end1 = end;

    while (CatchDepth >= 0) {
            _VCRT_VERIFY(start != -1);
            start--;
            if ( TBME_HIGH(pEntry[start]) < curState && curState <= TBME_CATCHHIGH(pEntry[start])
                    || (start == -1)
            ) {
                    CatchDepth--;
                    end = end1;
                    end1 = start;
                    }
            }

    ++start; // We always overshoot by 1 (we may even wrap around)
    _VCRT_VERIFY(end <= FUNC_NTRYBLOCKS(*pFuncInfo) && start <= end);
    auto iterStart = TryBlockMap::iterator(TryBlockMap, start);
    auto iterEnd = TryBlockMap::iterator(TryBlockMap, end);

    return TryBlockMap::IteratorPair(iterStart, iterEnd);
}
</code>```

Btw TBME_HIGH is tryHigh field and TBME_CATCHHIGH is the topic - catchHigh.

However I can't seem to follow the above code - what I can do however is show you my example:

```<code>#include <cstdio>
#include <Windows.h>
#include <winnt.h>
#include <malloc.h>
extern "C" void* _ReturnAddress(void);
void f() {
    if (!printf(""))
        throw 9;
}

struct test {
    test();
    test(const test&);
    ~test();
    test f1(int, test);
    int a, b;
} f(int, test) throw(int) {
    test tmp;
    f();
    return tmp;
}

int printfproxy(size_t szbuffer, const char* format, ...)
{
    va_list lst;
    va_start(lst, format);
    char* tmp = (char*)_alloca(szbuffer);
    int a = vsprintf(tmp, format, lst);
    OutputDebugStringA(tmp);
    return a;
}

test test::f1(int, test a) throw(int) {
    test tmp;
    return tmp;
}

test::test() : a((int)_ReturnAddress()), b(0) {
    printfproxy(sizeof "ctor test @ ffffffff\n", "ctor test @ %X\n", a);
}

test::test(const test& arg) : a((int)_ReturnAddress()), b(arg.a)
{
    printfproxy(sizeof "copy ctor test @ ffffffff\n", "copy ctor test @ %X\n", a);
}

test::~test() {
    printfproxy(sizeof "de ctor test @ ffffffff\n", "de ctor test @ %X\n", a);
}

struct test4 {
    int a[3];
} f4(int, struct test4 arg) throw(int) {
    test4 tmp;
    return tmp;
}

void main() {
    test tmp;
    test4 tmp2;
    try {
        test tmp, tmp3;
        test4 tmp2;
        try {
            if (tmp.b == 0)
#line 93
                f(9, tmp).f1(9, tmp), f(7, tmp);
            else
                f(7, tmp), f(7, tmp), f4(7, tmp2);
        }
        catch (int) {
            try {
#line 99
                printfproxy(sizeof "handler 2147483647""\n", "handler %d""\n", __LINE__); test tmphandler; f(7, tmp);
            }
            catch (int) {
#line 102
                printfproxy(sizeof "handler 2147483647""\n", "handler %d""\n", __LINE__);
            }
        }
#line 106
        if (tmp.b == 0)
            f(9, tmp).f1(9, tmp), f(7, tmp);
        else
            f(7, tmp), f(7, tmp), f4(7, tmp2);
    }
#line 111
    catch (int) { printfproxy(sizeof "handler 2147483647""\n", "handler %d""\n", __LINE__); }
}
</code>```

Here is the tryblockmap generated by the compiler:

```<code>stru_40C9F0     TryBlockMapEntry <11, 12, 13, 1, offset stru_40C9C0> ; offset loc_401554
                TryBlockMapEntry <4, 9, 13, 1, offset stru_40C9D0> ; offset loc_4014FF
                TryBlockMapEntry <1, 18, 19, 1, offset stru_40C9E0> ; offset loc_4015FD
</code>```

And here is the point of first exception inside main function (at line 93):

We see that at this point the state is 5 (state is represented by var_4 in ida).

Mind the break-point - the actual exception happens at the call to f - few instructions later.

So we look at the smallest range that fits - that is the second trymapentry (offset loc_4014FF). So we execute the handler at line 99:

Now there in the initial instructions, more specifically the call to printfproxy the state is still - the tryHigh of the previous step + 1 so 10. Then when we enter the call to f the state becomes 0xC (12). Now at this point when the exception occurs inside f the first trymapentry (offset loc_401554) is executed (line 102) for the same reason as before - it's the smallest range that fits the current state (note that the range is inclusive since:

```<code>typedef const struct _s_TryBlockMapEntry {
    __ehstate_t     tryLow;             // Lowest state index of try
    __ehstate_t     tryHigh;            // Highest state index of try
</code>```

and so the 12 fits here at the end).

Also funny thing to notice is that the appropriate trymapentry starts at state 11 and so if the exception occurred in the beginning where we established that the state is 10 the outermost handler will be executed (line 111) - however that is impossible since the compiler has determined that printfproxy can't throw.

Anyway now let's execute another handler further:

Here we continue execution at line 106 where another exception is about to occur. This time the state is set to 0xE (14). Which means it's time to execute the outermost handler (offset loc_4015FD @line 111)  because it's the only range that fits.

My point is we never once reached a point where catchHigh was needed. We only used the idea of the smallest possible range that fits current state. My question is - could there be a situation where this field would be actually needed to determine the right handler?

Note smallest possible range in my mind is if the range is contained in another range - that range. If I had to write an algorithm to find the right handler given state and tryblockmap I would do something like (pseudo-code using range for loop) and never use catchHigh:

```<code>findhandler(
    state,
    tryblockmap
) {
    int loweststate = INT_MIN, maxstate = INT_MAX;
    auto handler = nullptr;
    for (auto a : tryblockmap)
        if (a.tryLow <= state && a.tryHigh >= state) //if it fits
            if (a.tryLow > loweststate || a.tryHigh < maxstate) //if it smaller range then previous handler
                handler = a, loweststate = a.tryLow, maxstate = a.tryHigh;

    return handler;
}
</code>```

Note - I'm using VC++6.0 SP5 PP5 to compile.


问:
Combine two ELF binaries
Without having access to the original source code, is there a way to combine two ELF binaries with the main() in the first binary pointing to the main() in the second binary ?

In other words, I mean adding memory section for the content inside the second main().

ContentLicense: CC BY-SA 4.0

Title: Combine two ELF binaries


问:
What to do with a text file of disassembly code and binaries?
I am fairly new to software reverse engineering and I'd like to know how proceed with analyzing a   program if I have a text file of disassembly code and a bin file of binary data. I understand assembly language. But, is there a better way than just going through the text file, instruction by instruction, trying to figure out what the program is doing?  I don't have IDA Pro but I have Ghidra. Would I use Ghidra somehow? Or would I just use a debugger like x64dbg?</p>


问:
Hashing algorithm of length 50
I have been trying to reverse-engineer an Android application using Jadx for static analysis and Frida for dynamic analysis. The end goal is to be able to re-create the request signature, sent as a "x-signature" header, to replicate the API requests programmatically.

I am trying to figure out how a function, given an app key and a HashMap of request parameters as input, manages to output the signature "ab21c1009004ad4c88477eef2340998bb6f8c774732e1e9e03".

This hexadecimal string is of length 50 so, since a hexadecimal represents four bits, it means the hashing algorithm that generates it must create 200 bits (right?). However, according to https://en.wikipedia.org/wiki/List_of_hash_functions, there is none, and especially not the most well-known ones, such as SHA1, SHA-256 or MD5, that the code seems to be using very often, especially MD5.

What am I missing please? I don't know much about truncating and folding but I believe it's unlikely to be the issue here, since I've spent a lot of time getting familiar with the source code and nowhere has one of these techniques appeared, unless hidden in a common library's method.

Title: Hashing algorithm of length 50


问:
Writing a Ghidra FileSystem Module for 8-bit era disk images in which files have no header, format, or magic bytes
I've given myself a project of writing Ghidra Loaders and FileSystems for an 8-bit retrocomputing platform, namely the Sinclair ZX Spectrum. But I'm new to Ghidra, Java, and Eclipse.

When developing a Ghidra Loader Module you deal with one single file, parse its headers and format to tell Ghidra which pieces of the file it needs, what memory regions it would load to, where its entry points are, etc.

This is fine because there are file formats that have been devised for retro system emulators to encapsulate a single game etc.

But there are also files for those emulators which represent disk images and cassette tape images containing multiple files.

But unlike modern systems, files in these old disks are just arrays of bytes. They don't have a format, a header, or any magic word bytes to identify them. Any metadata needed to load and run them is part of the disk format, not part of the file.

So I've figured out how to make a Ghidra FileSystem but I can't see a way to pass this file metadata directly to Ghidra from the FileSystem. Instead, I only find a way to pass a byte stream to Ghidra, which then gets passed to the Loader system, which relies on identifying the byte stream by looking for recognizable file formats/headers/magic bytes.

Must I then create "fake" wrappers for these files that make them identifiable and create a matching Loader that recognizes them?

Or is there a system already present in Ghidra for passing metadata directly along with such "raw" binary files that I just haven't discovered?

Ghidra FileSystems cover things such as disk image files, archive and compression formats, and even fat executable binaries. It's quite possible there are already FileSystem modules in there for formats that package raw binary code blobs. How do they do it?

(By the way, the only other project I've found so far that tackles a retro disk image format uses a hack to list the files in the Loader option dialog rather than making a FileSystem.)


问:
USB packet capture; understanding the communication
Good Day-

I have captured via Wireshark some data and am attempting to understand it as well as the communication protocol for USB.

This one capture contains the sequence 02010c, which tells me the firmware version of a particular target. Wireshark says the request is in an earlier sequence- but I am not understanding where in that particular request is the actual 'request'. So I believe I am having trouble understanding how the URBs are working.

```<code>Frame 32625: 91 bytes on wire (728 bits), 91 bytes captured (728 bits) on interface wireshark_extcap1928, id 0
    Interface id: 0 (wireshark_extcap1928)
    Encapsulation type: USB packets with USBPcap header (152)
    Arrival Time: May  8, 2020 14:02:24.741579000 Eastern Daylight Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1588960944.741579000 seconds
    [Time delta from previous captured frame: 0.000943000 seconds]
    [Time delta from previous displayed frame: 0.000943000 seconds]
    [Time since reference or first frame: 141.773912000 seconds]
    Frame Number: 32625
    Frame Length: 91 bytes (728 bits)
    Capture Length: 91 bytes (728 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb]
USB URB
    [Source: 3.12.1]
    [Destination: host]
    USBPcap pseudoheader length: 27
    IRP ID: 0xffffd50384c4da20
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x0009)
    IRP information: 0x01, Direction: PDO -> FDO
        0000 000. = Reserved: 0x00
        .... ...1 = Direction: PDO -> FDO (0x1)
    URB bus id: 3
    Device address: 12
    Endpoint: 0x81, Direction: IN
        1... .... = Direction: IN (1)
        .... 0001 = Endpoint number: 1
    URB transfer type: URB_INTERRUPT (0x01)
    Packet Data Length: 64
    [Request in: 32618]
    [Time from request: 0.008964000 seconds]
    [bInterfaceClass: HID (0x03)]
Leftover Capture Data: 7e107bff000882000302010c003500000000000000000000…
</code>```

The request that is referenced:

```<code>Frame 32618: 27 bytes on wire (216 bits), 27 bytes captured (216 bits) on interface wireshark_extcap1928, id 0
    Interface id: 0 (wireshark_extcap1928)
    Encapsulation type: USB packets with USBPcap header (152)
    Arrival Time: May  8, 2020 14:02:24.732615000 Eastern Daylight Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1588960944.732615000 seconds
    [Time delta from previous captured frame: 0.000033000 seconds]
    [Time delta from previous displayed frame: 0.000033000 seconds]
    [Time since reference or first frame: 141.764948000 seconds]
    Frame Number: 32618
    Frame Length: 27 bytes (216 bits)
    Capture Length: 27 bytes (216 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb]
USB URB
    [Source: host]
    [Destination: 3.12.1]
    USBPcap pseudoheader length: 27
    IRP ID: 0xffffd50384c4da20
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x0009)
    IRP information: 0x00, Direction: FDO -> PDO
        0000 000. = Reserved: 0x00
        .... ...0 = Direction: FDO -> PDO (0x0)
    URB bus id: 3
    Device address: 12
    Endpoint: 0x81, Direction: IN
        1... .... = Direction: IN (1)
        .... 0001 = Endpoint number: 1
    URB transfer type: URB_INTERRUPT (0x01)
    Packet Data Length: 0
    [Response in: 32625]
    [bInterfaceClass: HID (0x03)]
</code>```

I've read a number of different examples on in, out, transfer packets. I'm just failing to see how this is working.

Is it as simple as... there's another pair of packets further up(down?) that is sending a command to the end point, and the machine is sitting there waiting to respond with an 'in' request from the host to let it know to send the data?


问:
help about methodology
I am a beginner in reverse engineering.

For a challenge I need to reverse a code in python this code use enigma algorithm :
To found the good configuration to decode the enigma code received.

The goal is to found the good configuration the bellow :

```<code>def create_configuration():
number_of_rotors = random.randrange(3, 6)
rotates_amounts = [3, 5, 7, 11, 17, 19, 23]

result = []
for _ in range(number_of_rotors):
    rotor = "".join(random.sample(string.ascii_uppercase, 26))
    rotates_amount = random.choice(rotates_amounts)
    result.append([rotor, rotates_amount])
return result
</code>```

After analyse I decided to make a bruteforce because I can see a random.choice and it's "impossible" to found exacly the sames configuration as the server who encoded the message. For That I modify this code :

number_of_rotors is a number between 3 and 6 logically it's will be a loop [3, 4, 5, 6]

rotates_amounts is all the possibilities numbers for the originally list ([3, 5, 7, 11, 17, 19, 23])

code :

```<code>def create_configuration(number_of_rotors, rotates_amounts):
result = []
    for i in range(number_of_rotors):
    rotor = "".join(random.sample(string.ascii_uppercase, 26))
    rotates_amount = rotates_amounts[i]
    result.append([rotor, rotates_amount])
return result
</code>```

I added The generator function to generate all the possibilities as (i am using itertools):
  [3,3,3,3,3,3,3],[3,3,3,3,3,5],...

```<code>def generators():
values = []
val = [3, 5, 7, 11, 17, 19, 23]
for _set in product(val, repeat=7):
    values.append(_set)
return values
</code>```

This part of code also generate randomly ascii list :

```<code>rotor = "".join(random.sample(string.ascii_uppercase, 26))
</code>```

So my questions is :

I don't know if it's the good approach for this problem ? If people have ideas.

Thank you very much.

Title: help about methodology


问:
Force gcc to use more complex instructions
I am reverse engineering a piece of assembly. I am trying to write the equivalent code in C, however, when I compile my code, gcc prefers to use simple instructions instead of the complex ones that are used in my assembly. I was wondering if I can suggest or force gcc to use more complex instructions.

EDIT: I have already tried using the -O options but they will change lots of other variables and therefore, don't look like a good solution.

You can find examples here:

```<code>// original assembly
lea     rdx, [rax+0x20]

// generated by gcc
add     rax, 0x20
mov     rdx, rax

// C code
0x20+((uint8_t *)lParm1)  // long lParm1
</code>```

```<code>// original assembly
test    eax, eax

// generated by gcc
mov     [rbp-0x10], eax
cmp     [rbp-0x10], 0x0

// C code
if (!iVar)  // int iVar
</code>```

```<code>// original assembly
mov     eax, [rax+0x40]

// generated by gcc
add     rax, 0x40
mov     eax, [rax]

// C code
(float)*(int *)(lParm1 + 0x40)
</code>```


问:
Help with decoding japanese text from binary
I'm building a fan website for a japanese mobile game. I'd like to have access to game data like character stats and ability names. I'll start by saying that this is the first time I have done something like this and could use any help.

This is what I have done so far.

There is a folder containing custom .pack files, which I think are binary files of unknown format.

Within this folder there is also a .dat file with the names of the .pack files followed by a string of numbers (e.g. master_attribute.pack  8CDF54ED0AE78C4FF663C3F639F28B7F). I do not know if this is related.

Each .pack file starts with the hex signature C9, which according to this wiki, is a .com file, which i think is an outdated executable file?

Most of the .pack files, when read as utf-8, contain snippets of the information I'm looking for but it is riddled with out-of-place continuation bytes (this is likely irrelevant because I am naively assuming that these files are utf-8 text files).

Here is an example of one of the smaller files, the japanese text are relevant and are not random.

As I said in the start, this is my first exposure to such things. I am stuck and welcome any help on what I can do next.

For reference, here are some of the files


问:
radare2 stop on lazy loaded library (gdb's stop-on-solib-events)
I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via

```<code>set stop-on-solib-events 1
</code>```

I've  been unable to find anything related for radare2. Help would be greatly appreciated.


问:
Recommended plugins for x64dbg
I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks.

The more you can elaborate, the more it will help. I believe that due to google searches, many people will find this thread and will use it to jumpstart their x64dbg usage.

If you need topics to make the answers more specific, I am looking for plugins that

ease malware analysis

aid dynamic debugging and

assist in exploit development

One answer per plugin please.

Title: Recommended plugins for x64dbg


问:
Reversing Pyarmor Discussion
Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what pyarmor looks like. Its infuriating to reverse however I think I might be onto a method for completely reversing pyarmor. Wanted to get some thoughts on this idea. (Sorry for all the screwed up images, im working on getting a hang of the markdown)

Once you unpack your python executable your left with a ton of unimportant files, however some of these files are interesting. Something that is important for the self unpacking is pytransform.

Part of what I was thinking is that you could call your functions normally from the included pyarmor dll as shown here.

Now whats interesting is that if you crack it open with something such as IDA you can call some of the readable functions without issue and it will return data.

Our dll entry point is pretty uneventful, its not packed or anything which makes our job a bit easier. It makes a simple computational check and decides whether it should end itself or to decrypt our file. Still playing around with the dll and seeing what each functions does.

One last final thing I found that for sure is interesting is this:

If we decompile our pytransform.pyc file we are left with some of our keygen source, which I am pretty sure can be found all on the github anyways. However since this is a paid version I still figured cracking it open wouldn't hurt.

Anyways, thoughts on calling functions from our dll and trying to pass it args? If that doesn't work ill try dumping it at runtime however that gets messy.

Title: Reversing Pyarmor Discussion


问:
memory addresses in Hex View are always byte-aligned in new versions of IDA
In IDA < 7, Hex View shows addresses starting from any memory location you choose (both synchronize or G + address). For example, asking for 0019E7EC shows:

```<code>0019E7EC  48 4B 46 42 39 39 2D 32  51 4D 38 35 33 2D 43 41  HKFB99-2QM853-CA
0019E7FC  32 30 30 30 00 CD 48 01  A0 E8 19 00 41 CD E1 5D  2000.-H.áÞ..A-ß]
</code>```

In IDA > 7, Hex View shows addresses only aligned on 16-byte boundaries (address & 0FFFFFFF0). For example, asking for 0019E7EC now shows:

```<code>0019E7E0  A4 EA 19 00 5C 17 EF 00  00 F0 2C 00 48 4B 46 42  ¤ê..\.ï..ð,.HKFB
0019E7F0  39 39 2D 32 51 4D 38 35  33 2D 43 41 32 30 30 30  99-2QM853-CA2000
</code>```

Is there a way to restore the old Hex View behavior?


问:
what are modern hooking techniques?
i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was wondering what are modern hooking techniques?

can anybody reference me to examples of "modern hooking techniques" and examples of them with code to make understanding easier?

when referring to hooking, malware researchers usually use manual hooking or use frameworks such as pintools/frida?

please elaborate on what you think is modern hooking and please share references or code samples, as it can greatly help me and i believe a lot of other people interested in becoming better at reversing/malware analysis.

thank you for your efforts

Title: what are modern hooking techniques?


问:
RopGadget buffer overflow
I have a question,

I have a device that i can perform on it buffer overflow.

The problem is that is that there is an ASLR(on all addresses in /proc/binary/maps, but not on the binary itself, but all addresses in binary are starting with two null bytes for example 0x00002000) and there is as well as DEP(on heap an stack).
I can override the return address(for the first gadget) but not possible to write additional addresses for ROP since all addresses from the binary starts with null bytes.
I also can`t leak an address and it is not possible to perform brute force in order to guess addresses for example from libc.
Does anyone have an idea how can perform the overflow in this case ?

Title: RopGadget buffer overflow


问:
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.

it has

ARM soc/mcu/processor

WI-FI (broadcom)

LCD touch screen + 16bit STM mcu.

EEPROM 4Kbyte on i2c bus

1 Giga bit NAND flash memory.

125 M byte of RAM

I2C bus on the motherboard.

Lacks features: i would like to start the timer only after the device reach the target temperature: with meats, it is ok to add food to the water as it heats. Not for Poached eggs!

I downloaded the firmware update payload motorola srecord SREC format concatenated with a big blob of data like BMP & i18n files. i used ghidra to look inside the code SREC : ARM 32bit/16bit big endian.

Qemu emulation with unicorn framework: i traced mcr instructions. it seems the firmware is configuring the MPU this way:

Recon Then i was able to id "Boot_console_put(char *)" function and a memory address where the firmware write char by char all the boot  message related strings: 0x3402f404

Console Output Then the emulated firmware update payload seems to be stuck on a loop when trying to acces and I2C slave (could be the eeprom) printing this:

```<code>[boot] entering HW_MCASIC_init
[boot NVM] I2C: SDA seems stuck low!
[boot NVM] I2C: SDA seems stuck low!
[boot NVM] I2C: SDA seems stuck low!
</code>```

the code dealing with I2C seem a bit too much convoluted for a rapid understanding

The question :  i would like to guess What are all the others address the firmware is referencing in the code. Searching google and github for similar constant/base address & offsets didn't help... google search result returning off topic commercial links.


问:
Display open handle ids in IDA Pro
Is there a way to display all the open handles of a process in IDA Pro while debugging it?

I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.

I want to display the list of all the open handles in the process:

```<code>Open file handles
Open registry handles
Open socket handles
</code>```

Debuggers such as Olly Debugger allow to see the complete list. Is it possible to see the same in IDA Pro?

Information should be as shown below:

```<code>handle_id - path to the file
</code>```

Thanks.

Title: Display open handle ids in IDA Pro


问:
Ghidra export to C header, how to remove ".conflict"?
When using the export to C header functionality of Ghidra it keeps outputting double and triple symbols with ".conflict" appended. When I change how the data type manager should deal with conflicts it still keeps outputting them. Does anyone know how to resolve this?

It prevents Ghidra from parsing that same output back into another version of the application.

edit: adding clarification as requested
I'm playing around with ioncube and what I'm trying to do is:

Compile PHP with debug enabled

Extract type information

Use type information on the ioncube executable

What I mean with 'use type information' is that I want to have structures available so that I can apply them manually. However when right clicking on the type manager and exporting the 'php with debug enables' to a C header, GHIDRA is not able to import the header file.

All the issues during import seem to be in regards to anonymous structures that besides the name also receive a '.conflict' append. I've temporarily resolved this by cleaning them up manually and just create the bare minimum to import. However it would be nice to do this as intended by GHIDRA.

Hope this clarifies a bit more.


问:
Specifying DLL imports within the PE?
I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them).
Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their addresses to the dumped function pointer table.

See below a photo of the on disk dumped PE function table and the list of functions

Title: Specifying DLL imports within the PE?


问:
reverse engineering TP link TL-WR841N router
I am trying to reverse engineer my routers firmware. So as the first step I took uart pins and I could login to the router through serial console. I need to export the binary files to my host system. My host PC is running ubuntu. I have tried SSH login but I am not able to login as the username and password is unknown. Also username and password is required for SCP too. So how can I copy files to host? Please suggest any method. How should I approach this situation?</p>


问:
Reverse engineering old mmo
I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and plain text shows up in the .rdata section except for dwords. Is this of any importance in reverse engineering said application?

Title: Reverse engineering old mmo


问:
How to bypass SSL certificate pinning on Windows 10
When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates.

Because of this, many applications use HTTPS to communicate with their servers. Bypassing this has become easy to do with tools like Charles (SSL Proxy).

As a result, some applications have begun to use Certificate Pinning which does not allow a proxy to intercept traffic.

What are some solutions around this problem, ideally, I'm looking for a methodology, tools and techniques to do this in Windows applications.


问:
Find the caption of VB5/6 Form Object in Memory Dump
I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make the form visible)
There are multiple forms so I am trying to work out specifically which form is being accessed.
To work this out I made some sample code like this:

```<code>Public gFormToActivate As Form

Private Sub cmddoDo_Click()
    gsCurrentLine = "START: Set gFormToActivate = FormDoDo"
    Set gFormToActivate = FormDoDo
    gsCurrentLine = "END: Set gFormToActivate = FormDoDo"
    gsCurrentLine = "START: Me.Hide"
    Me.Hide
    gsCurrentLine = "END: Me.Hide"
End Sub
</code>```

The ZOrder is later set using code like this:

```<code>Private Sub Command1_Click()
    FormDoDo.Show
    FormDada.Show
    Form2.Show vbModal
    gsCurrentLine = "START: gFormToActivate.ZOrder 0"
    gFormToActivate.ZOrder 0
    gsCurrentLine = "END: gFormToActivate.ZOrder 0"
End Sub
</code>```

Using IDA Pro I look at the disassembly:

```<code>    .text:00403674 C7 45 D4 18 2B 40 00                                            mov     dword ptr [ebp-2Ch], offset aStartSetGformt ; "START: Set gFormToActivate = FormDoDo"
    .text:0040367B C7 45 CC 08 00 00 00                                            mov     dword ptr [ebp-34h], 8
    .text:00403682 FF D7                                                           call    edi ; __vbaVarCopy
    .text:00403684 A1 24 40 40 00                                                  mov     eax, dword_404024
    .text:00403689 85 C0                                                           test    eax, eax
    .text:0040368B 75 10                                                           jnz     short loc_40369D
    .text:0040368D 68 24 40 40 00                                                  push    offset dword_404024
    .text:00403692 68 60 15 40 00                                                  push    offset dword_401560
    .text:00403697 FF 15 4C 71 40 00                                               call    ds:__vbaNew2
    .text:0040369D
    .text:0040369D                                                 loc_40369D:                             ; CODE XREF: .text:0040368B↑j
    .text:0040369D 8B 0D 24 40 40 00                                               mov     ecx, dword_404024
    .text:004036A3 68 E4 26 40 00                                                  push    offset dword_4026E4
    .text:004036A8 51                                                              push    ecx
    .text:004036A9 FF 15 70 71 40 00                                               call    ds:__vbaCastObj
    .text:004036AF 50                                                              push    eax
    .text:004036B0 68 60 40 40 00                                                  push    offset dword_404060
    .text:004036B5 FF 15 08 71 40 00                                               call    ds:__vbaObjSet
    .text:004036BB 8D 55 CC                                                        lea     edx, [ebp-34h]
    .text:004036BE 8D 4D DC                                                        lea     ecx, [ebp-24h]
    .text:004036C1 C7 45 D4 68 2B 40 00                                            mov     dword ptr [ebp-2Ch], offset aEndSetGformtoa ; "END: Set gFormToActivate = FormDoDo"
</code>```

Based on this I suspected form variable might be stored at "offset dword_404060". Any suggestions on good next steps to work out in more detail how to get the properties of this object? In WinDbg looking a this address shows the following. I have been reviewing http://sandsprite.com/vb-reversing/files/Alex_Ionescu_vb_structures.pdf to better understand VB structures but haven't worked out a solution yet


问:
IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?
I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself.

Unedited function:

Corrected function:

I can't see anything wrong with [rsp+20h] as it points into the fixed allocation of 0x48 bytes.
So what does that red mark indicate and what causes it?


问:
Removing/bypassing a BIOS whitelist
I am trying to bypass or erase the BIOS whitelist on my Thinkpad T440p. So far I've

used flashrom and a soic8 clip to dump the bios to a bios.img file

made another dump and compared with diff bios.img bios2.img to verify the file

used the UEFITool to find and extract the relevant section containing the string "Unauthorized network card ..." as an .efi file

Analyzed that section using Ghidra

Found a function in Ghidra (FUN_00010ec4) that contains said string (DAT_000104d0), and an entry function that calls this function.

Below, I'll post the function containing the string first, and then the entry function. Also, I'll put a link there to the extracted body.

```<code>void FUN_00010ec4(undefined8 param_1,undefined *param_2,undefined8 param_3,undefined8 param_4)

{
   if (param_2 == (undefined *)0x0) {
     param_2 = &DAT_00010ec0;
  }
  (**(code **)(DAT_00011040 + 0x170))(0x200,param_1,param_2,param_3,&DAT_000104d0,param_4);
  return;
}
</code>```

The above function gets called from here:

```<code>longlong entry(undefined8 param_1,longlong param_2)

{
  longlong lVar1;
  undefined8 local_res18;
  undefined8 *local_res20;
  undefined local_18 [24];

  FUN_00010f08(param_1,param_2);
  lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010480,0,&DAT_00011058);
  if (-1 < lVar1) {
    lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010410,0,&DAT_00011070);
    if (-1 < lVar1) {
      lVar1 = (**(code **)(DAT_00011040 + 0x140))(&DAT_000103f0,0,&DAT_00011078);
      if (-1 < lVar1) {
        lVar1 = (**(code **)(DAT_00011040 + 0x140))(&LAB_00010460,0);
        if (-1 < lVar1) {
          DAT_00011060 = *local_res20;
          local_res18 = 0;
          _DAT_00011068 = &LAB_00010b54;
          (**(code **)(DAT_00011040 + 0x80))(&local_res18,&DAT_000103d0,0,&DAT_00011068);
          DAT_00011028 = local_res18;
          FUN_00010ec4(0x10,FUN_00010cf8,0,local_18);
          lVar1 = 0;
        }
      }
    }
  }
  return lVar1;
}
</code>```

The body, as well as the dumped .img can be found here.

Now I don't know what to do with this. Could I just remove the line FUN_00010ec4(0x10,FUN_00010cf8,0,local_18); and the function would never get called, thus freeing me from the whitelist? What other possibilities do you see to get around it?

This is the first time I deal with BIOS-modding, and I really don't want to brick my laptop. Also I'm sorry, if I use the wrong tags. I'm open for suggestions for better fitting ones.

Title: Removing/bypassing a BIOS whitelist


问:
Intercepting packets from Electron App to keyboard in Linux
I have a USB keyboard which has an Electron app to set the macros on the keyboard. I unpacked the app.asar file, and the JS files seem to indicate that it is a ReactJS app, and is a minified production build, and obfuscated too much to reverse engineer.

Another way to approach the problem seemed to be to use USB sniffer. I chose WireShark for the job. I wanted to capture all the data packets sent from the app to the keyboard, and hoped to reverse engineer that. The problem is, I can't find a way to capture the raw USB stream. I tried using WireShark to monitor usbmon0, but there is too much metadata, and separating the raw data from the protocol metadata seems to be a daunting task.

I do not have a hardware USB sniffer or a JTAG debugger. Is there a simple way to capture all the raw data going from the app to the keyboard?


Title: ARMv7 Word Patch (CBZ)

Body:
I'm disassembling an iPhone app

I'm trying to batch the instruction CBZ -> CBNZ

Instruction Code: D9 09 00 34

As per my understanding, CBZ will jump to the address if value of register is 0

I have tried to convert it to CBNZ D9 09 00 35 but that didn't help

D9 09 00 34

00000000: 01000100 00111001 00100000 00110000 00111001 00100000 D9 09 00000006: 00110000 00110000 00100000 00110011 00110100 00001010 00 34.

D9 09 00 35

00000000: 01000100 00111001 00100000 00110000 00111001 00100000 D9 09 00000006: 00110000 00110000 00100000 00110011 00110101 00001010 00 35

I appreciate your support


问:
Where are private keys for Google Play stored on an android device?
I am running an application in BlueStacks that was installed with Google Play and am trying to look at network packets which are encrypted using RSA over TLS. I can see the client key exchange packet in the TLS handshake but do not know where to find my private key within the BlueStacks emulator to decrypt the messages after the handshake (I am trying to man-in-the-middle myself). Where is this located?</p>


问:
How do I implement register pages in Sleigh?
I'm working on creating a processor definition for the  Motorola / NXP HC11 using the Sleigh language for Ghidra. A definition for the HC12 already exists, so I'm working off of that.

The HC12 organizes its instructions into two pages: Page 1 with no prefix, and Page 2 with a prefix of 0x18:

The HC11, on the other hand, has two more pages of registers:

The HC12 processor definition uses a context variable and a recursive constructor to determine if an instruction resides on page 2:

```<code>define context contextreg
    Prefix18       = (0,0)    # 1 if 0x18 is the first byte
    PrefixHCS12X   = (0,0)    # 1 if first byte is 0x18 so that HCS12X to use GPAGE for memory access
    UseGPAGE       = (1,1)    # 1 if should use GPAGE concatenated to lower 16-bit EA
    XGATE          = (2,2)    # 1 if in xgate instruction decode mode
;
</code>```

-

```<code>:^instruction  is XGATE=0 & op8=0x18; instruction  [ Prefix18=1; ] {}
</code>```

-

```<code>:ABA                     is XGATE=0 & (Prefix18=1 & op8=0x06)
{
    result:1 = A + B;
    addition_flags1(A, B, result);
    A = result;
}
</code>```

Another user, also defining an HC11 processor, just used 16-bit instructions instead:

```<code>define token withprebyte(16)
  pre   = (0,16);
define token byte(8)
  op8   = (0,7);

OFF: op8    is op8 { export *[const]:2 op8; }
IMM8: op8 is op8 { export *[const]:1 op8; }

:bsetY OFF,IMM8 is pre=0x181C; OFF; IMM8
{
  local temp = *:1 (Y+OFF);
  temp = temp | (IMM8);
  *:1 (Y+OFF) = temp;
}
:bclrY OFF,IMM8 is pre=0x181D; OFF; IMM8
{
  local temp = *:1 (Y+OFF);
  temp = temp & (~IMM8);
  *:1 (Y+OFF) = temp;
}
</code>```

The approach used on the HC12 seems bizarre and complicated to me. I also don't see how it will work for more than one page. Is there a reason I shouldn't just use 16-bit tokens for those instructions which reside on other pages? Is using the context variable, as the HC12 implementation does, more elegant in some way that I'm not seeing?


问:
PE Explorer vs. Debugger differences
I injected shellcode into an executable.
Entrypoint is set to first shellcode instruction.

Shellcode:

nop
nop
label:
nop
nop
jmp
label
nop
nop

which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90

Correct Values in PE can be seen with PE-Explorer

There are other values displayed in the debugger which translate to wrong instructions.

What am I doing wrong here?

Thanks

Title: PE Explorer vs. Debugger differences


问:
Reversing PyArmor + Pyinstaller
Created an application, protected by PyArmor and used pyinstaller. I'm trying to reverse engineer it. So far I've decompiled the exe into pyc files but it's still pyarmor encrypted I can only see the loading of the encrypted bytes.

Is there a way to decrypt PyArmor?

If not, it's my understanding it decrypts at runtime, how could I catch the unencrypted portion? I've been trying to use Ollydbg but can't figure out exactly how it works.

The program prints a Hello World but I can't seem to even find the instruction or the string in reference strings, any idea why or how to do it?

Title: Reversing PyArmor + Pyinstaller


问:
Subaru Eyesight Images and collision avoidance systems
I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that are stored in Subaru's eyesight collision avoidance camera system. In the eyesight handbook it details that several images are recorded leading up to and after an "event", but that you have to contact Subaru to get them downloaded. Multiple companies have systems similar with the known and publicly available way to download images off of Toyota's.

Another person in my industry witnessed a Subaru tech download images, and said they plugged directly into the camera system mounted on the inside of the roof. I was able to purchase a complete camera assembly off of ebay to tinker with. The assembly i have is from a 2016 forester, the same vehicle I own. Using my car I was able to get the voltages I need to power up the assembly externally to tinker with.

In my image, the left most white connector is the only connection between the cameras and car, that's what I got the voltages of. 2 pins at 12V, 1 at 2.3V, 1 at 2.6V, and two grounds. Two other pins had wires but no voltages, could possibly be for the CAN network?

As for the other two connectors on the board, the small white on near the top center is covered by a sticker when installed, there is no access to it without removing the sticker or disassembling the system, I would be led to believe this is for programming the module during assembly? I don't know if that's a reasonable assumption or not, but if so I would imagine its a possible angle of attack. For the gray connector, that one is exposed once the module is accessible in the vehicle. I would assume this is the port used by Subaru to download images so this might be the best possible route of attack.

While doing research on hardware hacking, I've come across JTAG and UART as common attack angles, unfortunately I have been unable to locate any such pinouts on the board. Looking at the data sheets for some of the chips, however, i was able to locate JTAG pins on some of the chips. With an integrated system like this, I'm not sure how accessing JTAG pins on a single component would help. Possible the images are all stored on one chip and other chips are used for processing data and handling the collision avoidance system?

Again, thanks for anything you guys have to say, any help is greatly appreciated.


问:
How to locate the function being applied on password
I am thinking of taking up ethical hacking as a hobby. So, I installed Burp Suite Community Edition and set it up with Firefox. I opened Instagram and tried to login with these details (just for testing):

```<code>Username: admin

Password: 123456
</code>```

However, when I intercepted the request in Burp, although the username was still admin , the password had been encrypted to something else. This means that somewhere in the code of the website, a formula tells Firefox how to convert 123456 to that string. How can I find this 'formula'?


问:
How are single-player games made into multiplayer ones?
I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game.

In an infrastructure perspective, I know you might have a server that receives packets from a client and makes sure all the other clients receive these packets as well.

For example, whenever a player moves, the client sends a message to the server. The server then redirects the messages to each connected client. Each connected client updates the player's position.

However, how the engineers can "inject a code" into the game to make it send a network packet to a server whenever a player moves? How can they "inject a code" into the game, so it listens to a network packet to react over it?

The "inject a code" term is between quotes because I don't even know if a code is really injected into the game. That's exactly what I'm curious about. Which techniques are used? How can this be possible?

Do they hook into specific events to execute a custom code that performs networking communication? If so, could you guys elaborate that a bit further?

I'm not planning to do so, and I have no prior experience with Reverse Engineering. I couldn't find anything on the Internet. Due to that, feel free to explain any "basic concept" as well. :) I'd like to understand as much as possible about it, and different opinions and perspectives are more than welcome.


问:
x64dbg break when hex string is loaded
I'm trying to break execution when a string is loaded in memory.

I can´t find the string by using the search for -> string references

So I press Alt + M and press Ctrl + B to search my string once is loaded, I can see it.
I try to right click on the address and set a hardware breakpoint but the software closes as soon as that string is shown so it doesn't break on the next run.

How can I set a condition so if a string appears a break happens?

I tried shift + F4 like with ollydbg and then I try to create an expression like this UNICODE[EAX] == "myString" but it says invalid expression...

I also tried the same expression using traceInto, but it definitely is not matching for the string, because I can't see it int he dump and even if I compare with a huge string, it doesn't do anything at all.

Any suggestions or ideas?

Title: x64dbg break when hex string is loaded


问:
pick dump from a specific process from virtualbox coredump
i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner
what i have learned so far that we could use virtualbox to dump the RAM for us so we can get a full memory dump and look at the actual assembly code of a packed program, and that what i did so far on a x86 Windows 7 Ultimate VM

First Starting the vm with debugging mode enabled

```<code>virtualboxvm --startvm "Windows 7" --dbg
</code>```

Then opening VirtualBox Debugging Console Via Debug -> Command Line

and using this command you can get a full RAM dump file:

```<code>VBoxDbg> .pgmphystofile 'dump.bin'
</code>```

So now i have the file, and im not sure about the correct ways to analyse it, it's a "flat binary" i guess

```<code>file dump.bin
</code>```

will output:

```<code>dump.bin :data
</code>```

i tried to use volatility  to get some info:

```<code>volatility -f dump.bin imageinfo
</code>```

output:

```<code>Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86_24000, Win7SP1x86
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
                     AS Layer2 : FileAddressSpace (/root/w7-nc-shell.bin)
                      PAE type : PAE
                           DTB : 0x185000L
                          KDBG : 0x8292dc28L
          Number of Processors : 1
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0x8292ec00L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2020-06-14 17:41:24 UTC+0000
     Image local date and time : 2020-06-14 09:41:24 -0800
</code>```

A bunch of informations that im not sure what they really mean (if you can suggest me some useful resource in deep about those kind of informations in comment will be appreciated)

So Anyway using volatitlity we can get a process list using this command:

```<code>volatility -f dump.bin --profile=Win7SP1x86_23418 pslist
</code>```

output:

```<code>Volatility Foundation Volatility Framework 2.6
Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit
---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0x8415e558 System                    4      0     83      503 ------      0 2020-06-15 04:31:21 UTC+0000
0x84874560 smss.exe                248      4      2       29 ------      0 2020-06-15 04:31:21 UTC+0000
0x850579b0 csrss.exe               324    316     10      452      0      0 2020-06-15 04:31:25 UTC+0000
0x850ead40 csrss.exe               376    368     10      267      1      0 2020-06-15 04:31:26 UTC+0000
0x850e9030 wininit.exe             392    316      3       76      0      0 2020-06-15 04:31:26 UTC+0000
0x8511ad40 winlogon.exe            420    368      3      110      1      0 2020-06-15 04:31:26 UTC+0000
....
</code>```

is there a way, to get the dump of one specific processe and convert it back to PE? so i can easily debug the unpacked code? if not, is there a way to just dump the process and just dissassemble it?

Thanks in advance.


问:
Unable to start file "..\ntoskrnl.exe" in ollydbg [What can I do?]
Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)</p>


问:
Garage door rolling code: identifying the implementation
I'm trying to reverse engineer my garage door remote (we're having robbery problems here, so I check if it's a weak point), here's what I found, listening on 868MHz:

There's a "preamble" composed of an alternance of ones and zeros.

Then, data bits are transmitted using 3 bits, using the form "10x", I mean, a one, followed by a zero, following by a data bit, I do not recognize this encoding.

It looks to transmit 52 or 53 bits per button press (the last bit is always 0 so I don't really know if I have to count it or not).

Here's what I identified, I labelled the columns as far as I understand them, there's 4 lines for 4 distinct records (4 button press):

```<code>Constant     Remote specific  b    ?    rolling code ?
000011110100 1010101000000100 1000 0000 0011101001011011 0
000011110100 1010101000000100 0100 0000 1111010101001100 0
000011110100 1010101000000100 0010 0000 1011000111001010 0
000011110100 1010101000000100 0001 0000 1000010111011001 0
</code>```

with:

Constant: ... a 12 bits constant, not identified, could be the door id, the vendor ID, a protocol constant, don't know.

Remote specific: a 16 bits value, it change when I test another remote so it may be something like the serial number of my remote.

b is 4 bits showing the pressed buttons, one bit per button, (4 buttons == 4 bitS), here I pressed successively button 1, 2, 3 and 4 to demo it.

the 2nd 4-bits column is always filled of zeros

16 bits of maybe a rolling code

last bit is always 0, as far as I measured (like 25 records).

A long press emits the same message in a loop (the "rolling code" does not change"), but a release followed by another press make the rolling code change.

The remote is a "v2 phoenix", which looks compatible with the "v2 phox".

Do you have any idea about which protocol it is? (if it's named a "protocol")

OwnerDisplayName: Julien Palard


问:
ARM 20-pin JTAG header?
I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:

but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on either a IDCode or bypass scan. I put a logic analyzer on it and don't really see a steady clock:

Is it possible the clock is elsewhere and some of the header pins are still TDI/TDO etc., or do any of the logic analyzer data seem they could be from JTAG?

Title: ARM 20-pin JTAG header?


问:
Set a breakpoint for a win command without an address
How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address.

I don't know what exactly should be in these columns and that is why I need them empty.

So I need to set a breakpoint for a command without an address. Maybe other debuggers can do this.

UPDATE:

I am looking for this functionality in x64dbg:

So there are no addresses. Does it support this?


问:
Practicing Reverse Engineering To Find Default Password From Router Firmware
I am currently practicing reverse engineering to look for the default password of the Linksys V1.5 firmware here https://www.linksys.com/us/support-article?articleNum=148613

I tried to use binwalk to get more information from the file but do not know where to go from here.  Almost no useful information from what I have seen from hexdump and strings command.  Is there any other recommended tools to use or strategies?


问:
Determining the encoding of an unknown image format
I'm trying to reverse engineer a REST API and there is an endpoint that delivers images. Some of them are jpegs but other ones look like they're base64 encoded, except they don't appear to be, as they contain invalid chars such as & and -. If I "repair" the invalid chars I can base64 decode it, but it's just random binary data I can't discern anything from (does base64 have a checksum built in or can I base64-decode any string that has valid base64 characters?).

The data is around ~74 KB for an image I'm requesting in 500px width. Here is a bit of the content:

```<code>MAXe09nMdH7sLXdcCVfZhA1p3ll44Ye5vJABsCGRPlh4xej7NYAu9otU2xUns35mHcwVr1j12l9Mn2AsSP9RTZEjljoUGNzkCn5yshkPMGLBmyFgrI2PjRpme0UIFX9n/CF1K1FDbA8uhTqgqxLYV2DeA9LpG5hLSFPGlkKbGcsWlYa4YyqsbYtG9mg1knuzedm+kVWvPjUpN/WtypkypnaZKmUVnXh3jFgMxCOpWHLGX9QfptR331mte+pjS2n4Ot51EYvA2Bm0QxYoEZ8ZeV/W1UjkHw9L9PBH65NY/h1mL1s246/XHFsJT6eSnHTPFlILiT66cOVjJ+2T3LDidobQrDkamZi/+wwsugY5520lFrMUYvvtvyFEb
</code>```

The API is sending a Content-Transfer-Encoding: binary header with the response.

Are there other common formats to encode binary data that I may not be aware of or does anyone have an idea what kind of data this could be?


问:
How to quickly/easily make an analysis (reverse engineering) of the code of unknown CMS or framework on PHP?
I would like to know what tools and techniques do you use for rapid analyze of unknown code CMS or framework. If more specifically that for the following tasks:

1. To locate the file (s) html template layout of the output to the browser.

2. Identifying the mechanism of routing on the URL that is both on the basis of the URL, the system determines which content and form in which to display or put in short - a mechanism  controller  in the pattern of MVC.

3. Identifying the mechanism of the assembly of the main content of the modules, and work with a database that is everything for which usually must meet  model  in the pattern of MVC.

4. Determination of the mechanism of assembly of the entire html page before. That is,  view  in the pattern of MVC.

This is a basic, in my opinion, problems arising when creating / redoing projects in PHP, of course is a kind of generalization of more specific tasks.

For example, for me, it's probably become traditional: Xdebug, IDE for PHP (Eclipse). Also a very special service helps to visualize the trace files Xdebug - Recognizer. It is good because it builds a comfortable working sequence diagram of a trace log. Maybe enough for someone to read documentation, view the source code or running in the debugger, but for me chart tracing helps to form in my head the system and has become a really rapid way of analysis.

What is the average time you spend on the above tasks?

Encourage effective tools for quick/easy analysis (reverse engineering) of unknown CMS or framework?

ContentLicense: CC BY-SA 3.0


问:
which has better pseudocode? IDA or Ghidra
I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.</p>


问:
Same USB packet (Python/user vs C/kernel) but different result
I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device.
Using Wireshark I found what to send and where, so I tried the following command in user space Python and it works:

handle._controlTransfer(0x21, 0x09, 0x0300, 3, data, 8, 0) #packet sent, device reacts

Sadly I can't get it to work in the kernel module:

usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 0x09, 0x21, 0x0300, 3, data, 8, 0); //packet sent, device doesn't react

even by creating the urb myself:

```<code>urb = usb_alloc_urb(0, GFP_KERNEL);
cr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
cr->bRequestType = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
cr->bRequest = 0x09;
cr->wValue = cpu_to_le16(0x0300);
cr->wIndex = cpu_to_le16(3);
cr->wLength = cpu_to_le16(8);
usb_fill_control_urb(urb, dev, usb_sndctrlpipe(dev, 0), (void *)cr, data, 8, urb_callback, context);
usb_submit_urb(urb, GFP_ATOMIC);
kfree(cr);
usb_free_urb(urb);
//packet sent, device doesn't react
</code>```

When I say the device "reacts" I mean it flashes with another color so there is no ambiguity in the success of the command.

I logged everything with Wireshark and the packets are identical (except for urb_id and urb_ts_*)

Would you have any advice for me? Something I forgot or how to debug more?

Edit

Full working Python code

```<code>context = usb1.USBContext()
handle = context.openByVendorIDAndProductID(VENDOR_ID, PRODUCT_ID)
usb1.libusb1.libusb_set_auto_detach_kernel_driver(handle._USBDeviceHandle__handle, 0)
usb1.libusb1.libusb_set_auto_detach_kernel_driver(handle._USBDeviceHandle__handle, 3)
handle.claimInterface(0)
handle.claimInterface(3)
handle._controlTransfer(0x21, 0x09, 0x0300, 3, data, 8, 0)
handle.releaseInterface(3)
handle.releaseInterface(0)
</code>```


问:
How to see what has changed in a patched binary?
I am exploring MacOS Deckset app.
It has a trial version available on the official website.
But there's a cracked version available on torrent trackers.

I want to know what was changed by the people who cracked that app: strings? symbols? few assembly instructions?

Both (genuine and cracked) versions are available as .DMG installers.
I've extracted Deckset.app containers from both of them.

Now, I'm able to explore Deckset.app/Contents/MacOS/Deckset binary in Hopper tool.
But as the cracked version is patched, I want to understand what actually was patched.
For this, I used radiff2 tool from Radare2 toolset:

```<code>radiff2 genuine.app/Contents/MacOS/Deckset cracked.app/Contents/MacOS/Deckset  > bin_diff.txt
</code>```

It gave me output like this:

```<code>0x00000e98 901e => 101c 0x00000e98
0x0000201c 109a => 9097 0x0000201c
0x0027d486 770c => 585e 0x0027d486
0x0027d48b 04 => 03 0x0027d48b
0x0027d493 2c => 24 0x0027d493
0x0027d49a 511a => 5097 0x0027d49a
0x0027d49d 00 => 01 0x0027d49d
0x0027d49f 05 => 00 0x0027d49f
0x0027d4a3 fe00010000 => 07fade0c02 0x0027d4a3
0x0027d4aa 53bcfade0c02 => 507300020100 0x0027d4aa
0x0027d4b2 50ee => 0000 0x0027d4b2
0x0027d4b5 020500 => 0000b3 0x0027d4b5
0x0027d4b9 01 => 00 0x0027d4b9
0x0027d4bb 00 => 30 0x0027d4bb
0x0027d4be 012e => 0003 0x0027d4be
0x0027d4c2 0060 => 027e 0x0027d4c2
</code>```

Now, when I open "genuine" app in Hopper, and search for either 0x00000e98, or 901e, or 101c, it gives nothing useful.

E.g. when I do Menu > Navigate > Go to Address or Symbol and enter 0x00000e98, it gives me such segment:

I don't see nor 901e, neither 101c in this segment.

What am I doing wrong?
Do you know better tools for doing this (except IDA Pro, because it's expensive)?


问:
Reverse engineering a aarch64 elf in Ghidra
I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the figure are giving me some trouble understanding the algorithm of the code.

There are too much undefined variables. I don't know their datatypes. But as param_1 is a character array, I assume that local_58 will also be a character array of size 40 (from memcpy function call). So, local_30 will also be a character array of size 40(from memcpy function call). Am I right here?

I assume the 2nd marked snippet is telling the value of local_30. If i am correct local_30 has a value of  00001100 00000111 10101010 10011000 11100011. Please correct me here if I am wrong.

FUN_00400c3 is taking the local_58 and doing some operations. Along with local_58, the FUN function is also taking an integer and a unsigned long long int as 2nd and 3rd parameter. The 3rd parameter has a very large value. So, I am not sure whether ghidra is giving a correct value or a garbage one.


问:
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).

But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same results and process it correctly. Here are pictures of these three tools about the function png_write_rows:

Ghidra:

we can see that from 0x6bf9, bad results are generated.

For comparison, Objdump:

and IDA:

I know IDA is the best SRE tool, and I always thought Ghidra and IDA are the top 2. Objdump is a basic, standard and old tool, but why is it that Ghidra can't even get the correct disassembly code while the other two tools do? I use auto-analyze and import the binary file for both IDA and Ghidra.
How to correct these errors?

By adjusting analysis options，if Non-Returning Functions - Discovered is set as false, it will be correct.


问:
Reverse engineering a command line argument using angr for an aarch64 binary
I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument. I followed the previous examples in angr to extract the solution in bytes. Whenever I am restricting the result to only printable characters the angr is not giving any result but after removing the constraint angr provides one possible solution for the problem. The result of angr is as follows:

\xc7_\xb0\xb1>)9\x9f\x00\x82+\xe2ms\x90\x85\xbd\xdd\xebqyv1\x86\x82q]\xe9i\xc3\xed(\x1c\xdd\xfd\xf0\x9dgx

As per my understanding this doesn't mean anything and also is not the desired answer. Please let me know if I am missing something. Below is the code I am using:

```<code>def get_possible_flags():
p = angr.Project("test", load_options={'main_opts': {'arch': 'aarch64'}})
key_bytes = [claripy.BVS("byte_%d" % i, 8) for i in range(39)]
arg1 = claripy.Concat(*key_bytes)
initial_state = p.factory.entry_state(args=["test", arg1], add_options={"BYPASS_UNSUPPORTED_SYSCALL"})
sm = p.factory.simulation_manager(initial_state)
sm.explore(find=lambda s: b"correct" in s.posix.dumps(1),avoid=lambda s: b"wrong" in s.posix.dumps(1))
s = sm.found[0]
print("Found.........................")
print(s.posix.dumps(1))
possible_values = [ s.solver.eval_upto(arg1, 100, cast_to=bytes)]
possibilities = tuple(itertools.product(*possible_values))
return possibilities
</code>```


问:
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have tried to identify the malloc, memcpy, free and printf functions, but now I am struggling to understand what I believe to be the main malloc loop. I believe the entry point to malloc is at 00012124, based on the large number of xrefs Ghidra has found where r0 is set to a small immediate value followed by a branch to this address, eg:

```<code>        00018dcc 4f f4 a2 70     mov.w      r0,#0x144
        00018dd0 f9 f7 a8 f9     bl         malloc              ;; 00012124
</code>```

At 00012124 there is a branch to 00011eb8 which I believe to be the guts of the malloc function:

```<code>                             LAB_00011eb8                                    XREF[2]:     00012126(j), 0001212c(j)
        00011eb8 2d e9 f7 4f     push       { r0, r1, r2, r4, r5, r6, r7, r8, r9, r10, r1...
        00011ebc 03 30           add        r0,#0x3
        00011ebe 4f f0 01 0b     mov.w      r11,#0x1
        00011ec2 20 f0 03 04     bic        r4,r0,#0x3
        00011ec6 0b fa 01 f1     lsl.w      r1,r11,r1
        00011eca b1 f5 80 4f     cmp.w      r1,#0x4000
        00011ece 34 bf           itE        cc
        00011ed0 8b 46           mov.cc     r11,r1
        00011ed2 4f f4 80 4b     mov.cs.w   r11,#0x4000
        00011ed6 90 f0 a7 f8     bl         FUN_000a2028                                     undefined FUN_000a2028()
        00011eda 39 4b           ldr        r3,[DAT_00011fc0]                                = 002007B8h
        00011edc 00 22           mov        r2,#0x0
        00011ede bb f1 04 0f     cmp.w      r11,#0x4
        00011ee2 38 bf           it         cc
        00011ee4 4f f0 04 0b     mov.cc.w   r11,#0x4
        00011ee8 d3 f8 00 a0     ldr.w      r10,[r3,#0x0]=>DAT_002007b8
        00011eec 15 46           mov        r5,r2
        00011eee 91 46           mov        r9,r2
        00011ef0 13 46           mov        r3,r2
        00011ef2 cb f1 00 01     rsb        r1,r11,#0x0
        00011ef6 0b f1 ff 3b     add.w      r11,r11,#0xffffffff
        00011efa 01 91           str        r1,[sp,#Stack[-0x2c]]
        00011efc cd f8 00 b0     str.w      r11,[sp,#0x0]=>Stack[-0x30]
                             LAB_00011f00                                    XREF[1]:     00011f4a(j)
        00011f00 41 68           ldr        r1,[r0,#0x4]
        00011f02 19 b3           cbz        r1,LAB_00011f4c
        00011f04 d1 f8 00 80     ldr.w      r8,[r1,#0x0]
        00011f08 a0 45           cmp        r8,r4
        00011f0a 1d d3           bcc        LAB_00011f48
        00011f0c dd f8 04 b0     ldr.w      r11,[sp,#Stack[-0x2c]]
        00011f10 01 f1 08 07     add.w      r7,r1,#0x8
        00011f14 07 eb 08 0c     add.w      r12,r7,r8
        00011f18 c4 eb 0c 06     rsb.w      r6,r4,r12
        00011f1c 0b ea 06 06     and.w      r6,r11,r6
        00011f20 be 42           cmp        r6,r7
        00011f22 11 d3           bcc        LAB_00011f48
        00011f24 dd f8 00 b0     ldr.w      r11,[sp,#0x0]=>Stack[-0x30]
        00011f28 1b ea 07 0f     tst.w      r11,r7
        00011f2c 02 d0           beq        LAB_00011f34
        00011f2e f7 1b           sub        r7,r6,r7
        00011f30 07 2f           cmp        r7,#0x7
        00011f32 09 d9           bls        LAB_00011f48
                             LAB_00011f34                                    XREF[1]:     00011f2c(j)
        00011f34 c4 eb 08 07     rsb.w      r7,r4,r8
        00011f38 57 45           cmp        r7,r10
        00011f3a 05 d2           bcs        LAB_00011f48
        00011f3c 62 46           mov        r2,r12
        00011f3e 35 46           mov        r5,r6
        00011f40 67 b1           cbz        r7,LAB_00011f5c
        00011f42 ba 46           mov        r10,r7
        00011f44 81 46           mov        r9,r0
        00011f46 0b 46           mov        r3,r1
                             LAB_00011f48                                    XREF[4]:     00011f0a(j), 00011f22(j),
                                                                                00011f32(j), 00011f3a(j)
        00011f48 08 46           mov        r0,r1
        00011f4a d9 e7           b          LAB_00011f00
                             LAB_00011f4c                                    XREF[1]:     00011f02(j)
        00011f4c 48 46           mov        r0,r9
[snip]
</code>```

There is a loop entering at 00011f00 with the reverse jump at 00011f4a, and a single jump out of the loop at 00011f40.

The line that is confusing me is the first line of the loop (00011f00) -- here the instruction ldr r1,[r0,#0x4] would be using r0 as a base address and then dereferencing r0+0x4 into r1 (because of the [], indicating immediate offset addressing). However, I can't find any instructions prior to this where r0 is loaded into, it appears to only be loaded with a small immediate value at the malloc call sites (which I thought was the callers specifying the size of memory they want alloc'd). Apart from the 'wrapper' at 00012124, the only other block of code I am encountering in my in-my-head trace of the execution is the branch at 00011ed6, and the function there also does not touch r0.

The loop ends by moving r1 into r0 before jumping back to the start, at which point the ldr r1,[r0,#0x4] instruction is executed again. Based on this I had thought that this loop is walking over the linked list of free heap blocks: each heap block has a pointer to the next heap block at offset 0x4, which is retrieved at the start of the loop.

Is the instruction at 00011f00 actually dereferencing the size as a base address? Or is r0 being written to earlier in the flow and I cannot see where it is happening?

Additionally, I would love to know if I am on the right track with understanding the allocator, but if you can help me with this one ldr instruction I would be very grateful!

Thank you :)

[1] https://github.com/seemoo-lab/bcm_misc/blob/master/bcm4366c/rom.bin

[2] https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html

EDIT: FUN_000a2028 is defined as:

```<code>                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined FUN_000a2028()
             undefined         r0:1           <RETURN>
             undefined4        Stack[-0x4]:4  local_4                                 XREF[1]:     000a202e(W)
                             FUN_000a2028                                    XREF[2]:     FUN_00011dc4:00011de0(c),
                                                                                malloc:00011ed6(c)
        000a2028 10 b5           push       { r4, lr }
        000a202a 02 4c           ldr        r4,[DAT_000a2034]                                = 00200418h
        000a202c 24 68           ldr        r4,[r4,#0x0]=>DAT_00200418
        000a202e 01 94           str        r4,[sp,#local_4]
        000a2030 10 bd           pop        { r4, pc }

</code>```


问:
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.

I want to just make each function return so I'm replacing opcodes to do this, but doing this by hand is a painful job. My fingers and palm hurt after I modified a single library, so I need a way to do that with IDA Python.

It's an ARM 32 shared library, I know it doesn't matter here but specified for goodness sake.

This is the hex I'm replacing in every function:

00 00 a0 e1 00 00 a0 e3 1e ff 2f e1

This is what this hex is all about:

```<code>    movs r0, r0
    movs r0, #0
    bx lr
</code>```


问:
Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?
I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when importing the file, Ghidra complains about a lot of missing DLLs. So I started downloading all of them manually and putting them into a directory which I specified in the import settings -> External Libraries, however, the missing files only get written in the "Additional Info" field of the import results.

The problem here is, that the "Additional Info" ends with the following message:

```<code>There were too many messages to display.
659 messages have been truncated.
</code>```

meaning I can't take a look at all of the missing dll's.

I can't have a good look into the code without the dependencies, as Ghidra displays No symbol warning's everywhere. My guess is that a big thing of Unreal Engine is still missing, as most of the missing symbols start with U (UObjectBase, UWorld, ...)

Can I somehow look at the complete import log to add the missing libraries? Or is there a faster way to supply every dependency?


问:
How can I practically approach VM-obfuscated code with symbolic analysis/execution?
Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some pointers, I'd greatly appreciate it.

With dynamic analysis, am I supposed to only emulate the VM to get a symbolic binding? If yes, how can I deobfuscate only that part of a binary without touching the rest and would reconstructing a new binary even work if I only touched a small part (Jump locations might be off or don't point anywhere)? How do I do that? A lot of papers I read synthesize a new C program or use llvm-ir but that's not the entire program but only the VM loop. Now how do I merge it?

If I emulate the entire binary to get a symbolic representation of it (like I've seen in some CTF write-ups), wouldn't that mean I only have the representation of the main path that this binary is going? (No inputs). My reconstructed binary would lack the interactions that are not in the main trace from start to finish, no?

VM-obfuscated code usually has an encryption key that changes with each opcode that is interpreted. If I have a symbolic representation, I would still not be able to arbitrarily decompile the entire virtual opcode because I don't know the encryption key at that time.

On top of the confusion, the binary I am looking at right now doesn't just have one obfuscated VM loop but multiple which is apparently not uncommon when using commercial VM obfuscation. A short trace gave me over 4 structures that look like a VM loop. Debugging it showed me that the VM stack/context/registers used for pointers of each machine is different and random. So now,

Do I deal with the VMs 1-by-1? As in, I reverse one until it calls the second (say VM1 calling VM2 sometime), then recompile a binary without it, then go to the next?

Can I emulate the entire thing even though it means it will emulate potential dozens of VM-loops? I am guessing symbolic analysis won't really work if the registers used for internal stack and such are different over time

If I have multiple VMs, how do I even know which bytecode is interpreted by which VM? I can take a guess from the sections and analyzing my trace, but again the trace I have is only for the main path and other branches of the app are not in it.

My understanding from it is something like this:

Identify the VM loop and analyze where it stores it's context, stack pointer, opcode pointer, vmkey

Create a symbolic representation of the loop and how it pulls the next opcodes

Find all the handlers of the VM and create a symbol representation of them

Somehow use this knowledge then to de-virtualize it

All in all, I am really confused. I read a handful of papers on it but security researchers don't really like releasing tools/code samples so it's all just theoretical and abstract.


问:
How do I find Python data structures in Linux process memory using Volatility?
I have a Ubuntu 18.04 memory dump (entire RAM), and while I was acquiring it with LiME, I had a Python program running. Using Volatility, I want to recover its data structure values which are located in Python program process heap. The linux_proc_map plugin gave me the virtual addresses I should be looking through.

For now, I am trying to find out how CPython PyObjects appear in memory, but I'm not sure what values to look for, so scanning for specific values will be difficult. I only know the name of the data structure...

Has anyone else on here tried to recover program data structures from process memory?


问:
Debugged process not break on breakpoint
I launch a game process then I suspend the process and restore the hooks in ntdll.dll then I attach debugger to the process and resume the process. Next I see debugger catch the 0xC0000005(access violation) exception on thread [DbgUiRemoteBreakin] and did not break on any breakpoint I seted (I had set a break point on [DbgUiRemoteBreakin]). And can not single step debug. So is there any infomation about how to solve it here?</p>


问:
Can I reverse engineer a DLL file and add SEH or some error handing codes to it?
I am using some DLL files in my Java application using JNI library.

The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. Needless to say that they are making my java application unstable since unhandled exceptions in native side crash the java application.

I was thinking to reverse engineer the dll files and add some try and catch clause there or maybe just find the culprit line and add some prevention there.

The exceptions are mainly due to dereferencing a null pointer which I believe I can fix them by a couple of instructions (cmp and jmp)

So what I am trying to ask are as follow:

Is it practically doable?

Is IDA the right tool to do so?

Edit :
Another solution that I am guessing could fix the problem is to write a new native class and wrap all native functions that i am using in the new functions with error handling. But I have a lot of native functions and this solution could be tedious and cumbersome. So, still, reverse engineering DLLs is my number one solution. Comments are really welcome. Please share your views.


问:
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator and only has arm JNI Libs, so emulation is used for the ARM Libs.

```<code>import frida, sys
ss = """
Java.perform(function() {
    const System = Java.use('java.lang.System');
    const Runtime = Java.use('java.lang.Runtime');
    const VMStack = Java.use('dalvik.system.VMStack');

    System.loadLibrary.implementation = function(library) {
        try {
            console.log('System.loadLibrary("' + library + '")');
            const loaded = Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), library);
            return loaded;
        } catch(ex) {
            console.log(ex);
        }
    };

    System.load.implementation = function(library) {
        try {
            console.log('System.load("' + library + '")');
            const loaded = Runtime.getRuntime().load0(VMStack.getCallingClassLoader(), library);
            return loaded;
        } catch(ex) {
            console.log(ex);
        }
    };
});
"""
device = frida.get_device_manager().add_remote_device('127.0.0.1:27042')
pid = device.spawn(["com.testapp"])
session = device.attach(pid)
script = session.create_script(ss)
script.load()
device.resume(pid)
sys.stdin.read()
</code>```

this code list all libraries loaded when the app starts, but when i do

Module.findBaseAddress('libtest.so');

it always returns null, in the end of the day i just want to log all the instructions being executed by the process so i can get the faulty instruction and search it up in the ida to patch it.
if there's any other tool i can achieve the same than please suggest me also, process don't support attaching a debugger!


问:
DLL injection (Failed to inject)
I have found this complete and easy example to test the function hook:

https://github.com/Zer0Mem0ry/Detour

```<code>#include <Windows.h>
#include <iostream>

#include "detours.h"
#include "sigscan.h"

// this is the function that the program
// will jump to when sum() is called in the original program (testprogram.exe)

DWORD AddressOfSum = 0;
// template for the original function
typedef int(*sum)(int x, int y);

int HookSum(int x, int y)
{
    // manipulate the arguments
    x += 500;
    y += 500;

    // we manipulate the arguments here and then
    // redirect the program to the original function

    std::cout << "your program has been hacked! " << std::endl;
    sum originalSum = (sum)AddressOfSum;
    return originalSum(x, y);
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
    // store the address of sum() in testprogram.exe here.

    if (dwReason == DLL_PROCESS_ATTACH)
    {
        // We will use signature scanning to find the function that we want to hook
        // we will find the function in IDA pro and create a signature from it:

        SigScan Scanner;

        // testprogram.exe is the name of the main module in our target process
        AddressOfSum = Scanner.FindPattern("testprogram.exe", "\x55\x8B\xEC\x8B\x45\x08\x03\x45\x0C", "xxxxxxxxx");

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());

        // this will hook the function
        DetourAttach(&(LPVOID&)AddressOfSum, &HookSum);

        DetourTransactionCommit();
    }
    else if (dwReason == DLL_PROCESS_DETACH)
    {
        // unhook
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());

        // this will hook the function
        DetourDetach(&(LPVOID&)AddressOfSum, &HookSum);

        DetourTransactionCommit();
    }
    return TRUE;
}
</code>```

I have tried to inject this DLL to the "testprogram.exe" (without change nothing) using cheat engine, extreme inject, etc.. with the some result "failed to inject".

I need to change "xxxxxxxxx" before inject the DLL ?

Can you help me please ?

Best Regards

Title: DLL injection (Failed to inject)


问:
How are AutoIT variable names stored after compiling it to a executable?
I need to write a yara rule for a autoit malware (the binary itself not the decompiled script)

As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes that represent the variable names?

for example lets say there is a variable $MyObviousVariable in the script and i want to make a yara rule for it in the binary, where can i find this variable NAME in the binary? is it inside the RCData?


问:
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.

Why can I go to CFF explorer or some other PE editing software and nullify the IMAGE_IAT_DIRECTORY in the OptionalHeader and the program will still run fine?

As far as I understood, the loader will iterate the array of PIMAGE_THUNK_DATA pointed by OriginalFirstThunk, will parse the symbol, and then will overwrite the memory pointed by FirstThunk with the corresponding function address.

I also understood that the IMAGE_IAT_DIRECTORY Will serve as a container for these function pointer arrays, for each corresponding FirstThunk in each IMAGE_IMPORT_DESCRIPTOR.
When is it needed for an IAT directory to exist? Can it be that a lack of this directory will prevent an file from starting?

Thanks!


问:
What is the URL format for Google Trends?
When you search for the search term Tesla or AOL you get the following URLs:

https://trends.google.com/trends/explore?geo=US&q=Tesla

But, for the automobile maker, you get:

https://trends.google.com/trends/explore?geo=US&q=%2Fm%2F0j6n6s8

So what is the %2Fm%2F0j6n6s8 part? I know it URL decodes to /m/0j6n6s8 but how is it being encoded??

One more example of AOL (search term) vs. AOL (company)

https://trends.google.com/trends/explore?geo=US&q=AOL
https://trends.google.com/trends/explore?geo=US&q=%2Fm%2F0plw


问:
strange results with IDA (some function different Pseudo Code)
After show the pseudo code in IDA I see different results:

The function 4436C0 show different pseudo code.

For example:

```<code>result = sub_4376C0("vvcbb3.wav",v8,0);
</code>```

and

```<code>result = sub_4376C0((int)"vvcbb3.wav",v8,0);
</code>```

Have you never seen a similar situation?

It is a IDA bug ?


问:
Devirtualization
I've recently become pretty fascinated with virtualization and retrieving original code from a randomly generated byte code, such as protectors like VMProtect/etc. But I can not get a grasp on how it would actually be done.

Although I have read a few writings to help understand virtualization better, even articles specifically written to target the protector I'm trying to devirtualize, I can not relate their articles to my own sample. There are discrepancies between the two which confuse me.

I made a small program that takes in a string input and outputs it, then added Virtualization to the function. First thing I notice is that the function now calls another function, and looks like it adds random junk instructions after the call. I also notice that it pushes 4 bytes onto the stack.

```<code>.vmp0:00440C0F 68 28 02 8E 51                          push    518E0228h
.vmp0:00440C14 E8 68 BB FC FF                          call    sub_40C781
</code>```

Inside sub_40C781 I see it is pushing all registers on the stack and also the pushf instruction which pushes flags. Inbetween these pushes and main instructions, I can't help but notice pointless instructions inbetween, which is a little odd since I only specified Virtualization in protection.
Anyway, the main valid instructions I managed to scavenge from the function called go as

```<code>push    ebp
push    ebx
push    ecx
push    esi
push    edi
pushf
push    edx
push    eax
mov     eax, 0
push    eax
mov     esi, [esp+24h+arg_0]
lea     esi, [esi+eax]
lea     esp, [esp-0C0h]
</code>```

But from there, I'm not sure how to proceed. The rest of instructions past the last lea go as

```<code>.vmp0:0040E187                         loc_40E187:                             ; CODE XREF: .vmp0:00416516↓j
.vmp0:0040E187                                                                 ; .vmp0:loc_42E5EB↓j ...
.vmp0:0040E187 8B DE                                   mov     ebx, esi
.vmp0:0040E189 B8 00 00 00 00                          mov     eax, 0
.vmp0:0040E18E 0F BA F7 E7                             btr     edi, 0E7h ; 'ç'
.vmp0:0040E192 66 23 F8                                and     di, ax
.vmp0:0040E195 2B D8                                   sub     ebx, eax
.vmp0:0040E197
.vmp0:0040E197                         loc_40E197:                             ; DATA XREF: sub_40C781:loc_40E197↓o
.vmp0:0040E197 8D 3D 97 E1 40 00                       lea     edi, loc_40E197
.vmp0:0040E19D 66 0F A4 D0 09                          shld    ax, dx, 9
.vmp0:0040E1A2 C1 C8 49                                ror     eax, 49h
.vmp0:0040E1A5 81 EE 04 00 00 00                       sub     esi, 4
.vmp0:0040E1AB 0F A3 F8                                bt      eax, edi
.vmp0:0040E1AE 33 C6                                   xor     eax, esi
.vmp0:0040E1B0 C6 C4 27                                mov     ah, 27h ; '''
.vmp0:0040E1B3 8B 06                                   mov     eax, [esi]
.vmp0:0040E1B5 F9                                      stc
.vmp0:0040E1B6 F8                                      clc
.vmp0:0040E1B7 E9 79 12 05 00                          jmp     loc_45F435
</code>```

But I can't see how this would be interpreting code and translating it to its x86 representation. From my understanding, esi is probably the VM's instruction ptr. loc_40E197 seems to be the instruction 'dispatcher' for lack of better words. But I can not get a grasp of the inner workings, esi seems to be decremented by 4 each loop, which I thought would be 1 instead.

Any insight on to how to proceed would be greatly appreciated.

Title: Devirtualization


问:
Frida not able to trace sub_XXXXX which must have been called
I have the following pseudocode generated by IDA Pro decompiler:

```<code>__int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>)
{
  ...
  result = sub_222E0((__int64 *)a3, 2 * a2, 0x20u);
  return result;
}
</code>```

Using frida-trace, I could verify that sub_155B5 is called for every API request. This is the command that I used:

```<code>$ frida-trace -U com.app.name -a 'libname.so!0x155b5'
</code>```

Therefore, I thought I could safely assume that sub_222E0 was also executed, because it's contained by sub_155B5 which was obviously executed. However, it turned out that I was wrong. frida-trace failed to trace sub_222E0 using the same command above.

What are the possible causes for this outcome?

Thank you.

EDIT

Here's the declaration of sub_222E0:

```<code>__int64 __fastcall sub_222E0(__int64 a1, __int64 a2, __int64 a3)
{
  return sub_4D2EC(*(_QWORD **)(a1 + 64), a2, a3);
}
</code>```

And frida-trace does trace sub_4D2EC everytime sub_155B5 is executed, but not sub_222E0.


问:
Looking for obfuscation patterns within jumps
I'm working on an obfuscated binary. I recognized some patterns used to confuse the disassembler, some used to obfuscate function calls, some other for conditional jumps and so on.

The idea was to search these patterns along the binary. The problem is that such patterns are often interleaved with unconditional jumps.

For example this code is used to replace a simple conditional jump:

```<code>push    offset loc_123456
push    ebx
push    eax
mov     ebx, [esp+8]
mov     eax, offset loc_654321
cmovz   ebx, eax
mov     [esp+8], ebx
pop     eax
pop     ebx
retn
</code>```

The problem is that this pattern is often split in two or more parts (because the whole code is split in several blocks that are spread everywhere in the binary and then connected with unconditional jumps), and of course I cannot find it with a simple byte pattern search.

Is there any way to look for all the pieces of code that satisfy a pattern even if they are broken in 2 (or more) pieces and connected with an unconditional jump?


问:
WinDbg pattern search not returning expected result
I'm searching for a string, say the old "This program cannot run".

Switching context to e.g. notepad, non invasive, with page translation

```<code>1: kd> !process 0 0 notepad.exe
PROCESS ffff9d05d0005080
    SessionId: 2  Cid: 0368    Peb: 5c8ae78000  ParentCid: 0890
    DirBase: 30305002  ObjectTable: ffffb48e166c1440  HandleCount: 232.
    Image: notepad.exe

1: kd> .process /r /p ffff9d05d0005080
</code>```

And sweeping for strings returns the expected result

```<code>1: kd> s -[l16]sa 7ff6e1760000 L100
00007ff6`e176004e  "This program cannot be run in DO"
00007ff6`e176006e  "S mode.
</code>```

However pattern search returns with nothing

```<code>1: kd> s -a 7ff6e176004e L100 "This program"
</code>```

Sanity:

```<code>00007ff6`e176004e  54 68 69 73 20 70 72 6f-67 72 61 6d 20 63 61 6e  This program can
00007ff6`e176005e  6e 6f 74 20 62 65 20 72-75 6e 20 69 6e 20 44 4f  not be run in DO
00007ff6`e176006e  53 20 6d 6f 64 65 2e 0d-0d 0a 24 00 00 00 00 00  S mode....$.....
</code>```

Now if I switch context, but this time with the invasive flag

```<code>1: kd> .process /i /r /p ffff9d05d0005080
1: kd> g
</code>```

And voila

```<code>1: kd> s -a 7ff6e176004e L100 "This program"
00007ff6`e176004e  54 68 69 73 20 70 72 6f-67 72 61 6d 20 63 61 6e  This program can
</code>```

Since clearly WinDbg can search & find the string on it's own, why is invasive needed for it to crop up during pattern search?

Thanks


问:
How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)
I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). The PS3 version uses a very nice per-object motion blur while the PC version uses a crappy camera blur. The ultimate goal of this is to transfer this motion blur over to Storm 4 on PC which uses the same engine.

All of my findings are documented here:
https://docs.google.com/document/d/1xxqOxLJwt04sgnIKqHHlfr8Gu6V_4toOFHv52P1FYEY/edit?usp=sharing


问:
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?

I know there is an "Execute till return" option,

but I want to execute till next call statement or next CMP or any other statements.

Thank you.

Title: x64dbg execute till next call OR return


问:
What are all possible ways to add strings to the .rdata section of a Binary Executable?
I was wondering what are all the possible ways people can mess with the executable's .rdata strings ?

Because I've actualy seen it .. But I do not have any idea how they do that.

Some random dude made like a copy of My executable but with more strings (Files Names) on an [x] offset that falls into the .rdata section, which caused the Executable to map more files in the memory ...

How is that even possible ?


问:
Windows pintool mismatch between call/ret instructions
So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous call.

I've run the tool in a console application from which a number of inconsistencies can be observed. Below are the first 3 log entries showing this inconsistency:

```<code>1. Call from ntdll!LdrpCallInitRoutine+0x69, expected to return to 7ff88f00502a
2. RETURN to 7ff88f00502a
//call from ntdll!LdrpInitializeNode+0x1ac which is supposed to return at 7ff88f049385 is missing (the previous instruction)
3. RETURN to 7ff88f049385 (ntdll!LdrpInitializeNode+0x1b1)
</code>```

The above are the first 3 log entries for the call/ret instructions. As one can see, the monitoring appears to start a bit late, at the call found at ntdll!LdrpCallInitRoutine+0x69, after which it returned to the expected address but then returned to 7ff88f049385 without first tracking the call found in the previous instruction.

Any ideas of what could be the fault?

The program is traced with INS_AddInstrumentFunction with a callback that more or less does:

```<code>if INS_IsCall(ins) INS_InsertCall(ins,...
if INS_IsRet(ins) INS_InsertCall(ins,...
</code>```

I've tried the same program on Linux which worked as expected, without any mismatch.
Any ideas of the reason behind this behavior?


问:
What are the best ways today in order to learn about finding use-after-frees while code auditing?
I'm a novice CTF player with a decent understanding of OS internals and software mechanisms, I have deep understanding of heap and OS and User locking mechanims.

I would like to learn on how to properly identify use-after-frees in source codes. The classical examples of alloc-free-use are too simple, (at least for me), in order to deeply understand how use-after-free mechanims is actually identified. I've been reading about the subject for quite a lot in the past few weeks but I do not seem to find good examples, (bugs/writeups), on.

What are good examples, (bugs/writeups), or methodologies in order to properly identify use-after-frees in code?


问:
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist in the code, but as this is C++, it is simply impossible to revert to source code, thus leading me to a debugger,

So I found it, well.. the debugger displays many leading to the same adress, but that's for later.

```<code>0000000140201A9D | 48:8D0D FC7FFF02       | lea rcx,qword ptr ds:[1431F9AA0]      |00000001431F9AA0:"FireMode.HeatPerShot"
</code>```

As you can see
rcx is what contains it,
Is there a way to do math on it? or change it to a zero,

proof of concept:::

lea 0,qword ptr ds:[1431F9AA0]

or

lea rcx*0,qword ptr ds:[1431F9AA0]

I know it doesn't work, but would it not be possible to do something like that?

( https://i.imgur.com/hHCWS3l.png )

Title: Change value of memory in a debugger?


问:
How To Deobfuscate ConfuserEx .NET Assembly?
No matter what I try I cannot deobfuscate this crackme https://crackmes.one/crackme/5d6c847433c5d46f00e2c390.

I have tried each & every tutorial on youTube of which this one is the best https://youtu.be/X0F_-sE-6GU. Following all the steps in the video I receive an unhandled exception at 1:47. I am unable to deobfuscate the crackme. I've tried so many variations of this I couldn't possibly list them. Imagine 3-days; 9 hours a day running every variation, that's what I've done.

An expert will have it deobfuscated in a few mins. Is anyone able to advise the steps with dnSpy to truly deobfuscate this crackme?

I'm not after the solution to the crackme; just how to debfuscate.


问:
How to get video file URL from Twitter
I am looking how to find the video URL of a Twitter video so I can code a converter later (using nodejs or something), but I can't figure out how to do this. I saw this but it doesn't really clear anything up (I can't figure out where the json file they are talking about is)

Any help is appreciated

Title: How to get video file URL from Twitter