问:
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.

As far as I don't know exactly what CPU architecture is used on these SoCs.

Here are the binwalk + cpu_rec outputs - example of a media player based on STMP35xx SoC:

bootmanager.sb - from DSP of STMP35xx-based player (DSP56004-compatible)

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
9276          0x243C          ARM executable code, 16-bit (Thumb), big endian, at least 564 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0x380, entropy=0.606236)
896           0x380           TMS320C6x (size=0x100, entropy=0.526849)
1152          0x480           None (size=0x1680, entropy=0.617841)
6912          0x1B00          TMS320C6x (size=0x80, entropy=0.570979)
7040          0x1B80          None (size=0x1400, entropy=0.624876)
</code>```

hostlink.sb - from DSP of STMP35xx-based Portable media player (DSP56004-compatible)

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
34195         0x8593          ARM executable code, 16-bit (Thumb), big endian, at least 809 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0x24000, entropy=0.559532)
147456        0x24000         TMS320C6x (size=0x800, entropy=0.642204)
149504        0x24800         None (size=0x2000, entropy=0.657037)
157696        0x26800         TMS320C6x (size=0x800, entropy=0.621518)
159744        0x27000         None (size=0x11000, entropy=0.666237)
229376        0x38000         TMS320C6x (size=0x1800, entropy=0.625215)
235520        0x39800         None (size=0x4000, entropy=0.656501)
251904        0x3D800         TMS320C6x (size=0x800, entropy=0.619983)
253952        0x3E000         None (size=0x6800, entropy=0.658247)
280576        0x44800         TMS320C6x (size=0x3000, entropy=0.678292)
</code>```

hostrsc.bin

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1133          0x46D           ARM executable code, 16-bit (Thumb), big endian, at least 548 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0xc00, entropy=0.498160)
3072          0xC00           IA-64 (size=0x100, entropy=0.121801)
3328          0xD00           None (size=0x100, entropy=0.115110)
3584          0xE00           OCaml (size=0x200, entropy=0.297187)
4096          0x1000          None (size=0x3d00, entropy=0.500052)
</code>```

resource.bin

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
149           0x95            ARM executable code, 16-bit (Thumb), little endian, at least 506 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0x30000, entropy=0.676872)
196608        0x30000         OCaml (size=0x1000, entropy=0.176639)
200704        0x31000         None (size=0x9800, entropy=0.422213)
239616        0x3A800         OCaml (size=0x2800, entropy=0.374464)
249856        0x3D000         None (size=0x35800, entropy=0.650011)
468992        0x72800         IA-64 (size=0x1800, entropy=0.388964)
475136        0x74000         None (size=0x5800, entropy=0.366840)
497664        0x79800         i860 (size=0x2800, entropy=0.510416)
507904        0x7C000         None (size=0x3c000, entropy=0.621825)
753664        0xB8000         IQ2000 (size=0x2000, entropy=0.606170)
761856        0xBA000         None (size=0x19000, entropy=0.650506)
864256        0xD3000         IQ2000 (size=0x1000, entropy=0.656057)
868352        0xD4000         None (size=0x2000, entropy=0.670506)
876544        0xD6000         IQ2000 (size=0x2800, entropy=0.647489)
886784        0xD8800         None (size=0x3f000, entropy=0.669609)
1144832       0x117800        IQ2000 (size=0x800, entropy=0.645091)
1146880       0x118000        None (size=0x16000, entropy=0.680016)
1236992       0x12E000        IQ2000 (size=0x1800, entropy=0.637937)
1243136       0x12F800        None (size=0x9000, entropy=0.515688)
1280000       0x138800        i860 (size=0x2800, entropy=0.505416)
1290240       0x13B000        None (size=0x2000, entropy=0.520863)
1298432       0x13D000        Mico32 (size=0x800, entropy=0.482741)
1300480       0x13D800        None (size=0x24800, entropy=0.597388)
1449984       0x162000        IQ2000 (size=0x800, entropy=0.632276)
1452032       0x162800        None (size=0x16000, entropy=0.649701)
1542144       0x178800        IQ2000 (size=0x800, entropy=0.607468)
1544192       0x179000        None (size=0x19800, entropy=0.650747)
1648640       0x192800        IQ2000 (size=0x5000, entropy=0.662928)
1669120       0x197800        None (size=0x16000, entropy=0.665614)
1759232       0x1AD800        IQ2000 (size=0x800, entropy=0.670895)
1761280       0x1AE000        None (size=0x14800, entropy=0.667852)
1845248       0x1C2800        IQ2000 (size=0x800, entropy=0.588944)
1847296       0x1C3000        None (size=0x2b000, entropy=0.676079)
2023424       0x1EE000        IQ2000 (size=0x800, entropy=0.624574)
2025472       0x1EE800        None (size=0x1a800, entropy=0.560986)
2134016       0x209000        IA-64 (size=0x2800, entropy=0.350932)
2144256       0x20B800        None (size=0x5800, entropy=0.348755)
2166784       0x211000        IA-64 (size=0x800, entropy=0.324605)
2168832       0x211800        None (size=0x71800, entropy=0.583669)
2633728       0x283000        i860 (size=0x800, entropy=0.355774)
2635776       0x283800        None (size=0x1800, entropy=0.357956)
2641920       0x285000        IA-64 (size=0x1000, entropy=0.353298)
2646016       0x286000        None (size=0x4800, entropy=0.349873)
2664448       0x28A800        IA-64 (size=0x1000, entropy=0.287276)
2668544       0x28B800        None (size=0x2800, entropy=0.341594)
2678784       0x28E000        IA-64 (size=0x1000, entropy=0.340884)
2682880       0x28F000        None (size=0x15000, entropy=0.509803)
2768896       0x2A4000        MMIX (size=0x800, entropy=0.560577)
2770944       0x2A4800        None (size=0x8a000, entropy=0.641322)
3336192       0x32E800        OCaml (size=0x2000, entropy=0.382561)
3344384       0x330800        None (size=0x42800, entropy=0.593790)
</code>```

stmpsys.sb

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
314           0x13A           ARM executable code, 16-bit (Thumb), little endian, at least 575 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0x5800, entropy=0.692062)
22528         0x5800          TMS320C6x (size=0x200, entropy=0.612087)
23040         0x5A00          None (size=0x4000, entropy=0.678696)
39424         0x9A00          TMS320C6x (size=0x200, entropy=0.609237)
39936         0x9C00          None (size=0x2400, entropy=0.671392)
49152         0xC000          ARC32el (size=0x200, entropy=0.618732)
49664         0xC200          TMS320C6x (size=0x200, entropy=0.597122)
50176         0xC400          None (size=0x1400, entropy=0.642002)
55296         0xD800          ARC32el (size=0x200, entropy=0.581111)
55808         0xDA00          None (size=0x7200, entropy=0.499010)
84992         0x14C00         TMS320C6x (size=0x400, entropy=0.588876)
86016         0x15000         None (size=0xb200, entropy=0.421008)
</code>```

updater.sb - from DSP of STMP35xx-based Portable media player (DSP56004-compatible)

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
34195         0x8593          ARM executable code, 16-bit (Thumb), big endian, at least 809 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0x24000, entropy=0.559532)
147456        0x24000         TMS320C6x (size=0x800, entropy=0.642204)
149504        0x24800         None (size=0x2000, entropy=0.657037)
157696        0x26800         TMS320C6x (size=0x800, entropy=0.621518)
159744        0x27000         None (size=0x11000, entropy=0.666237)
229376        0x38000         TMS320C6x (size=0x1800, entropy=0.625215)
235520        0x39800         None (size=0x4000, entropy=0.656501)
251904        0x3D800         TMS320C6x (size=0x800, entropy=0.619983)
253952        0x3E000         None (size=0x6800, entropy=0.658247)
280576        0x44800         TMS320C6x (size=0x3000, entropy=0.678292)
</code>```

Here are the bin and sb files:https://easyupload.io/zzuycg

And also there is an output of an media player based on STMP34xx SoC:

resource.bin

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1545          0x609           ARM executable code, 16-bit (Thumb), big endian, at least 538 valid instructions

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             None (size=0x25000, entropy=0.655862)
151552        0x25000         OCaml (size=0x1800, entropy=0.213865)
157696        0x26800         None (size=0x47000, entropy=0.585404)
448512        0x6D800         OCaml (size=0x800, entropy=0.226252)
450560        0x6E000         None (size=0xa800, entropy=0.550543)
</code>```

Here are the bin files:https://easyupload.io/jw5z4i

Datasheet:https://www.rockbox.org/wiki/pub/Main/DataSheets/stmp35xx-ds-1-03.pdf

Ref. Schematics:http://www.rockbox.org/wiki/pub/Main/HardwareSchematics/stmp3500_reference_sch_revb.pdf


问:
Difference between __openat and openat (Android)
While reverse engineering an Android process, I wanted to explore the openat function. I noticed that there is a symbol "openat" and another symbol "__openat". What is the difference between these two?

Furthermore, if I use info function openat, I can see more openat related symbols. Can someone also explain what are the differences between these?

```<code>__dl___openat_2
__dl___openat
__openat_2@plt
openat
openat64
__openat_2
__openat
__openat_2@plt
__openat_2@plt
openattr
__openat_2@plt
sun.nio.fs.UnixNativeDispatcher.openatSupported
openat@plt
Java_sun_nio_fs_UnixNativeDispatcher_openat0
__openat_2@plt
</code>```

UPDATE

Suppose I want to get a function pointer to openat, I can do this inside Android Studio

```<code>    int (*getptr)(int, const char*, int, ...);
    getptr = openat;
</code>```

However, I cannot do it for __openat since this function does not seem to exist.

At least this is one difference between the two that I know.

ContentLicense: CC BY-SA 4.0


问:
Help with reversing an application with x64dbg
I am a newbie to reverse engineering. I am trying to reverse engineer an app that uses some form of internet explorer frame kind of thing because I could see use of mshtml.dll and jscript9.dll and with the help of some dynamic analysis with ProcMon I could guess that. Now the thing is I want to know what code gets executed when I enter something in the textbox that the program has. I have tried many things like dll entry breakpoint, windows messages breakpoints, doing a trace into , trace over, string references, call stack method. But none helped me. The app does the check dynamically, there no need for you to press a button and since this is not a normal windows form I cannot set BP on messagebox API also if i could there is no message that gets displayed if there is an error.

Request you guys help me with some ideas as to how to tackle programs that use the internet explorer frame kind of stuff for desktop application with x64dbg


问:
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ARM64 boot executable Image' when running the file command. I've tried running binwalk to extract anything meaningful, but all I get is the Linux kernel ARM64 image and text. My question is, is it even possible to boot this image and how can I go about this?


问:
Need help extracting AP_Pack .obb files
I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb.

Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the internet I saw that someone on GitHub had created a specific extractor for this game: https://github.com/flamewing/sorcery-xtractobb

Unfortunately, very few details are given and I don't know what I should do.

It seems to use the Android .obb files of the game but someone in the Issues section confirms that it works with the .obb files of the PC version of the game, and even with another game from the same developer.

If anyone could explain or point me in the right direction, I would be really grateful.

Title: Need help extracting AP_Pack .obb files


问:
How to analyze Dynamic import resolving malware?
How to analyze a runtime Dynamic import resolving malware? What are the best ways to do that kind of analysis?
Windows malware analysis.</p>


问:
What could be the reason-s for a exe not to load after a Dnspy modification to a DLL
After modifying a method of a DLL with Dnspy, the related EXE won't start.

What could be the reason for it not starting?

Here's what I did:

I modified a method from a DLL with Dnspy using edit Method (C#).

Compiled.

Saved the DLL using Save All with Shared Method Bodies ticked
and  Mixed-Mode module ticked.

Notes:

The saved DLL is 5.29MB vs 4.86MB before saving.

I saved it from inside a duplicate folder of the exe install folder with all other dlls etc.


问:
i want to know how to tracing a exe's http responses and log them
I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way to do it would just to trace their http responses and "log" them can't really find many articles on this so I'm asking if anyone is willing to give me a helping hand and maybe show me some stuff or point me in the right direction</p>


问:
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some problems.

- I need to create a header file in C format to register many classes at once, which is too much work because classes are usually hierarchical.

- While member variable names and some virtual functions can be renamed automatically, simple methods need to be named manually.

Is there a more efficient way to solve these problems?

Title: IDA ATL C++ class reconstruction


问:
How to unpack emotet with x64dbg and do dynamic analysis?
I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if my approach is appropriate?

I run Emotet with arguments given to rundll32.exe using X64DBG. The argument is DllRegisterServer.

I set a breakpoint at NtResumeThread to prevent the child process created by Emotet from executing.

I start a new instance of x64dbg and attach it to the child process. I set a Load DLL breakpoint to prevent execution from proceeding when it detaches from the parent process.

In the child process's x64dbg, I set a breakpoint at VirtualAlloc to identify where the unpacked executable is expanded.

I set a breakpoint at the location identified in step 4 to stop just before execution after unpacking is complete.


问:
What is the best emulator/environment for android debugging?
I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want.

There are fast emulators but they don't provide good debugging features not even root privilege
and those who are designed for debugging are so slow and incapable of debugging games or even loading them, only tiny apps.

I tried some emulators but even after rooting, I can not push things like dbg_server into /system/.

I want to debug both dalvik and arm.
I'm so frustrated at this point. Can anyone give a list of what to install/do?


问:
IDA Pro debugging an ARM binary on windows with QEMU
I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging" ?


问:
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);

It doesn't seem possible to create an __m128i datatype in a Frida script. Does anyone know how to achieve this?

For reference, I am on android and this is an Intel x64 intrinsic. Info on the datatype here: http://portal.nacad.ufrj.br/online/intel/compiler_c/common/core/GUID-7478B278-2240-44D8-B396-1DC508E3656E.htm


问:
How would one go about finding the key to this crackme (polynomial - childhood crackme)?
I'm trying to solve a crackme that contains a key check like so:

```<code>    lVar4 = vulnerability1(passwd);
    if (lVar4 == 0x260a4c7d7af23fc0) {
      solve_check(1,0xffffffff);
      free(passwd);
      uVar3 = 1;
    }
</code>```

with childhood vulnerability being

```<code>long vulnerability1(char *param_1)

{
  char *local_20;
  long local_10;

  local_10 = 0x7364626d;
  local_20 = param_1;
  while( true ) {
    if (*local_20 == 0) break;
    local_10 = local_10 * 0x1003f + (long)(int)*local_20;
    local_20 = local_20 + 1;
  }
  return local_10;
</code>```

}

Basically, vulnerability1 cycles through each letter of param1 and applies some transformations. It returns this transformation and it must be the value 0x260a4c7d7af23fc0

My question is: Is there an more "correct" way of finding the correct string besides brute force? How would a veteran RE person do this?


问:
What is patched by LX 16:32 fixup record
In LX format description in section
3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option:

06h = 16:32 Pointer fixup (48-bits).

1. How many bytes does this fixup change and how? I found a particular example of such fixup, it points to 2nd byte of a certain jump instruction:

66EA665544332211  jmp dword 0x1122:0x33445566

I assume it at least changes 4-byte offset (33445566), but does it also change 16 bit selector (1122)?

2. Where can I find more in-depth description of different fixup kinds? IBM doc seems to assume it to be common knowledge.


问:
binwalk gives an endless list of files
I am running binwalk -B image.bin on an 8MB firmware that I dumped from an MStar MSC313e based ip camera. The binwalk output is longer than I would expect. Could they be mostly false positives?

I have assumed that the squashfs parts are detected properly, and I have successfully unsquashed the 3 squashfs at

0x210000 (len 0x430000): squashfs_1_out

0x640000 (len 0x90000): squashfs_2_out

0x6D0000 (len 0xFFF32): squashfs_3_out

Then I have assumed that and jffs2 at 0x530000-0x640000 is 1 big jffs2 and successfully extracted it

0x530000 (len 0x110000): jffs2_out

```<code>.
├── jffs2_out
│   ├── asnvdvrclientdemo
│   ├── audiofile_player
│   └── wificonf
│       ├── RT2870AP
│       └── RT2870STA
├── squashfs_1_out
│   ├── bin
│   ├── etc
│   │   ├── bak
│   │   │   └── reset
│   │   └── init.d
│   ├── font
│   ├── lib
│   │   ├── libc
│   │   └── modules
│   │       └── 3.18.30
│   └── usr
│       ├── bin
│       ├── lib
│       └── share
├── squashfs_2_out
│   └── modules
└── squashfs_3_out
    ├── apps
    ├── demo
    ├── iq
    ├── lib
    └── modules
</code>```

How would you go about this?

Entropy plot:

Binwalk output:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
95704         0x175D8         CRC32 polynomial table, little endian
98216         0x17FA8         xz compressed data
196608        0x30000         uImage header, header size: 64 bytes, header CRC: 0x4E02B7B8, created: 2018-05-04 01:36:00, image size: 97660 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xC803513A, OS: Firmware, CPU: ARM, image type: OS Kernel Image, compression type: lzma, image name: "MVX1##I3g#######CM_UBT1501###XVM"
196672        0x30040         xz compressed data
393216        0x60000         uImage header, header size: 64 bytes, header CRC: 0x18637732, created: 2019-05-22 04:21:22, image size: 1648896 bytes, Data Address: 0x20008000, Entry Point: 0x20008000, data CRC: 0xC0344FAC, OS: Linux, CPU: ARM, image type: Multi-File Image, compression type: lzma, image name: "MVX2##I3gbeb3a68KL_LX318####[BR:"
393292        0x6004C         xz compressed data
1967368       0x1E0508        xz compressed data
2162688       0x210000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3191278 bytes, 245 inodes, blocksize: 131072 bytes, created: 2019-05-22 04:21:30
5439488       0x530000        JFFS2 filesystem, little endian
5505128       0x540068        JFFS2 filesystem, little endian
5505608       0x540248        JFFS2 filesystem, little endian
5534392       0x5472B8        JFFS2 filesystem, little endian
5534580       0x547374        Zlib compressed data, compressed
5534756       0x547424        Zlib compressed data, compressed
5534932       0x5474D4        Zlib compressed data, compressed
5535108       0x547584        Zlib compressed data, compressed
5535284       0x547634        Zlib compressed data, compressed
[... snip snap 380 Zlib/JFFS2 lines omitted...]
6420404       0x61F7B4        JFFS2 filesystem, little endian
6422676       0x620094        Zlib compressed data, compressed
6423024       0x6201F0        JFFS2 filesystem, little endian
6460760       0x629558        Zlib compressed data, compressed
6461188       0x629704        Zlib compressed data, compressed
6461616       0x6298B0        Zlib compressed data, compressed
6462044       0x629A5C        Zlib compressed data, compressed
6462472       0x629C08        Zlib compressed data, compressed
6462900       0x629DB4        Zlib compressed data, compressed
6463328       0x629F60        Zlib compressed data, compressed
6463760       0x62A110        Zlib compressed data, compressed
6464192       0x62A2C0        Zlib compressed data, compressed
6464624       0x62A470        Zlib compressed data, compressed
6465056       0x62A620        Zlib compressed data, compressed
6465488       0x62A7D0        Zlib compressed data, compressed
6465920       0x62A980        Zlib compressed data, compressed
6466352       0x62AB30        Zlib compressed data, compressed
6466784       0x62ACE0        Zlib compressed data, compressed
6467216       0x62AE90        Zlib compressed data, compressed
6467648       0x62B040        Zlib compressed data, compressed
6468080       0x62B1F0        Zlib compressed data, compressed
6468512       0x62B3A0        Zlib compressed data, compressed
6468944       0x62B550        Zlib compressed data, compressed
6469376       0x62B700        Zlib compressed data, compressed
6469808       0x62B8B0        Zlib compressed data, compressed
6470240       0x62BA60        Zlib compressed data, compressed
6470672       0x62BC10        Zlib compressed data, compressed
6471104       0x62BDC0        Zlib compressed data, compressed
6471536       0x62BF70        Zlib compressed data, compressed
6471968       0x62C120        Zlib compressed data, compressed
6472400       0x62C2D0        Zlib compressed data, compressed
6472832       0x62C480        Zlib compressed data, compressed
6473264       0x62C630        Zlib compressed data, compressed
6473696       0x62C7E0        Zlib compressed data, compressed
6474128       0x62C990        Zlib compressed data, compressed
6474560       0x62CB40        Zlib compressed data, compressed
6474992       0x62CCF0        Zlib compressed data, compressed
6475424       0x62CEA0        Zlib compressed data, compressed
6475856       0x62D050        Zlib compressed data, compressed
6476288       0x62D200        Zlib compressed data, compressed
6476720       0x62D3B0        Zlib compressed data, compressed
6477348       0x62D624        Zlib compressed data, compressed
6477716       0x62D794        Zlib compressed data, compressed
6478148       0x62D944        Zlib compressed data, compressed
6478580       0x62DAF4        Zlib compressed data, compressed
6479340       0x62DDEC        Zlib compressed data, compressed
6479772       0x62DF9C        Zlib compressed data, compressed
6480204       0x62E14C        Zlib compressed data, compressed
6480640       0x62E300        Zlib compressed data, compressed
6481076       0x62E4B4        Zlib compressed data, compressed
6481508       0x62E664        Zlib compressed data, compressed
6481940       0x62E814        Zlib compressed data, compressed
6482372       0x62E9C4        Zlib compressed data, compressed
6482804       0x62EB74        Zlib compressed data, compressed
6483236       0x62ED24        Zlib compressed data, compressed
6483668       0x62EED4        Zlib compressed data, compressed
6484100       0x62F084        Zlib compressed data, compressed
6484532       0x62F234        Zlib compressed data, compressed
6484964       0x62F3E4        Zlib compressed data, compressed
6485396       0x62F594        Zlib compressed data, compressed
6485828       0x62F744        Zlib compressed data, compressed
6486260       0x62F8F4        Zlib compressed data, compressed
6486688       0x62FAA0        Zlib compressed data, compressed
6487116       0x62FC4C        Zlib compressed data, compressed
6487544       0x62FDF8        Zlib compressed data, compressed
6488064       0x630000        JFFS2 filesystem, little endian
6553600       0x640000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 575890 bytes, 15 inodes, blocksize: 131072 bytes, created: 2019-04-16 09:59:10
7143424       0x6D0000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 1048370 bytes, 52 inodes, blocksize: 131072 bytes, created: 2019-05-22 09:58:29
</code>```

Title: binwalk gives an endless list of files


问:
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code

```<code>   undefined4 CspDBInitPdtInterface(undefined4 *param_1)

{
  dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
  dbAddCfgItem(0xffff,1,"/userconfig/cfg/db_default_cfg.xml");
  dbAddCfgItem(0xffff,2,"/userconfig/cfg/db_backup_cfg.xml");
  param_1[2] = 1;
  param_1[3] = CspDBSetBackupItem;
  param_1[7] = dbPdtTransferCfg;
  *param_1 = 0;
  strncpy((char *)((int)param_1 + 0x117),"L04&Product@5A238dc79b15726d5c05",0x20);
  strncpy((char *)(param_1 + 0x4e),"ZTE%FN$GponNJ025678b02a85c63c705",0x20);
  PdtDBSetUserCfgAESCBCEncryKey((int)param_1 + 0xd5,(int)param_1 + 0xf6,0x21,0x21);
  return 0;
}

 void PdtDBSetUserCfgAESCBCEncryKey(char *param_1,char *param_2,size_t param_3,size_t param_4)`

{
  int iVar1;
  undefined auStack_74 [64];
  uint local_34;

  local_34 = (uint)(param_2 == (char *)0x0 || param_1 == (char *)0x0);
  if (param_2 != (char *)0x0 && param_1 != (char *)0x0) {
    memset(auStack_74,local_34,0x40);
    iVar1 = GetTagParam(0x200,auStack_74,0x40);
    if (iVar1 == 0) {
      snprintf(param_1,param_3,"8dc79b15726d5c46%s",auStack_74);
      snprintf(param_2,param_4,"678b02a85c63c786%s",auStack_74);
    }
    else {
      strncpy(param_1,"8dc79b15726d5c46d412af8cbed65aad",param_3 - 1);
      strncpy(param_2,"678b02a85c63c786def4523b061265e8",param_4 - 1);
    }
  }
  return;
}
</code>```

Did I understand correctly that there are two keys?


问:
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own programs while the program is linked to my guarded library.

What anti-debug techniques should be adopted ?Provided that the users are able to debug their programs and my library is not comprised.

By the way, my friend has a proprietary software which licensed through a software license, (anti-debug of course). If he wants to debug his program while using the software, He has to buy an extra dongle and replace the lib with the version which coupled with the dongle.

Thanks!


问:
Better understanding of BoF and what happens in memory
I was trying to learn buffer overflows and found some exercises. One of the exercise was a buffer overflow with a read instead of the famous gets.

compiled with: gcc test.c -m32 -no-pie

```<code>#include <stdio.h>
#include <unistd.h>
#include <unistd.h>

void pwnme()
{
    char buffer[20];
    puts("Gimme your payload: ");
    read(0, buffer, 33);
}

int main()
{
    pwnme();
    return 0;
}

int win()
{
    execl("/bin/cat", "cat", "flag.txt", NULL);
    return 0;
}
</code>```

I have 2 questions about this code and the exploit that come with it.

First of all, here is the command i used to create the exploit:

```<code>echo -ne 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xcf\x91\x04\x08' > pay
</code>```

And then i run with:

```<code>./a.out < pay
</code>```

To make the magic exploit, I had some ideas and wanted to be sure if they are good/true or wrong/false. As we can see in the code, the read takes 33, but the buffer is only 20. I heard that allocation always creates, in memory, block of 8, so i took the upper 2ⁿ value, and found 32 was working. Does this theory works even when there is no memory allocation (malloc) ?
This is not very clear for me and thats what i want to clearly understand.
Is this true and can i use this statement to have a better guess of the good padding i should use in other exercise ?

To better understand the behavior behind it, I tried modifying the size READ takes.
I used various size, 33, 50, 64, 90, 127. The thing i don't understand is that i can use the same exploit until the size exceed 127. For values > 127, the exploit does not work anymore. So my second question is WHY.

Thanks before all everyone, thanks for your time, sorry if i was not very clear but i want to have a deep understanding of those concepts.
Thanks before all. My goal is to have a thorough knowledge of those concepts so don't hesitate to be very technical and go dip in the asm.

That's all folks
:)


问:
what is Max operating temperature of TASSIMO Bosch My Way
Having read the articles regarding changes to barcodes on Tassimo Coffee Machines, I was wanting to know if the water temperature could be changed to a hotter setting if possible via the barcodes.
Unfortunately I am not experienced in editing code as described.

Thanks for your time.
Kind regards
Ivor Mac


问:
Fuzzing closed application
I want to get from you some advice about fuzzing.

I am checking a huge C application (not open source) which is also an http server.

My purpose is to fuzz the http server via the requests being sent to the server for finding memory corruptions.

There are various tools for fuzzing: AFLNET,AFL (libdesock does not work well), honggfuzz and so on.

What do you recommend for me for fuzz the application?

Title: Fuzzing closed application


问:
Fixing the stackpointer in IDA when exception handlers are used
The code that I'm looking at uses exception handlers and it seems that the stack pointer is misscalculated in the case of the exception handler. I posted this function as an exmple in full, so that the problem can be seen.

What I'm interested in is, how I can get rid of the sp-analysis failing.

```<code>000                 push    ebp
004                 mov     ebp, esp
004                 push    0
008                 push    ebx
00C                 push    esi
010                 mov     ebx, eax
010                 xor     eax, eax
010                 push    ebp
014                 push    offset j_ExceptionHandler1_2
018                 push    dword ptr fs:[eax]
01C                 mov     fs:[eax], esp
01C                 push    1               ; uIDEvent
020                 mov     eax, [ebx+28h]
020                 push    eax             ; hWnd
024                 call    j_KillTimer
01C                 mov     esi, [ebx+24h]
01C                 test    esi, esi
01C                 jz      short loc_4467F1
01C                 cmp     byte ptr [ebx+34h], 0
01C                 jz      short loc_4467F1
01C                 cmp     word ptr [ebx+2Eh], 0
01C                 jz      short loc_4467F1
01C                 push    0               ; lpTimerFunc
020                 push    esi             ; uElapse
024                 push    1               ; nIDEvent
028                 mov     eax, [ebx+28h]
028                 push    eax             ; hWnd
02C                 call    j_SetTimer
01C                 test    eax, eax
01C                 jnz     short loc_4467F1
01C                 lea     edx, [ebp+Str]
01C                 mov     eax, ds:off_5C6E3C
01C                 call    LoadString      ; EAX = StringResource
                                            ; EDX = Target
                                            ;
01C                 mov     ecx, [ebp+Str]
01C                 mov     dl, 1
01C                 mov     eax, off_40CA00
01C                 call    sub_409F34
01C                 call    GlobalExceptionE

    loc_4467F1:                             ; CODE XREF: sub_446788+27j
                                            ; sub_446788+2Dj
                                            ; sub_446788+34j
                                            ; sub_446788+46j
00C                 xor     eax, eax
00C                 pop     edx
008                 pop     ecx
004                 pop     ecx
000                 mov     fs:[eax], edx
000                 push    offset loc_44680E

    loc_4467FE:                             ; CODE XREF: CODE:0044680Cj
004                 lea     eax, [ebp+Str]  ; RDStr
004                 call    ReleaseDelphiString ; EAX = Pointer to a stringpointer
                                            ;
                                            ; Refcount is decreased and the pointer is set to NULL.
004                 retn
    sub_446788      endp ; sp-analysis failed

    ; [00000005 BYTES: COLLAPSED FUNCTION j_ExceptionHandler1_2. PRESS KEYPAD "+" TO EXPAND]
    ; ---------------------------------------------------------------------------
                    jmp     short loc_4467FE
    ; ---------------------------------------------------------------------------
    ; START OF FUNCTION CHUNK FOR sub_446788

    loc_44680E:                             ; CODE XREF: sub_446788+7Ej
                                            ; DATA XREF: sub_446788+71o
004                 pop     esi
000                 pop     ebx
-04                 pop     ecx
-08                 pop     ebp
-0C                 retn
</code>```

Update

The the GlobalExceptionE function is this

```<code>000                 pop     edx
-04                 push    esp
000                 push    ebp
004                 push    edi
008                 push    esi
00C                 push    ebx
010                 push    eax
014                 push    edx
018                 push    esp             ; lpArguments
01C                 push    7               ; nNumberOfArguments
020                 push    1               ; dwExceptionFlags
024                 push    0EEDFADEh       ; dwExceptionCode
028                 push    edx
02C                 jmp     j_RaiseException
</code>```

ContentLicense: CC BY-SA 3.0


问:
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.

My idea is to identify executable vads that were created after a process was created by for example LoadLibrary() calls. As these vads should not correspond to any dll imported.

Therefor I recursively walk the processes / modules import directories (DIRECTORY_ENTRY_IMPORT and DIRECTORY_ENTRY_DELAY_IMPORT). Whenever I find a new dll, I mark the corresponding vad as imported and start scanning from there.

I use the volatility plugin ProcExeDump to dump the module and peFile to read the import directories from the dumped module.

Such a recusive walk looks like this:

```<code>PID: 600, services.exe

msvcrt.dll - 0x77c10000
    kernel32.dll - 0x7c800000
        ntdll.dll - 0x7c900000
advapi32.dll - 0x77dd0000
    secur32.dll - 0x77fe0000
        netapi32.dll - 0x5b860000
            ws2_32.dll - 0x71ab0000
                ws2help.dll - 0x71aa0000
                    user32.dll - 0x77d40000
                        cant parse delay import directory
rpcrt4.dll - 0x77e70000
userenv.dll - 0x769c0000
    authz.dll - 0x776c0000
        cant parse delay import directory
    ole32.dll - 0x774e0000
        gdi32.dll - 0x77f10000
    oleaut32.dll - 0x77120000
scesrv.dll - 0x758e0000
    cant parse delay import directory
umpnpmgr.dll - 0x758c0000
    winsta.dll - 0x76360000
ncobjapi.dll - 0x5f770000
    msvcp60.dll - 0x76080000
</code>```

As you can see, sometimes the delay import directories can't be read although the module has the directory and the size of the directory is not 0.

In the above example I was able to identify 20 executable vads that correspond to imported modules. (20 out of a total of 38 executable vads)

Among the other 18 executable vads, there are many that belong to other dlls such as version.dll, uxtheme.dll or apphelp.dll

example:

```<code>Start: 2008285184, 0x77b40000L
Flags: CommitCharge: 1, ImageMap: 1, Protection: 7
ControlArea @8a3f4bf8 Segment e15392a0
Dereference list: Flink 00000000, Blink 00000000
NumberOfSectionReferences:          1 NumberOfPfnReferences:          12
NumberOfMappedViews:                4 NumberOfUserReferences:          5
WaitingForDeletion Event:  00000000
Control Flags: Accessed: 1, File: 1, HadUserReference: 1, Image: 1
FileObject @8a4fc660, Name: \WINDOWS\system32\apphelp.dll
First prototype PTE: e15392d8 Last contiguous PTE: fffffffc
Flags2: Inherit: 1
</code>```

Any Ideas why the import directories can't be parsed? Or any other comments regarding my idea? Maybe a way to achive the same just another way...

Any help is most appreciated, thank you!


问:
Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg
I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour.

When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header
compared to that what I could expect analysing the file using hex-editor.
For example number of sections is different.

Does anyone know what's going on?


问:
funcap not capturing information in IDA debugger
I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github.com/deresz/funcap/) mentioned in another question here and it looked like exactly what I wanted.

However, I've loaded/run the script and it doesn't look like it's doing anything. I get messages saying it's on and off, but other than that no output. It's also asked me to select a debugger so I know the script is running but there's no output or notes added to the idb.

When the plugin was published it said there was a lot of documentation available but it doesn't look like anyone else has had this issue. I've tried running the script and the running the process in a debugger, and breaking at the beginning of a processor and then running the script and in both situations it hasn't worked.

I feel like this is a dumb question but I was hoping someone else here had experience using this script, or a similar one and could point towards what I'm doing wrong. I'm on IDA 6.3 if that makes a difference.

Edit: I forgot to mention above the original reason I was looking at the script is I'd just like something to quickly tag functions and their parameters. funcap looks like the only one I've run into that can do this. I've also looked at doing something with PIN but it seemed like (at the time) this would be easier.


问:
Patch ELF (arm): remove constructor segment
I got an ELF shared library with a constructor function that is executed every time the library is loaded:

```<code>.init_array:00005E5C ; =====================================================================
.init_array:00005E5C
.init_array:00005E5C ; Segment type: Pure data
.init_array:00005E5C                 AREA .init_array, DATA
.init_array:00005E5C                 ; ORG 0x5E5C
.init_array:00005E5C                 DCD sub_239C
.init_array:00005E60                 DCB    0
.init_array:00005E61                 DCB    0
.init_array:00005E62                 DCB    0
.init_array:00005E63                 DCB    0
.init_array:00005E63 ; .init_array   ends
.init_array:00005E63
</code>```

This constructor calls the function sub_239C:

```<code>.text:0000239C
.text:0000239C ; =============== S U B R O U T I N E =======================================
.text:0000239C
.text:0000239C ; Attributes: thunk
.text:0000239C
.text:0000239C sub_239C ; DATA XREF: .init_array:00005E5Co
.text:0000239C                 B sub_1354
.text:0000239C ; End of function sub_239C
.text:0000239C
</code>```

Is there any way for me to remove the constructor and make sub_239C exported symbol


问:
What other public firmware/reverse engineered alternatives are available to replace stock firmware?
Recently I have taken an interested in learning about Linux and the Unix family of operating systems.

In my quest to do so I found that my simple home router contained hardware capable of much more than I thought. It was a fully fledged computer running Linux!

I was able to load both Openwrt and then DD-wrt allowing experimentation with a mini Linux computer.

Im also aware that there are many other possiblities for router/modem firmware:
https://en.wikipedia.org/wiki/List_of_wireless_router_firmware_projects

Other projects that give this possibility are:

Cyanogenmod (plus many more) for many Android based mobiles

FreemyiPod for Apple iPods

Rockbox for other Mp3 players including iPods

What other popular projects are available that provide customized firmware or an alternative to proprietary software that can be loaded on to a device?

Is anyone able to provide a link to any lists of such projects?


问:
How to send and render an .html for chromecast using RAW http requests?
I am trying to RE the chrome cast protocol.
I saw Koushik Dutta did RE the protocol, but didn't find any post online analyze the protocol. Moreover Google changed it a little bit since then.

currently I figured out some of the http packets the sender and receiver transmit but I would like to figure out what is the http request I need to send the cast device in order it will render an .html file and/or javascript code on it.

I want to mimic this snippet without using google API nor APP ID nor NAMESPACE:

```<code> $(function() {
        var receiver = new cast.receiver.Receiver('*** YOUR APP ID ****', ['*** YOUR NAMESPACE ***']),
            channelHandler = new cast.receiver.ChannelHandler('*** YOUR NAMESPACE ***'),
            $messages = $('.messages');

        channelHandler.addChannelFactory(
            receiver.createChannelFactory('*** YOUR NAMESPACE ***'));

        receiver.start();

        channelHandler.addEventListener(cast.receiver.Channel.EventType.MESSAGE, onMessage.bind(this));

        function onMessage(event) {
            $messages.html(event.message.type);
        }
</code>```

I want to find the right curl / http request in order to run my .js on the cast without using google API. for example the following curl:

```<code>curl -H “Content-Type: application/json” http://10.0.1.2:8008/apps/YouTube -X DELETE
</code>```

kills the running app on the cast. How can I make it run my app without being bounded to google's whitelist and demo API.

The google cast_reciver.js is obfuscated:

```<code>cr$rb = function (a) {
    cr$k(a, "Listener can not be null.");
    if ("function" == cr$b(a)) return a;
    cr$k(a.handleEvent, "An object listener must have handleEvent method.");
    return a[cr$Ab] || (a[cr$Ab] = function (b) {
        return a.handleEvent(b)
    })
};
</code>```


问:
How to disassemble Ubicom32 binaries?
I cannot figure out how to disassemble these binaries I pulled from a wireless router I recently came into possession of.

file output:

```<code>httpd: ELF 32-bit MSB executable, version 1 (SYSV), dynamically linked (uses shared libs), stripped
</code>```

binwalk output:

```<code>DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
0               0x0             ELF 32-bit MSB executable, Ubicom32, version 1 (SYSV)
</code>```

IDA doesn't seem to disassemble it correctly. gobjdump doesn't seem to have any matching targets for it.

Am I just missing something obvious? How should I disassemble this?

Title: How to disassemble Ubicom32 binaries?


问:
Shotcuts in immunity debugger
Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity debugger.

Do you know how to use custom keybinds in immdbg? Any external tool/plugin for this purpose?

Title: Shotcuts in immunity debugger


问:
How to decrypt this file?
I have to decrypt a file that is used by an app built using VB5. The file itself contains some data that is decrypted when the app is run and the decrypted data is text data that is displayed in a listview.

I have seen that the app decrypts each character one by one. I think the decryption algorithm is some kind of bit shifting where each character is converted to binary and depending on the length of the binary it does some operation.

For example

```<code>Encrypted character #

Decrypted Character 1

"#" in ascii, 35 = 10 0011

"1" in ascii, 49 = 11 0001

encrypted: 178 = 10 11 00 10
decrypted:  83 = 1  01 00 11
</code>```

The full encrypted file can be found here.

So far I have seen two methods to get the contents:

Decrypt the file

Read the memory of the app when it is run.

Any help/comment is most welcome.

Title: How to decrypt this file?


问:
Is it possible to know what changed on a mssql database?
I'm trying to reverse engineer the mssql database behind an ERP.

I was planning to export the database as a sql file before and after I do a modification in the ERP to be able to diff the files. But my files are huge. About 8 GB for the development environment, it would be a lot more for the production one.

I was wondering if there's a better way. Maybe with snapshots or maybe I could enable a log with all SQL queries. Or maybe I could sniff the data on the network.

I'm using Sql Server 2005.


问:
I want to know more about how a particular exploit works. How do I do that?
I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect potential malicious attacks on the server as a part of my class assignment. Looking at the exploit code I can easily write a rule to look for the keyword SITE or \x8d\xa0\xfc\xdf\xff\xff (as my vulnerable Vm is an Ubuntu machine). However, that would be pretty lame and also writing patches specific to the code of the exploit is not a good practice. I would like the rule to apply even if the exploit code is changed.

I have read about the bug and I know that the presence of special IAC character (255 or \xFF) would potentially lead to buffer overflow. However, any normal packet could contain  \xFF and writing a rule for detecting \xFF would to false positives. I want to know some specific details of the exploit which would either help me figure out where I need to look for the IAC character or help me find some details about the exploit which would allow me to find malicious packets without having to resort to look for IAC character \xFF. How do I go about doing that? Any help or pointers would be appreciated.

Thanks.

EDIT:

Currently, I have installed udcli to try to understand the commands in the ROPStack portion of the code. For ex: I am trying to evaluate line 100 (0x805a544,  # mov eax,esi / pop ebx / pop esi / pop ebp / ret) in the code. I have tried:

```<code>echo "08 05 a5 44" | udcli -32 -x
echo "805a544" | udcli -32 -x
echo "44 a5 05 08" | udcli -32 -x
echo "44 a5 05 80" | udcli -32 -x
</code>```

But none of them evaluates to the following sequence

```<code>mov eax,esi
pop ebx
pop esi
pop ebp
ret
</code>```


问:
How to write bit-by-bit to a medium, as opposed to byte-by-byte?
I am trying to write binary opcodes, but I can't in a text editor as 1s and 0s because:

1 or 0 on a text editor ends up being stored as the literal ASCII equivalent code on the storage medium, not the individual bit values as part of a machine instruction. I want to write a program in machine code to be executable directly to the CPU without assembling/etc. However, there's only one way I can think of:

I can flip the conundrum backwards, and instead of worrying about the formation of bits, I can write ASCII characters and save them in a text editor so long as their ASCII-binary equivalent matches the identical configuration of an opcode byte(s) for the target machine. But then the problem arises again ... there is not an existing one-byte ASCII character that can match every possible combination of bits within an opcode, so I can't code this way.

For me to write in machine code, I'd need a way of directly placing the right formation of bits that make up each byte(s) and instruction(s).

How could I do this?

CORRECTION: I am not trying to write a single bit at a time (not possible in x86), but get a byte configured with the correct bits in order to be stored that make up the correct machine instructions.


问:
Where is uni.inc file?
In the IDA Pro generated asm code, I see this line:

```<code>include uni.inc ; see unicode subdir of ida for info on unicode
</code>```

I don't find unicode subdir nor do I find uni.inc file...

Could any one give me some help? Thank you!

Title: Where is uni.inc file?


问:
Ollydbg and hundreds of events under QT GUI
I'm trying to debug an application that uses QT GUI library. The problem is that I can't even start debugging as ollydbg seems to be processing ~1k events per second where in stack trace I see all of them running inside QT. The application has very fancy GUI (blending, custom window and buttons etc) and perhaps that is what hangs the debugger as it tries to process all this. Eventually it bluescreens. Can I somehow force olly to skip or ignore these events? </p>


问:
Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA
I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to the register which wrecks havoc in terms of code readability/cross-referencing. Therefore, I wrote an IDApython script to fix up these calls/references. Effectively the script uses poor man's static tracing and some logic to find what function is being called and creates a cross-reference.

add_cref(ea_from,ea_to,fl_CF)

In its current state, I create a repeatable comment or a function comment for readability. This works as shown below, and is MUCH better now that I read what a repeatable comment really is, however it can be somewhat annoying keeping function comments synced with function names in the function window and what not while reversing/documenting the binary. Is there a better way of accomplishing this?

Another nuisance is if I re-run auto-analyze, these comments are cleared.


问:
How to analyse the communication between a WebApp loaded with awesomium and the native program?
I have a Windows program that uses awesomium to display a WebApp. This WebApp communicates in some way with the client program through some native calls. I found references to window.externalHost and window.native in the JS source, but it's build with YUI and has tens of thousand lines of code and single character variables and I can't quite figure out what exactly they are doing (static analysis).

I have injected Javascript into the WebApp to check those two objects:

```<code>try {
    document.write(JSON.stringify(window.externalHost, null, 4))
} catch (err) {
    document.write(err)
}
</code>```

But window.externalHost is undefined and window.native is {}.

So my questions are:

How are native calls usually set up?

What interfaces do exist and how are they used? (Both directions)

Can I "detour"/"intercept" native calls to see what they are sending?

Are there any remote JS debug projects which I could inject to dynamically debug the complex WebApp?

update 1: I am confident that it uses window.native. Because of this Object {}. It seems likely that the communication is not implemented as window.externalHost.postMessage() based on what I have read on the awesomium wiki.

I now try to capture what methods are called on it. My idea was to overwrite window.onerror to capture all errors and set window.native = undefined; to capture exceptions like Cannot call aNativeCall() on undefined. Unfortunately it seems that windows.native can't be overwritten - it doesn't stay undefined.

Any other ideas?

update 2:

I came up with this javascript code to check some interesting Objects like window.external, etc...

```<code>obj = ['external', 'externalHost', 'native', 'Y', ['Y','native'],['Y','Native'], ['Y','external'], ['Y','externalHost']];
for(i=0; i< obj.length; ++i) {
    try {

        if(obj[i] instanceof Array) {
            var tmp = window[obj[i][0]];
            for(j=1; j<obj[i].length; ++j) {
                tmp = tmp[obj[i][j]]
            }
            document.write(obj[i]+" | <b>"+Object.getOwnPropertyNames(tmp)+"</b><br>");
        } else {
            document.write(obj[i]+" | <b>"+Object.getOwnPropertyNames(window[obj[i]])+"</b><br>");
        }

    } catch(err) {
        document.write(obj[i]+" | <i>Error: "+err+"</i><br>");
    }
}
</code>```

It became slowly more clear that it has to be window.native. This object has the following properties: 'on','isNative','scale','Emitter','call','register','_ready'

When I try to call window.native.call() the native program crashes. And the debug information shows that it crashed in a ProcessRequest function. So I found the right interface.

I now need to find out how exactly this interface is used. Unfortunately I can't overwrite window.native.call = function() { ... } to log the calls.

Anybody another idea?


问:
Windows Media Player - library format
Is anyone aware of any documentation (official or reverse-engineered) on the Windows Media Player library / database .wmdb format?  (Specifically WMP 12).

The file resides at C:\Users\[username]\AppData\Local\Microsoft\Media Player\CurrentDatabase_[nnn].wmdb. It's a binary file, seemingly uncompressed.

I'm willing to work on this, but don't want to waste my time if it's already been done!

Research:

Neither the Mulimedia.cx wiki page, nor the hachoir utility seem to have any information about it.

This blog post links to a product called Simple Carver, a paid forensics utility, that claims to support the format.

This forum post indicates that WMP 11 came with a wmdbexport.exe utility, but this doesn't exist in WMP 12.

Specifically, there are a few tools/scripts I've wanted to write that would need to directly manipulate this database.

Title: Windows Media Player - library format


问:
Is there distributed fuzz testing platform against modern proprietary CPU like SETI@HOME?
My idea is near what SETI Institute does.

Distributed fuzz testing against modern Intel and Amd Central processing units(CPU).

To find similar to Blue Pill bugs.

Is there?


问:
qemu and gdb error: could not load xml document
I'm trying to debug an application using Qemu for AARCH64

```<code>./qemu-arm64-static -g 1234 file.bin
</code>```

When running GDB and connecting to the remote host, I get the following error message:

```<code>$ ./aarch64-linux-gnu-gdb
GNU gdb (crosstool-NG linaro-1.13.1-4.8-2014.03 - Linaro GCC 2014.03) 7.6.1-2013.10
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-build_pc-linux-gnu --target=aarch64-linux-gnu".
For bug reporting instructions, please see:
<https://bugs.launchpad.net/gcc-linaro>.
(gdb) file file.bin
Reading symbols from .bin...(no debugging symbols found)...done.
(gdb) target remote localhost:1234
Remote debugging using localhost:1234
warning: while parsing target description (at line 1): Could not load XML document "arm-neon.xml"
warning: Could not load XML target description; ignoring
0x0000000000000000 in ?? ()
</code>```

arm-neon.xml seems that it should be sent by qemu, strace of qemu:

```<code>read(4, "$qXfer:features:read:arm-neon.xm"..., 256) = 42
sendto(4, "+", 1, 0, NULL, 0)           = 1
sendto(4, "$E00#a5", 7, 0, NULL, 0)     = 7
recvfrom(4, "+", 1, 0, NULL, NULL)      = 1
</code>```

Any idea what is causing the issue ? How is arm-neon.xml should be retrieved by qemu and how to solve it ?


问:
Sharing IDC file between versions 5 and 6 of IDA pro
I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth.

However, the IDC file generated by my program cannot be loaded in his program.

Is there a way for me to generate an IDC file that is compatible with her machine? Is it possible it doesn't work because I am using the trial version of IDA? Are there scripts that can be run on the file to convert it back and forth?


问:
How can you reverse engineer a Windows Phone App?
I know this is a controversial question... but before you answer, keep in mind that this is both legal and there are scenarios where this is needed.

In our case we want to decompile an app, so we can look at some secrets that we need to call a public API.

The problem I have is that I'm not even able to get access to the .XAP file. It can be downloaded from the Windows Phone store, but it's signed, and I guess it requires a Jailbreaked WP to get access to the file system on the phone.

So maybe the question should be "How do reverse engineer a signed Windows Phone App?"


问:
Getting basic blocks using SDK
How to map an arbitrary address to its corresponding basic block in IDA?
There are several ways to do it using Ida-python, but I am interested in pure C++ solutions (using IDA SDK, of course).</p>

Title: Getting basic blocks using SDK


问:
ResumeThread doesn't work after attaching to the process using vTrace
In an effort to learn vtrace I've been trying to attach to a process and hook the import address table and then resume the main thread of a process.  When I don't attach to the process the ResumeThread() call works fine.  But when I do it spins up a thread then the call to ResumeThread() doesn't work and the main thread never runs.  Below is the code...

```<code>from ctypes import *
from ctypes import wintypes
from defines import *
import vdb
import vtrace
import sys
from iathook import *

class PROCESS_INFORMATION(ctypes.Structure):
    _fields_ = [
            ("hProcess",    HANDLE),
            ("hThread",     HANDLE),
            ("dwProcessId", DWORD),
            ("dwThreadId",  DWORD),
            ]

process_info    = PROCESS_INFORMATION()

kernel32 = ctypes.WinDLL('kernel32.dll')

bCreateProcessW = kernel32.CreateProcessA(
                                path_to_binary,
                                None,
                                None,
                                None,
                                True,
                                creation_flags,
                                None,
                                None,
                                byref(startupinfo),
                                byref(process_info))

#launched the process in a suspended state and patch it using DLL injection
#but this code doesn't effect the following code

apptrace = vtrace.getTrace()
apptrace.attach(process_info.dwProcessId)     #1
hookSomeStuff = hookIat(apptrace, 'MSVCR110') #2
#apptrace.resumeThread(process_info.hThread)  #3
dwPrevSuspendCount = kernel32.ResumeThread(process_info.hThread)
</code>```

As I mentioned above when I remove the vtrace attach and and hookIat stuff (line #1 & #2).  The ResumeThread() call works fine and the main thread runs.  I also tried resuming the thread using the vtrace method (line #3) but it tells me that the thread is not suspended.  The main thread doesn't actually run so I wonder how it could not be suspended or what happened to it.  I also check the events of the binary using procmon and when it attaches it spins up another thread and that seems to throw things off.  This may seem awkward and I understand there are many other ways to do this but I'm using it as a learning exercise and now I'm interested why it's not working.  Any help is appreciated and thanks in advance for any help.


问:
Calling Lua by C/C++ in compiled applications
So, currently I've been reverse engineering an application, that allows Lua coding. Because for some special purposes, I need to call Lua directly by C/C++ coding. However, as this application is compiled obviously, I can't simply write a function that calls it. I would need the signature of the original functions (incl. the mask) and then write the function prototype, with calling convention, return type, etc. and later compile it as DLL, then inject it.

All this was done already. I've got the signature by IDAPro using the SigMaker plugin, made the base functions for scanning for the pattern and the masks.

So, that's how for example the Lua Print Functions looks like:

```<code>DEC_FUNC(__cdecl, DWORD, print, int a1);
</code>```

Looking into the Lua source, a1 is "lua_State *L". How would I now call this function and for example print "hello world" in Lua? Excuse me for my incompetence in such things like that, but I've been stuck to this for a couple of days now.

For comparison you may look here to the code part from lbaselib.c (in the Lua source):

```<code>static int luaB_print (lua_State *L) {
int n = lua_gettop(L);  // number of arguments
int i;
lua_getglobal(L, "tostring");
for (i=1; i<=n; i++) {
const char *s;
lua_pushvalue(L, -1);  // function to be called
lua_pushvalue(L, i);   // value to print
lua_call(L, 1, 1);
s = lua_tostring(L, -1);  // get result
if (s == NULL)
  return luaL_error(L, LUA_QL("tostring") " must return a string to "
                       LUA_QL("print"));
if (i>1) fputs("\t", stdout);
fputs(s, stdout);
lua_pop(L, 1);  // pop result
}
fputs("\n", stdout);
return 0;
}
</code>```

Thanks in advance. If some more information is needed, I may provide it of course.


问:
Malware terminated in Ollydbg after a while - Why?
I try to analyze a backdoor program with ollydbg. When I go through the assembly code by clicking the "Step Over"-Button, i stop sometimes to make a notice on a paper.
Later when i want to go trough the code again, suddenly the malware terminates itself.
I dont know why but it terminates.

Could it be a anti-debugging mechanism ? Because the behaviour its not normal.
Someone has made same experiences and can help me?

edit: I have read something about a "Timing Checks" as anti-debuging techniques used by malware. So, with that technique the malware itself is able to find out if it is debugged.
Could it be something like that ?


问:
In theory, Hex-Rays CAN Decompile 16-bit code. But how?
A while back i e-mailed Hex-Rays about decompiling (obtaining pseudocode) from 16-bit functions ( 16bit code ). They replied in theory it can be done. Others have succeded,
but Hex-Rays themselves have never tried it. Does anyone have any leads?</p>


问:
Are there alternative online resources for hacking/reverse engineering at present?
Years back there were sites or online resources which had a lot of information on decompilation, software protection schemes, even reality cracking (notably by Fr/-\vi@)

Apart from software security sites (and conferences) sponsored by some
  companies, are there "alternative" (in the sense of not being sponsored
  and the content being actually valid today) online resources that have this quality?

NOTE: The question does NOT ask for specific web addresses, but for the general state of affairs on resources as mentioned above, possibly what can be like in the future also?

Thank you


问:
What is the difference between Software Architecture Recovery and Software Remodularization in the context of Reverse Engineering?
In the reverse engineering scenario, after extracting a representation of the code, it is often useful to recover/ reconstruct the architecture of the software (for eg. when reverse engineering java programs, recovering packages from classes). I am particularly concerned with the modules view of Software Architecture. To my understanding when we try to recover the modular architecture of a software, it is same as software remodularization. Is there a difference?</p>


问:
Need help figuring out compression used on a PKDPX file from a Nintendo DS game
So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky.

So far most formats were pretty easy to reverse, until I stumbled on a compressed format using a header I've never seen in any other compressed files in other games on the DS so far (I'm not all that experienced in reversing)..

Its magic number is PKDPX or 0x50, 0x4B, 0x44, 0x50, 0x58. And here's the header :

The 2 bytes right after the magic number is the file length. Its a little odd to store a file length on only 2 bytes though. Especially when every other format I've seen this far uses mainly 4 bytes integers...
And I'm wondering if it couldn't be an older compression format used in GBA games. Given that a lot of data from the previous game, for the GBA, was re-used in this one.

However I'm still at a loss as to how to deal with this format. I haven't found anything from the NDS hacking scene about those, besides people mentioning they never saw that format before, or on the contrary, people just talking about it as if it was a very obvious format.

From what I know, NDS games are known for using huffman and lz compression, or even rle, but I really doubt this is rle, given its probably not an image, and I doubt a pure data format would see much advantage from having rle compression applied to it.. But, I'm not an expert on compression, or I wouldn't posting this here XD.

One thing to note is the SIR0 magic number down there, 0x53, 0x49, 0x52, 0x30. SIR0 is a format I'm familiar with, right after the magic number there are 2 4bytes pointers that points to some file structure related data at the end of the file. Thus if those aren't too mangled, just like the SIR0 magic number, it could give a decent idea of the decompressed file size, give or take a couple hundred bytes.

However, right now there is no indication that those weren't mangled, or where the first value ends and where the other starts...

Any tidbits of info would be welcome at this point !

EDIT:
I also found out that, the DS has built-in LZ10 compression handling, however its common for devs to make their own "custom" compression and do it themselves. But, given it was made near the end of the DS's life cycle, it might just be "custom" LZ11, LZSS, or another variant..


问:
IDA Pro Patch Error
I am trying to alter a jnz in IDA but it wont allow me. It says:

```<code>Cannot Reach Destination From current location
</code>```

Any reason for this problem ?

Edit:
The Program is Trying to CreateFileA.
It Then makes a cmp between eax and 0FFFFFFFFh( i am guessing it returns -1 if file doesnt exist ).
More Information jnz     short FileExist ; Jump if Not Zero (ZF=0) Changing that to jmp short FileExist

Edit 2:
So I changed the hex code for the jmp and it works but when i do it by assembly it doesnt , still yet to find out why.

Title: IDA Pro Patch Error


问:
How to map enum types to imm values in IDA
I have added support for type info handling in my IDA processor, and now in the use_regarg_type3 event, I am mapping a parameter that I know is an enum. But, I am unsure how to set an imm operand to be enum, as you would if you pressed m key and selected the type manually.

So, my question is what function do I call to set the op to be an enum, and how do I get any needed arguments for said function from the tinfo_t I have.

Edit 1

There is an op_enum function, but it wants enum_t and from the tinfo_t via type.get_enum_base_type() I get type_t.

Edit 2

I have it working using

```<code>qstring tname;
type.get_type_name(&tname);
enum_t enumt = get_enum(tname.c_str());
op_enum(cmd.ea, x.n, enumt, 0);
</code>```

But, it feels wrong to have to go via a string, and a little fragile. So, now the questions is: is there a better/safer way to achieve this ?


问:
Serial console stops output abruptly
I've been playing with a device similar to this one: EPC3208G.
I've connected GND, TX and what i think is an RX pins via ttl adapter. Using minicom, 8N1 and baudrate of 115200, I managed to get some output after the device powers up. But, much like in the linked article on openwrt wiki, the serial console output just stops after some time. It stops on the same character every time, although not the same as in the article.

I was wondering what could be the reason for this behaviour?

Title: Serial console stops output abruptly


问:
Retrieving database credentials with access to an application that can connect and execute
I was asked to help extract information from an old Progress database. I have physical and remote access to both the database server and a workstation with the client application installed. I am able to run the client application which requests and presents information from the database. The connection appears to be via ODBC and I am able to connect to the host/service but do not have valid credentials.

I presume the credentials have to be stored somewhere on the client machine since logging in to the client application allows me to connect. I already reviewed the registry and file system for any hints of configuration and found many useful pieces of information but no credentials. My next thought was to try to trace the network communication but I expect that the communication would be encrypted so that would be a whole other issue.

How can I best go about finding what the database credentials are?

Update: I should also mention I'm not familiar with Progress databases - my experience is in Oracle, SQLServer, and MySQL. I'm just trying to help an old coworker out and assume once I can connect it's just like any other relational database.


问:
How to find a login packet structure (client-side only)?
As Google did not yield any results, I decided to ask it here.

I'd like to reverse the login sequence of a game (using gamespy).
In this login sequence, first the game uses the gamespy protocol (that can be easily resolved with Aluigi's tool).

After this it sends a network packet to what seems to be a Master Server (This packet not encrypted).
Then the game (I assume) is looking for an answer from the Master server (a challenge or some infos I don't know).
The only problem is that the game's server is not public, so I only have the game's code to work with.

Is that something achievable or should I forget about it?
I tried to mess around the typical winsocket functions (send, receive...) but apart the Gamespy protocol, I can't find any clues about the packet to the master server (except for the first packet the client sends).

If anyone could help, I'd really appreciate!

Cheers.


问:
Unpacking and disassembling mach-o binary
I am trying to reverse an OSX mach-o binary,

Disassembling gives me a bullshit, seems its encrypted with some packer.

I need to determine the encryption algorithm, and decrypt the binary.

Load Commands

Here is otool -l calculator  output,

(seems there is no any crypt information... but it's encrypted)

```
Load command 0
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __PAGEZERO
   vmaddr 0x0000000000000000
   vmsize 0x0000000100000000
  fileoff 0
 filesize 0
  maxprot 0x00000000
 initprot 0x00000000
   nsects 0
    flags 0x0
Load command 1
      cmd LC_SEGMENT_64
  cmdsize 1032
  segname __TEXT
   vmaddr 0x0000000100000000
   vmsize 0x000000000032f000
  fileoff 0
 filesize 3338240
  maxprot 0x00000007
 initprot 0x00000007
   nsects 12
    flags 0x0
Section
  sectname __text
   segname __TEXT
      addr 0x0000000100001760
      size 0x000000000028f4bc
    offset 5984
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __stubs
   segname __TEXT
      addr 0x0000000100290c1c
      size 0x0000000000000762
    offset 2690076
     align 2^1 (2)
    reloff 0
    nreloc 0
     flags 0x80000408
 reserved1 0 (index into indirect symbol table)
 reserved2 6 (size of stubs)
Section
  sectname __stub_helper
   segname __TEXT
      addr 0x0000000100291380
      size 0x0000000000000c5e
    offset 2691968
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x80000400
 reserved1 0
 reserved2 0
Section
  sectname __objc_methname
   segname __TEXT
      addr 0x0000000100291fde
      size 0x0000000000015697
    offset 2695134
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __cstring
   segname __TEXT
      addr 0x00000001002a7680
      size 0x0000000000023fdc
    offset 2782848
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __TEXT
      addr 0x00000001002cb660
      size 0x0000000000006b50
    offset 2930272
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __ustring
   segname __TEXT
      addr 0x00000001002d21b0
      size 0x00000000000007de
    offset 2957744
     align 2^1 (2)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_classname
   segname __TEXT
      addr 0x00000001002d298e
      size 0x0000000000000b42
    offset 2959758
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __objc_methtype
   segname __TEXT
      addr 0x00000001002d34d0
      size 0x00000000000069c4
    offset 2962640
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000002
 reserved1 0
 reserved2 0
Section
  sectname __gcc_except_tab
   segname __TEXT
      addr 0x00000001002d9e94
      size 0x0000000000007b48
    offset 2989716
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __unwind_info
   segname __TEXT
      addr 0x00000001002e19dc
      size 0x0000000000002814
    offset 3021276
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __eh_frame
   segname __TEXT
      addr 0x00000001002e41f0
      size 0x000000000004ae08
    offset 3031536
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Load command 2
      cmd LC_SEGMENT_64
  cmdsize 1832
  segname __DATA
   vmaddr 0x000000010032f000
   vmsize 0x0000000000160000
  fileoff 3338240
 filesize 1396736
  maxprot 0x00000007
 initprot 0x00000003
   nsects 22
    flags 0x0
Section
  sectname __program_vars
   segname __DATA
      addr 0x000000010032f000
      size 0x0000000000000028
    offset 3338240
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __nl_symbol_ptr
   segname __DATA
      addr 0x000000010032f028
      size 0x0000000000000010
    offset 3338280
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000006
 reserved1 315 (index into indirect symbol table)
 reserved2 0
Section
  sectname __got
   segname __DATA
      addr 0x000000010032f038
      size 0x0000000000000218
    offset 3338296
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000006
 reserved1 317 (index into indirect symbol table)
 reserved2 0
Section
  sectname __la_symbol_ptr
   segname __DATA
      addr 0x000000010032f250
      size 0x00000000000009d8
    offset 3338832
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000007
 reserved1 384 (index into indirect symbol table)
 reserved2 0
Section
  sectname __pointers
   segname __DATA
      addr 0x000000010032fc28
      size 0x0000000000000008
    offset 3341352
     align 2^0 (1)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __const
   segname __DATA
      addr 0x000000010032fc30
      size 0x00000000000051d0
    offset 3341360
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_classlist
   segname __DATA
      addr 0x0000000100334e00
      size 0x00000000000002f8
    offset 3362304
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_nlclslist
   segname __DATA
      addr 0x00000001003350f8
      size 0x0000000000000008
    offset 3363064
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_catlist
   segname __DATA
      addr 0x0000000100335100
      size 0x0000000000000048
    offset 3363072
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_protolist
   segname __DATA
      addr 0x0000000100335148
      size 0x0000000000000158
    offset 3363144
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_imageinfo
   segname __DATA
      addr 0x00000001003352a0
      size 0x0000000000000008
    offset 3363488
     align 2^2 (4)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_const
   segname __DATA
      addr 0x00000001003352a8
      size 0x000000000002c718
    offset 3363496
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_selrefs
   segname __DATA
      addr 0x00000001003619c0
      size 0x0000000000004c70
    offset 3545536
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000005
 reserved1 0
 reserved2 0
Section
  sectname __objc_protorefs
   segname __DATA
      addr 0x0000000100366630
      size 0x0000000000000028
    offset 3565104
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_classrefs
   segname __DATA
      addr 0x0000000100366658
      size 0x0000000000000530
    offset 3565144
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_superrefs
   segname __DATA
      addr 0x0000000100366b88
      size 0x0000000000000218
    offset 3566472
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x10000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_data
   segname __DATA
      addr 0x0000000100366da0
      size 0x0000000000001e00
    offset 3567008
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __objc_ivar
   segname __DATA
      addr 0x0000000100368ba0
      size 0x0000000000001888
    offset 3574688
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __cfstring
   segname __DATA
      addr 0x000000010036a428
      size 0x000000000000ff60
    offset 3580968
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __data
   segname __DATA
      addr 0x000000010037a390
      size 0x0000000000109c38
    offset 3646352
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000000
 reserved1 0
 reserved2 0
Section
  sectname __bss
   segname __DATA
      addr 0x0000000100483fd0
      size 0x000000000000a898
    offset 0
     align 2^4 (16)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Section
  sectname __common
   segname __DATA
      addr 0x000000010048e868
      size 0x00000000000004a8
    offset 0
     align 2^3 (8)
    reloff 0
    nreloc 0
     flags 0x00000001
 reserved1 0
 reserved2 0
Load command 3
      cmd LC_SEGMENT_64
  cmdsize 72
  segname __LINKEDIT
   vmaddr 0x000000010048f000
   vmsize 0x000000000001b000
  fileoff 4734976
 filesize 108304
  maxprot 0x00000007
 initprot 0x00000001
   nsects 0
    flags 0x0
Load command 4
            cmd LC_DYLD_INFO_ONLY
        cmdsize 48
     rebase_off 4734976
    rebase_size 10256
       bind_off 4745232
      bind_size 6696
  weak_bind_off 4751928
 weak_bind_size 40
  lazy_bind_off 4751968
 lazy_bind_size 8056
     export_off 4760024
    export_size 28752
Load command 5
     cmd LC_SYMTAB
 cmdsize 24
  symoff 4788776
   nsyms 492
  stroff 4799444
 strsize 10680
Load command 6
            cmd LC_DYSYMTAB
        cmdsize 80
      ilocalsym 0
      nlocalsym 1
     iextdefsym 1
     nextdefsym 1
      iundefsym 2
      nundefsym 490
         tocoff 0
           ntoc 0
      modtaboff 0
        nmodtab 0
   extrefsymoff 0
    nextrefsyms 0
 indirectsymoff 4796648
  nindirectsyms 699
      extreloff 0
        nextrel 0
      locreloff 0
        nlocrel 0
Load command 7
          cmd LC_LOAD_DYLINKER
      cmdsize 32
         name /usr/lib/dyld (offset 12)
Load command 8
     cmd LC_UUID
 cmdsize 24
    uuid 1AF510C1-9C81-3DCA-9ADE-2B00ED53EF5F
Load command 9
      cmd LC_VERSION_MIN_MACOSX
  cmdsize 16
  version 10.7
      sdk 10.9
Load command 10
        cmd LC_UNIXTHREAD
    cmdsize 184
     flavor x86_THREAD_STATE64
      count x86_THREAD_STATE64_COUNT
   rax  0x0000000000000000 rbx 0x0000000000000000 rcx  0x0000000000000000
   rdx  0x0000000000000000 rdi 0x0000000000000000 rsi  0x0000000000000000
   rbp  0x0000000000000000 rsp 0x0000000000000000 r8   0x0000000000000000
    r9  0x0000000000000000 r10 0x0000000000000000 r11  0x0000000000000000
   r12  0x0000000000000000 r13 0x0000000000000000 r14  0x0000000000000000
   r15  0x0000000000000000 rip 0x0000000100001760
rflags  0x0000000000000000 cs  0x0000000000000000 fs   0x0000000000000000
    gs  0x0000000000000000
Load command 11
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name @loader_path/../Frameworks/Sparkle.framework/Versions/A/Sparkle (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1.5.0
compatibility version 1.5.0
Load command 12
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name @rpath/libLLVM-3.4.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 0.0.0
compatibility version 0.0.0
Load command 13
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libexpat.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 7.2.0
compatibility version 7.0.0
Load command 14
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/Python.framework/Versions/2.7/Python (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 2.7.5
compatibility version 2.7.0
Load command 15
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libncurses.5.4.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 5.4.0
compatibility version 5.4.0
Load command 16
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libSystem.B.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1197.1.1
compatibility version 1.0.0
Load command 17
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libcrypto.0.9.8.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 50.0.0
compatibility version 0.9.8
Load command 18
          cmd LC_LOAD_DYLIB
      cmdsize 48
         name /usr/lib/libc++.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 120.0.0
compatibility version 1.0.0
Load command 19
          cmd LC_LOAD_DYLIB
      cmdsize 48
         name /usr/lib/libz.1.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1.2.5
compatibility version 1.0.0
Load command 20
          cmd LC_LOAD_DYLIB
      cmdsize 96
         name /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1.8.0
compatibility version 1.2.0
Load command 21
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 275.0.0
compatibility version 1.0.0
Load command 22
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 20.0.0
compatibility version 1.0.0
Load command 23
          cmd LC_LOAD_DYLIB
      cmdsize 96
         name /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1056.13.0
compatibility version 300.0.0
Load command 24
          cmd LC_LOAD_DYLIB
      cmdsize 56
         name /usr/lib/libobjc.A.dylib (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 228.0.0
compatibility version 1.0.0
Load command 25
          cmd LC_LOAD_DYLIB
      cmdsize 88
         name /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 1265.19.0
compatibility version 45.0.0
Load command 26
          cmd LC_LOAD_DYLIB
      cmdsize 112
         name /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 48.0.0
compatibility version 1.0.0
Load command 27
          cmd LC_LOAD_DYLIB
      cmdsize 104
         name /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 59.0.0
compatibility version 1.0.0
Load command 28
          cmd LC_LOAD_DYLIB
      cmdsize 104
         name /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (offset 24)
   time stamp 2 Thu Jan  1 04:00:02 1970
      current version 855.14.0
compatibility version 150.0.0
Load command 29
          cmd LC_RPATH
      cmdsize 48
         path @executable_path/../Frameworks (offset 12)
Load command 30
      cmd LC_DATA_IN_CODE
  cmdsize 16
  dataoff 4788776
 datasize 0
Load command 31
      cmd LC_CODE_SIGNATURE
  cmdsize 16
  dataoff 4810128
 datasize 33152
```

Diassembling

Here is otool -tvV calculator output chunk

```
0000000100001760    lahf
0000000100001761    popq    %rcx
0000000100001763    rolb    $0xe2,0xc3c024ac(%rax)
000000010000176a    jne 0x1000016ef
000000010000176c    .byte 0x06 #bad opcode
000000010000176d    sbbb    %al,0x5b(%rsi)
0000000100001770    jle 0x10000178f
0000000100001772    xorl    %edi,0x30659afe(%rsi)
0000000100001778    fldenvq 0xc9e9c0e1(%r14)
000000010000177f    xorl    %esp,%esp
0000000100001781    xchgl   %esp,%eax
0000000100001782    xchgl   %esi,%eax
0000000100001783    wait/jrcxz  0x1000017ed
0000000100001786    stosl   %eax,(%edi)
0000000100001787    xchgl   %edi,%eax
0000000100001788    jbe 0x100001727
000000010000178a    stc
000000010000178b    jns 0x100001748
000000010000178d    xorl    %ecx,0x13(%rbx,%rbx,8)
0000000100001791    popq    %rax
0000000100001793    sbbl    $0xe9507796,%eax
0000000100001798    popq    %rbx
0000000100001799    incb    (%rbx)
000000010000179b    js  0x100001778
000000010000179e    addb    %ch,%bh
00000001000017a0    testl   0xe4(%rcx),%ebp
00000001000017a3    imull   $0xfe,0xf6(%rcx),%esp
00000001000017a7    clc
00000001000017a8    imull   $0x85bb1b76,0x65(%rdx),%ebp
00000001000017af    cld
00000001000017b0    testb   0xc9(%rax),%cl
00000001000017b3    loop    0x10000175d
00000001000017b5    andb    %ah,0x4c79a1ae(%rax)
00000001000017bb    orl 0x90da6a05(%rbp,%rdx),%esi
00000001000017c2    sbbb    %ch,%ch
00000001000017c4    jrcxz   0x100001780
00000001000017c6    xorb    $0x6c,%al
00000001000017c8    jne 0x1000017b9
00000001000017ca    orb %cl,0x13(%rcx,%rsi)
00000001000017ce    ficompl 0x7d4a8745(%rbp)
00000001000017d4    .byte 0x07 #bad opcode
00000001000017d5    mov %?6,(%rax)
00000001000017d7    insl
00000001000017d8    .byte 0xd4 #bad opcode
00000001000017d9    movb    %dl,%al
00000001000017db    .byte 0xdd, 0x2f #bad opcode
00000001000017dd    lcall   $0x76f5,$0xedc7f289
00000001000017e4    subb    $0xd3,%al
00000001000017e6    mull    0xa4(%rsi)
00000001000017e9    popf
00000001000017ea    inl $0xf4,%eax
00000001000017ec    adcl    $0x413fe92b,(%rdi)
00000001000017f2    sarl    $0x12,0xf5(%rcx)
00000001000017f6    addb    %dh,0xec(%rbx,%rcx)
00000001000017fa    movabsb 0x63ea27230d2c31f2,%r8d
0000000100001804    movl    $0x12d794f0,%ecx
0000000100001809    subb    $0x20,%al
000000010000180c    shll    %esi
000000010000180e    repz/falc
0000000100001810    movb    $0xd9,%dh
0000000100001812    outl    %eax,%dx
0000000100001813    loop    0x1000017ab
0000000100001815    movl    $0x781ecd57,%edi
000000010000181b    pushq   %rdi
000000010000181c    addb    $0x7e,%ah
000000010000181f    inl $0x40,%eax
0000000100001821    adcl    $0xd480505a,%eax
0000000100001826    cmpl    $0x28a6762d,%eax
000000010000182b    ljmpl   *0x36(%rdx,%rbx)
000000010000182f    .byte 0xce #bad opcode
0000000100001830    xchgl   %edx,%eax
0000000100001831    movabsl %eax,0x6d3cb9568b4b88a5
000000010000183a    subl    0xa8d980d9(%rbx,%rdi,8),%eax
0000000100001841    popq    %rdi
0000000100001842    pushq   $0x4c
0000000100001844    subb    $0x97,%al
0000000100001846    .byte 0x43, 0x82, 0x25 #bad opcode
0000000100001849    adcb    %ah,%ah
000000010000184b    testb   0x3141d9d1(%rbx),%ah
0000000100001851    sbbl    $0xc405e320,%eax
0000000100001856    xchgl   %ecx,%eax
0000000100001857    paddb   %mm2,%mm1
000000010000185a    xorl    %edi,%edi
000000010000185c    clc
000000010000185d    jmp 0x100001885
000000010000185f    xchgl   %esi,%eax
0000000100001860    wait/jae    0x1000018a8
0000000100001863    lret
0000000100001864    jb  0x1000018ae
0000000100001866    fisubrs (%rsi)
0000000100001869    lodsb   (%esi),%al
000000010000186a    pushq   %rsp
000000010000186b    .byte 0x27 #bad opcode
000000010000186c    lret
000000010000186d    cmpl    %eax,(%rdx)
000000010000186f    orb $0xa2,%al
0000000100001871    movl    $0xb2bf2631,%ebp
0000000100001876    sti
0000000100001877    movl    0x87b0df80(%rsp,%rcx,8),%ecx
000000010000187e    hlt
000000010000187f    inb $0x42,%al
0000000100001881    andl    %esi,%ebx
0000000100001883    adcl    %eax,0xa587d6ff(%rsi)
0000000100001889    movsll  %ch,%esp
000000010000188b    clc
000000010000188c    xchgl   %ecx,%eax
000000010000188d    sbbb    $0x82,%al
000000010000188f    cwtl
0000000100001890    movl    $0x673e9a73,%ebx
0000000100001895    movb    $0x18,%bl
0000000100001899    leal    0x87(%rax),%edi
000000010000189c    .byte 0x37 #bad opcode
000000010000189d    jns 0x10000187a
000000010000189f    .byte 0x06 #bad opcode
00000001000018a0    rolb    $0x44,(%rsp,%rax,4)
00000001000018a4    movsll  %cl,%edx
00000001000018a6    fiaddl  0xf4061e00(%rip)
00000001000018ac    jo  0x100001838
00000001000018ae    stosl   %eax,(%edi)
00000001000018af    adcb    0xac1ff7e3(%rcx),%dl
00000001000018b5    testl   $0x51d2321e,%eax
00000001000018ba    movl    $0x10cb41ba,%ebp
00000001000018bf    shrb    0xa724e9d8(%rdx)
00000001000018c5    fcompl  0x31(%rbp)
00000001000018c8    xorb    (%rdi,%rdx,4),%ch
00000001000018cb    leal    %eax,%eax
00000001000018cd    addb    %dh,%ah
00000001000018cf    movsl   (%esi),(%edi)
00000001000018d0    addb    0x64cc6bfb(%rcx),%bh
00000001000018d6    testl   0xb4f698f5(%r10),%esi
00000001000018dd    mov %esp,%?6
00000001000018df    pushf
00000001000018e0    popq    %rsi
00000001000018e1    jmp 0x83f231a4
00000001000018e6    .byte 0xd3, 0xf3 #bad opcode
00000001000018e8    orl %ebp,0xf1(%rdx)
00000001000018eb    movl    $0xf2f3e10c,0x35(%rdi,%rbx)
00000001000018f3    xchgl   %esi,%eax
00000001000018f4    sbbb    %r11d,%esp
00000001000018f7    movl    $0x30412d40,%eax
00000001000018fc    insl
00000001000018ff    popq    %rsi
0000000100001900    sahf
0000000100001901    popq    %rax
0000000100001902    jrcxz   0x10000197c
0000000100001904    andl    0x758d6d0d(%rsi),%ecx
000000010000190a    movb    $0x89,%ch
000000010000190c    fistpq  0xa5(%rsi)
000000010000190f    .byte 0x62 #bad opcode
0000000100001910    sahf
0000000100001911    loop    0x10000193b
0000000100001913    jg  0x100001908
0000000100001915    cmpsl   (%esi),(%edi)
0000000100001916    movsl   (%esi),(%edi)
0000000100001917    iret
0000000100001918    scasl   %eax,(%edi)
0000000100001919    .byte 0x0e #bad opcode
000000010000191a    xorb    %cl,(%rcx)
000000010000191c    stosb   %al,(%edi)
000000010000191d    andb    $0x9b,%al
000000010000191f    cmpl    $0x72a850c7,0xbdced867(%rax,2)
000000010000192a    jae 0x1000018c0
000000010000192c    .byte 0xd3, 0xf6 #bad opcode
000000010000192e    lcall   $0x608c,$0x851d69e3
0000000100001935    .byte 0x62 #bad opcode
0000000100001936    xchgl   %ecx,%eax
0000000100001937    cmpb    %ah,%cs:%cl
000000010000193a    movsb   (%esi),(%edi)
000000010000193b    subb    $0xc7,%al
000000010000193d    outl    %eax,$0x05
000000010000193f    je  0x100001999
0000000100001941    inl $%cs:0x7d,%eax
0000000100001944    sbbl    %ebp,0x7c5ec982(%rdx)
000000010000194a    movsl   (%esi),(%edi)
000000010000194b    xchgl   %ecx,%eax
000000010000194c    movl    $0x1393211e,%ecx
0000000100001951    .byte 0x27 #bad opcode
0000000100001952    cmpsl   (%esi),(%edi)
0000000100001953    xchgl   %esp,%eax
0000000100001954    .byte 0x1f #bad opcode
0000000100001955    addl    $0x6ed2f22b,%eax
000000010000195a    insb
000000010000195b    .byte 0x67, 0xd5 #bad opcode
000000010000195d    cmpl    (%rdi),%edi
000000010000195f    popq    %rbp
0000000100001960    ret
0000000100001961    addl    $0x961d3d82,%eax
0000000100001966    ret
0000000100001967    jle 0x100001938
0000000100001969    .byte 0x1e #bad opcode
000000010000196a    loop    0x100001936
000000010000196c    movsl   (%esi),(%edi)
000000010000196d    andb    $0xfc,(%rax)
0000000100001970    xchgl   %ecx,%eax
0000000100001971    pushf
0000000100001972    movb    $0xb0,%ah
0000000100001974    popq    %rbp
0000000100001975    lahf
0000000100001976    sbbl    $0x9605ee9d,%eax
000000010000197b    incb    %bh
000000010000197d    cmpl    (%rcx),%ecx
000000010000197f    testb   0x90(%rsp,%rsi,8),%ecx
0000000100001985    repz/int    $0x3
0000000100001987    .byte 0x4c, 0x2f #bad opcode
0000000100001989    ljmp    $0x072a,$0x233e8063
0000000100001990    leave
0000000100001991    orb %al,(%rdx)
0000000100001993    andl    (%rcx),%ebp
0000000100001995    ljmpl   *(%rbx)
0000000100001997    shlb    0x26(%rdi)
000000010000199a    movl    $0x592a9d36,%esp
```

LLVM disassembler fails with output

```
(__TEXT,__text) section
Segmentation fault: 11
```

Injecting via cycript

I have tried cycript to dump image and patch it back via dd tool, but seems this trick doesn't work and binary gets corrupted.

Debuggers

gdb/lldb can't attach/start the process, as it's uses pt_deny_atach/sysctl/kauth anti-debugging techniques.

I have also tried to patch osx kernel (as the assembly is not available and I can't nop out that calls) - to ignore anti-debugging calls, but after this process doesn't event start, just hangs up (But other application like Github, iTunes are starting without any problem, seems it has anti-anti-anti debugging protection :)).

Can you please advise some extra technique (or suggestion what I can try) to get the plain assembly?


问:
Detecting and/or converting binary endianness (PPE [CELL] to Intel)
I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then please do.

That said, my issue right now is figuring out a way to convert a binary file compiled for the CELL architecture to Intel. These are binary files rather than executables. I've thoroughly searched the net looking for answers, however all of them seem to refer to PowerPC instead of PPE.

In a perfect world, the preferred solution would entail simply dragging/dropping the big-endian files onto a conversion executable. Since this is not a perfect world, I wont look forward to such a thing.

NOTE 1: The binary files in question are 64 bit, judging from the specs on the CELL architecture.

NOTE 2: Fortunately, I have versions of these binaries in both big and little-endian. Using UltraCompare (albeit taking an ungodly amount of time to compare,) I can verify byte-swapping in the headers when comparing against it's little-endian counterparts.

"If you have both versions, then why do you need to convert them?"

There are some binaries not available in little-endian and those are the ones I need.