问:
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:

```<code>public static int CalculateCoefficients(
          int[] coefficients,
          out int negCoeffs,
          int numPoints,
          int selCoeffs,
          int CalType,
          double[] bridgeRaw,
          double[] bridgeDesired,
          double[] tempRaw,
          double[] tempDesired)
        {
            CalData data = new CalData();
            Vector<CalPoint> calPoints = (Vector<CalPoint>)data.calPoints;
            LMCallbacks callbacks = new LMCallbacks();
            lm_control_type control = new lm_control_type();
            int index1 = 0;
            negCoeffs = 0;
            if (0 < numPoints)
            {
                do
                {
                    bridgeRaw[index1] = (double)Program.TwosComplementToDecimal((int)bridgeRaw[index1]);
                    tempRaw[index1] = (double)Program.TwosComplementToDecimal((int)tempRaw[index1]);
                    ++index1;
                }
                while (index1 < numPoints);
            }
            int index2 = 0;
            if (0 < numPoints)
            {
                do
                {
                    if (tempRaw != null && tempDesired != null)
                    {
                        CalPoint calPoint;
                        calPoint.rawB = bridgeRaw[index2];
                        calPoint.bridge = bridgeDesired[index2];
                        calPoint.temp = tempDesired[index2];
                        calPoint.rawT = tempRaw[index2];
                        calPoints.Add(calPoint);
                    }
                    else
                    {
                        CalPoint calPoint;
                        calPoint.rawB = bridgeRaw[index2];
                        calPoint.bridge = bridgeDesired[index2];
                        calPoint.temp = 2000.0;
                        calPoint.rawT = 2000.0;
                        calPoints.Add(calPoint);
                    }
                    ++index2;
                }
                while (index2 < numPoints);
            }
            data.CalType = CalType;
            data.CO_CAL = selCoeffs;
            Map<double, double> map = new Map<double, double>();
            List<CalPoint>.Enumerator enumerator1 = calPoints.GetEnumerator();
            if (enumerator1.MoveNext())
            {
                do
                {
                    CalPoint current = enumerator1.Current;
                    double key = Math.Truncate(current.temp * 10.0) / 10.0;
                    Dictionary<double, double>.Enumerator enumerator2 = map.GetEnumerator();
                    if (enumerator2.MoveNext())
                    {
                        while (Math.Abs(Map<double, double>.Key((ValueType)enumerator2.Current) - key) >= 0.1)
                        {
                            if (!enumerator2.MoveNext())
                                goto label_11;
                        }
                        goto label_12;
                    }
                label_11:
                    map[key] = current.rawT;
                label_12:;
                }
                while (enumerator1.MoveNext());
            }
            if (map.Size < 3)
                data.CO_CAL &= -561;
            if (map.Size < 2)
                data.CO_CAL &= -269;
            double[] par = new double[10];
            par[0] = 0.0;
            data.cos[0] = 0.0;
            data.cos[1] = 65536.0;
            data.cos[2] = 0.0;
            data.cos[3] = 0.0;
            data.cos[4] = 0.0;
            data.cos[5] = 0.0;
            data.cos[6] = 0.0;
            data.cos[7] = 0.0;
            data.cos[8] = 32768.0;
            data.cos[9] = 0.0;
            data.zero_point = 8388608.0;
            int[] numArray = new int[4] { 2, 4, 6, 7 };
            int num = 0;
            do
            {
                data.CalType = CalType;
                int index3 = 0;
                do
                {
                    int n_par = 0;
                    int index4 = 0;
                    if (0 < numArray[index3])
                    {
                        do
                        {
                            if ((data.CO_CAL >> index4 & 1) != 0)
                            {
                                par[n_par] = data.cos[index4];
                                ++n_par;
                            }
                            else
                                data.cos[index4] = (double)coefficients[index4];
                            ++index4;
                        }
                        while (index4 < numArray[index3]);
                    }
                    data.calcTo = numArray[index3];
                    control.Initialize();
                    //< Module >.lm_minimize(((Vector<CalPoint>)calPoints).Size, n_par, par, (ILMCallbacks)callbacks, (lm_data_type)data, control);
                    int index5 = 0;
                    int index6 = 0;
                    if (0 < numArray[index3])
                    {
                        do
                        {
                            if ((data.CO_CAL >> index6 & 1) != 0)
                            {
                                data.cos[index6] = par[index5];
                                ++index5;
                            }
                            ++index6;
                        }
                        while (index6 < numArray[index3]);
                    }
                    ++index3;
                }
                while (index3 < 4);
                data.CalType = 2;
                int n_par1 = 0;
                int index7 = 7;
                do
                {
                    if ((data.CO_CAL >> index7 & 1) != 0)
                    {
                        par[n_par1] = data.cos[index7];
                        ++n_par1;
                    }
                    else
                        data.cos[index7] = (double)coefficients[index7];
                    ++index7;
                }
                while (index7 <= 9);
                control.Initialize();
                //< Module >.lm_minimize(((Vector<CalPoint>)calPoints).Size, n_par1, par, (ILMCallbacks)callbacks, (lm_data_type)data, control);
                int index8 = 0;
                int index9 = 7;
                do
                {
                    if ((data.CO_CAL >> index9 & 1) != 0)
                    {
                        data.cos[index9] = par[index8];
                        ++index8;
                    }
                    ++index9;
                }
                while (index9 <= 9);
                int index10 = 0;
                do
                {
                    coefficients[index10] = (int)data.cos[index10];
                    ++index10;
                }
                while (index10 < 10);
                int coefficient = coefficients[6];
                if (coefficient < 0)
                {
                    if (coefficient < -8388607)
                    {
                        coefficients[6] = -8388607;
                        data.CO_CAL &= -65;
                        data.cos[6] = 0.0;
                    }
                    else
                        break;
                }
                else if (coefficient > 536870911)
                {
                    coefficients[6] = 33554431;
                    data.CO_CAL &= -65;
                }
                else
                    break;
                ++num;
            }
            while (num < 2);
            if (coefficients[0] < 0)
                negCoeffs |= 64;
            if (coefficients[7] < 0)
                negCoeffs |= 128;
            if (coefficients[9] < 0)
                negCoeffs |= 8;
            if (coefficients[4] < 0)
                negCoeffs |= 2;
            if (coefficients[5] < 0)
                negCoeffs |= 4;
            if (coefficients[3] < 0)
                negCoeffs |= 16;
            if (coefficients[2] < 0)
                negCoeffs |= 32;
            return 0;

        }
</code>```

But I have problems with a function and a class that is:

```<code>< Module >.lm_minimize(((Vector<CalPoint>)calPoints).Size, n_par1, par, (ILMCallbacks)callbacks, (lm_data_type)data, control);

</code>```

I can't find the class  and I don't know what it refers to... it would be very useful if you can help me find a solution...

Thanks

Title: Decoding CalibrationL6.dll


问:
Java Byte Code Debugger
I'm trying to reverse a highly obfuscated program written in java.  None of the deobfuscators seem to work so I have been poking at it in eclipse.  I can attach to a running process and have figured some of the code out but it appears the part im after happens in a synthetic function so I want to be able to step line by line through the byte code and see whats going on.  None of the tools I have found so far seem to have this ability.  I appreciate any suggestions.

What I've tried
1.) Eclipse with various plugins (can kind of decompile code but without line numbers its little help debugging)
2.) Recaf(useful for static analysis but have not found a way to use it in a debug fashion)
3.) Several deobfuscators with no luck

ContentLicense: CC BY-SA 4.0

Title: Java Byte Code Debugger


问:
Problems trying to debug a running application on my PC
I've been reverse engineering an application out of necessity, meaning I'm a beginner on the subject. After days analyzing decompiled code from ILSpy I noticed that debugging the application would really help me to figure out better what parts of the code I should worry about, considering the decompiled version of the code is way too dense to work with. So in the last couple of days, I've been trying to run the target application and debug it on my own with dotpeek and Visual Studio. I found this tutorial as well as this one to help me out with the task, but I'm still failing for some reason.

The thing is, I set up everything just fine, but after I set the breakpoint on the target method and used the application till reached that method, nothing happens on Visual Studio, not even errors, which left me not knowing where to look for problems.

My first guess is that I'm not describing the method correctly for the "Function breakpoint..." option, so I tried all variations I could think of and the same results happened (nothing at all).

The method is inside the application's .exe (around 150mb - plus around 30 dlls). It also requires you to have a FIFA game (21/22/23) installed on your PC to be used, but it isn't a commercial tool as opposed to the games. It can be downloaded here(the editor one) just in case anyone is able to test it. While the target method is located at:

"Fifa_Tool.ModWriter.WriteProject"

Which is triggered after you go to "File>Export to mod>Save (at tool's window)>Save (at Windows' window)".

Tried to provide everything I got in a concise way, does anyone have any insights to help me out?


问:
How do I reverse engineer a file uploading api?
The API is pretty old and is written in C#, I tried debugging the API calls with mitmproxy.

This is the successful API call (manually uploading file)

but when I tried curling it, it gave me this error which is apparently a common error from the C# language (that's how I'm able to know that the API is written in C#) "Sequence contains no element" im not sure but i think it's got something to do with SQL

I also tried insomnia and postman but it came to the same ending

so what is it that I can do to reverse engineer this file uploading API? It'd be perfect if you could briefly explain it so that I may understand and do better for the next API reverse engineering that I might do THANK YOU!!!!

sources: https://products.aspose.app/video/compress

please ask for more sources, I don't know what screenshot is necessary for me to put here.


Title: What format could this image mask be?

Body:
So I'm looking at these sprite files from a type of virtual world format that's no longer around. They appear to be JPEGs with some custom markers, one of which appears to be an alpha mask. Here's some examples with the first 30 bytes from the chunk in each file, immediately following "CWMAHUF1"

File
Width
Height
Length
First Four Bytes
Divided by Height
Divided by 4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

afrowomandoc.sprite
277
866
6148
31176
36
9
c8
79
0
0
ff
b0
0
0
0
17
c6
0
0
0
5
e0
a1
e0
6
80
0
0
6f
74
1c
1
60
0
0
27

asiandoc.sprite
268
906
6497
32616
36
9
68
7f
0
0
ff
b0
0
0
0
2f
c
3
80
0
2
e0
70
70
2
e4
0
0
b
f8
98
1
3e
0
0
12

balddoc.sprite
301
855
7008
34200
40
10
98
85
0
0
ff
b0
0
a
3
0
a1
e0
0
2f
c4
60
0
2
e4
c0
0
4f
80
0
19
c0
ab
23
e0
0

blondedoc.sprite
215
865
5118
24220
28
7
9c
5e
0
0
ff
b0
0
0
17
f6
0
0
0
0
6e
0
17
b7
f0
1
70
4
1
d0
fc
f9
9f
80
8
c0

crowd02.sprite
247
274
2509
8768
32
8
40
22
0
0
ff
b0
0
0
80
30
30
5f
ec
0
0
6
f8
b0
10
c0
0
0
bf
f
b7
f0
9c
0
0
a

desk.sprite
393
482
5431
25064
52
13
e8
61
0
0
ff
b0
0
0
0
0
0
28
c
3
80
0
1
3a
0
0
1
94
0
0
c
fe
aa
aa
d0
70

desknocomputer.sprite
393
241
2508
12532
52
13
f4
30
0
0
ff
b0
0
0
0
0
0
28
c
3
80
0
0
0
0
0
34
c0
0
0
0
0
0
17
c0
0

dome.sprite
256
128
762
4096
32
8
0
10
0
0
ff
b0
1
7c
60
1e
8f
80
0
0
f
e1
27
e8
78
0
0
3
3f
df
55
97
f0
0
0
c

entrance.sprite
600
279
3937
21204
76
19
d4
52
0
0
ff
b0
0
0
0
0
0
0
0
0
8
0
0
0
0
0
0
0
0
0
0
50
0
0
0
0

flags.sprite
245
28
194
896
32
8
80
3
0
0
ff
87
f1
0
50
0
99
e5
f8
90
4
0
8
0
14
42
2b
d6
f
0
34
e8
1
dc
9
40

Fountain.sprite
460
1584
28016
95040
60
15
40
73
1
0
ff
b0
0
0
0
0
0
0
2f
c
3
80
0
0
0
0
0
0
34
c0
0
0
0
0
0
0

indoor_stadiumwl01.sprite
256
500
2007
16000
32
8
80
3e
0
0
80
30
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

indoor_stadiumwl02.sprite
256
500
2007
16000
32
8
80
3e
0
0
80
30
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

leftwingroof.sprite
256
116
806
3712
32
8
80
e
0
0
ff
b0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

lights.sprite
165
500
2858
12000
24
6
e0
2e
0
0
ff
b0
0
5
f1
80
78
0
0
11
f0
3
3f
34
4
1
fe
0
67
82
c9
f8
6
54
0
ee

phone.sprite
192
358
1997
8592
24
6
90
21
0
0
ff
b0
0
1
7f
60
e0
0
0
5f
ca
6
0
0
4
fc
48
8
0
0
1d
e0
0
0
7f
85

PLANT.sprite
676
686
13127
60368
88
22
d0
eb
0
0
ff
b0
0
0
0
17
f0
0
0
0
0
0
3
f0
a0
13
40
0
0
0
a
0
0
0
0
0

powercells.sprite
457
798
8241
47880
60
15
8
bb
0
0
ff
b0
0
2f
8c
3
d3
f0
0
0
0
0
f0
12
0
0
3e
b4
1c
0
0
0
0
6a
80
0

ro.sprite
197
668
4724
18704
28
7
10
49
0
0
ff
b0
0
0
5f
18
7
80
0
0
11
f0
0
c1
fd
e0
b2
fe
0
cf
80
f
f0
e8
7d
40

rocks.sprite
400
200
1992
10400
52
13
a0
28
0
0
ff
b0
0
0
0
0
0
10
5
0
0
0
0
0
0
38
0
0
0
0
0
0
a0
0
0
0

sleep.sprite
600
2888
42275
219488
76
19
60
59
3
0
ff
b0
0
0
b0
40
0
0
0
0
0
6
0
0
0
5
fc
a0
20
0
0
0
0
0
2
0

TORCH.sprite
300
2600
23504
104000
40
10
40
96
1
0
ff
b0
0
0
0
2
f0
c0
38
0
0
0
0
34
c0
0
0
0
1
7c
0
0
0
0
1a
80

treee.sprite
400
437
5290
22724
52
13
c4
58
0
0
ff
b0
0
0
0
0
0
10
5
0
0
0
0
0
0
38
0
0
0
0
0
0
a0
0
0
0

weldbotlit.sprite
352
607
5979
26708
44
11
54
68
0
0
ff
b0
0
5
c1
81
80
0
0
0
0
1b
80
0
0
0
0
1c
3
71
fc
0
0
0
0
2

All I've been able to determine is that the first four bytes are a word that seems to have nothing to do with the actual length of the chunk. However, they are all divisible by the image's height and further divisible by 4.

indoor_stadiumwl01.sprite and indoor_stadiumwl02.sprite seem to be (almost) all 0s, and the image themselves look to be almost completely opaque

I'm not entirely sure what the data is supposed to look like decoded, but the mask appears to be binary


问:
Understanding pointer indirection for accessing static variables in Cortex M0 firmware
I'm reverse engineering some firmware from a device running an ARM Cortex M0 (specifically, Nordic nrf51802). For reference, the pertinent part of the memory map looks like this:

I'm trying to add proper data types and names to global variables, but I don't quite understand what is going on.

Consider this simple bit of C code:

```<code>static volatile u32_t wait_for_ack_timeout_us;

static void update_radio_bitrate(void)
{
    NRF_RADIO->MODE = esb_cfg.bitrate << RADIO_MODE_MODE_Pos;

    switch (esb_cfg.bitrate) {
    case NRF_ESB_BITRATE_2MBPS:
        wait_for_ack_timeout_us = RX_ACK_TIMEOUT_US_2MBPS;
        break;

    case NRF_ESB_BITRATE_1MBPS:
        wait_for_ack_timeout_us = RX_ACK_TIMEOUT_US_1MBPS;
        break;

    case NRF_ESB_BITRATE_250KBPS:
        wait_for_ack_timeout_us = RX_ACK_TIMEOUT_US_250KBPS;
        break;

    case NRF_ESB_BITRATE_1MBPS_BLE:
        wait_for_ack_timeout_us = RX_ACK_TIMEOUT_US_1MBPS_BLE;
        break;

    default:
        /* Should not be reached */
    }
}
</code>```

Ghidra decompiles this as:

Double-clicking PTR_DAT_00003d24 reveals:

Double-clicking DAT_2000003c here reveals where wait_for_ack_timeout_us actually lives in memory:

I changed the data type to uint32_t and added the variable name, but the decompiled code still shows the weird pointer dereference.

My questions are:

Why is there the added level of pointer indirection to access the static variable? Is this just how statics are implemented in ARM?

Ultimately what I'd like to get is decompiler output that looks like this:

```<code>void update_radio_bitrate(void)

{
  char cVar1;

  *(uint *)(PTR_NRF_RADIO_Type_40001000.RESERVED6[59]_00003d20 + 0x10) =
       (uint)(byte)PTR_nrf_esb_config_00003d1c[8];
  cVar1 = PTR_nrf_esb_config_00003d1c[8];
  if (cVar1 == '\0') {
    wait_for_ack_timeout_us = 0x40;
  }
  else if (cVar1 == '\x01') {
    wait_for_ack_timeout_us = 0x30;
  }
  else if (cVar1 == '\x02') {
    wait_for_ack_timeout_us = 0xfa;
  }
  else if (cVar1 == '\x03') {
    wait_for_ack_timeout_us = 0x40;
  }
  return;
}

</code>```

Is this possible?


问:
Why the global string varable exploitation using angr doesn't work?
To learn the angr module, I have made a simple C code like follows.

test.c

```<code>#include <stdio.h>
#include <string.h>

char input[6];

int main(void)
{
    scanf("%s", input);

    if(strcmp(input, "hello")==0)
    {
        puts("Correct!");
    }
    else
    {
        puts("Incorrect!");
    }
}
</code>```

I complied this using gcc. and I disassemble it using gdb.

test disassemble code

```<code>Dump of assembler code for function main:
   0x08049176 <+0>:     push   ebp
   0x08049177 <+1>:     mov    ebp,esp
   0x08049179 <+3>:     push   0x804c01c
   0x0804917e <+8>:     push   0x804a008
   0x08049183 <+13>:    call   0x8049060 <__isoc99_scanf@plt>
   0x08049188 <+18>:    add    esp,0x8
   0x0804918b <+21>:    push   0x804a00b
   0x08049190 <+26>:    push   0x804c01c
   0x08049195 <+31>:    call   0x8049030 <strcmp@plt>
   0x0804919a <+36>:    add    esp,0x8
   0x0804919d <+39>:    test   eax,eax
   0x0804919f <+41>:    jne    0x80491b0 <main+58>
   0x080491a1 <+43>:    push   0x804a011
   0x080491a6 <+48>:    call   0x8049050 <puts@plt>
   0x080491ab <+53>:    add    esp,0x4
   0x080491ae <+56>:    jmp    0x80491bd <main+71>
   0x080491b0 <+58>:    push   0x804a01a
   0x080491b5 <+63>:    call   0x8049050 <puts@plt>
   0x080491ba <+68>:    add    esp,0x4
   0x080491bd <+71>:    mov    eax,0x0
   0x080491c2 <+76>:    leave
   0x080491c3 <+77>:    ret
End of assembler dump.
</code>```

and I make the exploit code using angr.
test.py

```<code>mport angr
import claripy

p=angr.Project('./test', auto_load_libs=True)

initial_state=p.factory.blank_state(addr=0x8049176)

password=claripy.BVS('password', 8*5)

password_addr=0x804c01c
initial_state.memory.store(password_addr, password)

sm=p.factory.simulation_manager(initial_state)

sm.explore(find=0x8049196, avoid=0x80491b5)

print(sm.found)

if sm.found:
    sol_state=sm.found[0]
    print(sol_state.solver.eval(password, cast_to=bytes))
</code>```

When I excute this exploit code, it doesn't work!
output:

```<code>WARNING  | 2023-02-20 04:18:53,914 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing register with an unspecified value. This could indicate unwanted behavior.
WARNING  | 2023-02-20 04:18:53,914 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING  | 2023-02-20 04:18:53,914 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING  | 2023-02-20 04:18:53,915 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING  | 2023-02-20 04:18:53,915 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING  | 2023-02-20 04:18:53,915 | angr.storage.memory_mixins.default_filler_mixin | Filling register ebp with 4 unconstrained bytes referenced from 0x8049176 (main+0x0 in test (0x8049176))
WARNING  | 2023-02-20 04:18:54,608 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7fff0000 with 4 unconstrained bytes referenced from 0x80491c3 (main+0x4d in test (0x80491c3))
WARNING  | 2023-02-20 04:18:55,018 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV32 mem_7fff0000_16_32{UNINITIALIZED}>
[]
</code>```

What happend? I have searched on the Internet, I can't find the answer.
Here is a similar question, but it's not clear.


问:
I need help to read this code of a .lua file
i want to read the next code, is library of commands in a .lua for a program called xenobot
the code is rly big
https://pastebin.pl/view/1539062b</p>


问:
How to find passphrase for Lua maked in cocos game?
I tried to decompile and find main.lua in file (link below) with IDA Pro but it wasn't helpful, because every lua file has it own signature and there is no key near string main.lua.
I also tried to find strings such xxtea as I found by search, but there is no string in the file.

Screenshot:

Link to download file(google drive)

But I can't understand how to chain this data to encryption

I would be grateful for any advice and further ideas.


问:
Cannot load libvulkan.so on Linux chroot running on Android while normal Android apps can load it

Environment

First I will give a quick summary of my environment

Device: Samsung Galaxy M20 (m20lte)

SoC: Exynos 7904 (with Mali-G71 GPU)

OS: Android 10 (Stock ROM with root using Magisk)

Kernel: 4.4.177

SELinux is disabled (set to permissive mode)

Vulkan API version: 1.1.108

Chroot environment: Debian 11 (arm64) running on Linux Deploy, with full root access. Directories like /dev, /proc, /data, /system, /sdcard are mounted into the chroot.

Vulkan availability

I know this device support Vulkan API (Vulkan loader avaliable at /system/lib64/libvulkan.so).

Normal Android apps can load and use Vulkan APIs without any problems. For example:

Vulkan Caps Viewer can display Vulkan information on this device

GeekBench 5, Compute section has an option to compute with GPU using Vulkan API, and it works well

Problem

I cannot load libvulkan.so from /system/lib64/libvulkan.so by running program in the chroot.

For example, I created a simple c source (named dlopen.c):

```<code>#include <stdio.h>
#include <dlfcn.h>

int main() {
        void *handle = dlopen("libvulkan.so", RTLD_LAZY);
        if (!handle) {
                printf("Cannot load libvulkan.so\n");
        } else {
                printf("Loaded libvulkan.so\n");
        }

        return 0;
}
</code>```

Compile it using gcc: gcc dlopen.c -ldl -o dlopentest

Setup the environment variable LD_LIBRARY_PATH=/system/lib64/ or symlink /system/lib64/libvulkan.so to (folder in chroot) /lib/aarch64-linux-gnu/libvulkan.so and /lib/aarch64-linux-gnu/libvulkan.so.1

Finally run it using ./dlopentest, the program always print Cannot load libvulkan.so

Using strace, but nothing weird found (log link)

I'm not sure about /lib/aarch64-linux-gnu/libc.so, since instead of being a symlink to libc.so.6 or a real .so file, it's some kind of ld script. But replacing it with a symlink to libc.so.6 makes no change.

vulkaninfo also reports an error:

```<code>ERROR at /build/vulkan-tools-3Ouhix/vulkan-tools-1.2.162.0+dfsg1/vulkaninfo/vulkaninfo.h:628: Failed to initialize: Vulkan loader is not installed, not found, or failed to load.
</code>```

strace result is pretty much the same as my dlopentest, so I won't include it here.

EDIT 1:

(actually I don't know what section to put this, so I put it here)

Running file on /system/lib64/libvulkan.so:

```<code>/system/lib64/libvulkan.so: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[md5/uuid]=e749d3c10d92fcef9b84402783d311f8, stripped
</code>```

It's dynamically linked, so I run ldd on it and notice the following line:

```<code>/system/lib64/libvulkan.so: /lib/aarch64-linux-gnu/libc.so: version `LIBC' not found (required by /system/lib64/libvulkan.so)
/system/lib64/libvulkan.so: /lib/aarch64-linux-gnu/libdl.so: version `LIBC' not found (required by /system/lib64/libvulkan.so)
</code>```

And other lines from .so libraries in /system/lib64 claimed the same thing.

So I check the /system/lib64/libc.so, and found that it's a symbolic link to /apex/com.android.runtime/lib64/bionic/libc.so.

So I mounted /apex/com.android.runtime to chroot.

After doing so, ldd found no more problem (log link)

But, when I run the program:

```<code>root@localhost:~# ./dlopentest
Trace/breakpoint trap
</code>```

Running strace (log link)

Using gdb, I found that it was a trap signal from /system/lib64/ld-android.so

```<code>Program received signal SIGTRAP, Trace/breakpoint trap.
0x0000007fb7fef000 in rtld_db_dlactivity () from /system/lib64/ld-android.so
</code>```

When I check that file:

```<code>root@localhost:~# file /system/lib64/ld-android.so
/system/lib64/ld-android.so: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[md5/uuid]=62f4de8cdef6f71d65c403ac59427c51, stripped
root@localhost:~# ldd /system/lib64/ld-android.so
        statically linked
</code>```

Question

Why it does not work (why I cannot load libvulkan.so properly)?

How to fix it?

Real purpose

I know this section might not related to the question, but I still want to include it, to avoid possible XY problem.

I want to run War Thunder (a game, and it supports x86_64 Linux). I run it on box64 and it runs until report cannot initialize Vulkan. FYI, Vulkan is the only supported render backend for the game on Linux, so I can't use OpenGL or something.

The game require the real libc (not Android one), so I can't run it on proot, and distro-proof on Termux is too complicated compared to Linux Deploy.

Finally, thank you for reading this
I just want to run War Thunder :)


问:
Flashed "compatible" firmware onto two generic Allwinner A50 tablets
I'm already at least 3 days on this and can't find a way out. I'm still unsure if it fits here, but here we go!

I have 3 A50 Allwinner tablets (HOW HT-705XT) that I wanted to root. Since the only way was patching a boot.img obtained from the web, I found one that someone suggested that was apparently "compatible" with this tablet, with minor issues, so I did.

I flashed the firmware using PhoenixSuit with the checkbox "multiple" partitions disabled and it in fact flashed the whole system. It booted with another logo, into another Android version and even Magisk was patched, meaning that the bootloader was flashed too.

On the second tablet I wanted to preserve the original ROM, so I did all of it again but selected "multiple partitions" and checked only "BOOTLOADER" and "BOOT".

To my surprise, the tablet restarted with the screen completely gray-ish, as if the resolution or sync were mismatched.

I flashed the firmware again using the default option, which doesn't use the "multiple partitions" checkmark, like I did on tablet 1, but it restarted with a gray screen again. At this point I knew I messed up.

Strange thing is: The tablet with the bricked screen is still starting up. It reacts to button presses and luminosity changes. It is probably booted up, I just can't see it.

At this point I have:

A working, rooted tablet

A screen with a bricked screen

A new, unmodified, tablet

I can't simply restore the original firmware, since it is not available on the internet. The only one available is this "compatible" firmware. Both are for the A50 chip, and one worked, so...

I tried to backup all partitions using the rooted tablet using dd if=/dev/block/by-name/boot of=/sdcard/boot.img and all others, shown below:

```<code>ML-SO06-M7sLite:/dev/block/by-name # ls
UDISK bootloader dto   env media_data misc    recovery vendor
boot  cache      empty frp metadata   private system
</code>```

I repacked boot and bootloader into the extracted firmware on my PC and repacked it using imgRePacker. After that I tried to flash it, but it still didn't fix the screen.

At this point I was convinced that the file sys_config.fex or config.fex contain an invalid lcd_driver entry and therefore it doesn't work, shown below:

```<code>[lcd0]
lcd_used            = 1

lcd_driver_name     = "fx070"
lcd_if              = 0
lcd_x               = 1024
lcd_y               = 600
</code>```

The problem is that I cannot find those files, for comparison, on the running system. Furthermore, the config.fex appears to be a binary representation of the first file, which (afaik) must also be changed, and I wouldn't even know how. I tried reading /dev/block and grepping "lcd", but at certain blocks the  device simply rebooted.

I shut the device down and tried to enter FEL mode and built the sunxi-tools binaries to attempt and read the whole NAND, which also didn't succeed. FEL gives read errors at certain adressess and I don't know which ones to skip, since I don't have a partition reference. I tried to enter FES mode but also failed due to missing pointers.

The goal here is just to trying to fix the screen, and, at this point any clue to what is going wrong is greatly appreciated. All info above is greatly shortened to avoid a page-long question, but I think most of the important informations were given. If something is missing, just let me know.

And yes, at this point all my links on Google are already purple (and my head, too)


问:
Reverse Engineering XORed string
I am trying to reverse engineer some data received over serial port.

The hardware sending the data consists of a gps, compass and a power monitoring unit (which sends information about the battery).

I received three types of messages of varying length. These are given below:

```<code>55 BB 55 BB 33 00 E7 29 B4 BD D7 82 61 39 23 C4 04 74 04 38 6B 02 12 8E 8D F3 E3 D7 4B 59 91 9C 01 98 0F C5 43 95 D2 03 D2 CC 4B B1 9A A2 54 8C 99 4A 00 DD 02 AB CD

55 BB 55 BB 38 00 85 1F EA BD DE D0 87 7F 14 9A 5C 46 78 7A D1 E7 29 56 2E 7D F9 A9 FF DE E4 6C F2 F5 26 0D EF CD 6A ED B0 28 1D 9E DB 9D 8E BA 5F 58 26 3F B3 DD 03 00 A6 73 AB CD

55 BB 55 BB 24 00 F3 8B FD F6 BF D0 B0 06 05 8D 7C 40 19 CF 29 72 0E 88 B5 0F 4E 56 67 1C 56 AE F8 A3 01 00 DE 05 AB CD
</code>```

What i have understood so far is:

Each message starts with 55 BB 55 BB which i assume is the Message Header.

The field (byte 5) is the length of the message from 5th till the last byte.

It is then followed by 00 which might mark the start of payload.

The last two bytes are always AB CD which might be a trailing header.

The fourth last and third last bytes might be checksum for the message.

The fifth last byte is always zero which might indicate the end of payload.

The checksum is obtained by using The 8-bit Fletcher Checksum Algorithm described in the TCP alternate checksum options document (rfc1145).

The data in the payload doesn't make sense. I have to figure out the order as well any encryption that might be occurring. It seems as they are Xoring the data and the Xor mask changes everytime. But they are sending the Xor mask in the data. I tried Xoring the whole string with each byte but couldn't obtain something similar to known values for Lat/Long.

Can somebody provide some guidance on how should i proceed?

Some work has been done here before. Rcgroups Post#15

Here is a rft file containing the rest of the data.
4shared Link RTF File

ContentLicense: CC BY-SA 3.0

Title: Reverse Engineering XORed string


问:
Calculate Function Call To Imported Function In Dumpbin Output
What is the easiest way to determine the function called in dumpbin output. No PDBs available.

The disassembly:

```<code>  004028E2: 8B 1D 70 42 40 00  mov         ebx,dword ptr ds:[00404270h]
  004028E8: 55                 push        ebp
  004028E9: 56                 push        esi
  004028EA: 57                 push        edi
  004028EB: 8B 7C 24 18        mov         edi,dword ptr [esp+18h]
  004028EF: 89 4C 24 10        mov         dword ptr [esp+10h],ecx
  004028F3: 57                 push        edi
  004028F4: 33 F6              xor         esi,esi
  004028F6: FF D3              call        ebx
</code>```

In this case I know the function is "wcslen" but want to see if there is a good way to resolve this when working in environments where I only have access to Microsoft Visual Studio and not my usual reverse engineering tools.
Dumpbin /imports shows

```<code>MSVCRT.dll
                40422C Import Address Table
                404C14 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                   D3 _exit
                   48 _XcptFilter
                  249 exit
                  1E7 _wcmdln
                   8B __wgetmainargs
                  10F _initterm
                   83 __setusermatherr
                   9D _adjust_fdiv
                   6A __p__commode
                   6F __p__fmode
                   81 __set_app_type
                   CA _except_handler3
                   55 __dllonexit
                  186 _onexit
                    E ??1type_info@@UAE@XZ
                   B7 _controlfp
                  2E9 wcsncpy
                  2E6 wcslen
                  2E1 wcscmp
                  2D6 towupper
                   62 __p___argc
                   66 __p___wargv
                  1EA _wcsicmp
                   49 __CxxFrameHandler
                  2C0 strncmp
                  2C1 strncpy
                  2EB wcsrchr
                  2DF wcscat
                  2CB swprintf
</code>```

Dumpbin /raw shows the following at the address 404270h

```<code>00404270: 76 4D 00 00 6C 4D 00 00 60 4D 00 00 52 4D 00 00  vM..lM..`M..RM..
</code>```

0x4D76 corresponds to wcslen in CFF Explorer -> Import Directory -> MSVCRT.dll -> wcslen OFTs and FTs (IAT) columns with a hint of "2E6"

This is here, but trying to calculate the offset for the wcslen from these addresses.

```SECTION HEADER #2
  .rdata name
    102A virtual size
    4000 virtual address (00404000 to 00405029)
    2000 size of raw data
    4000 file pointer to raw data (00004000 to 00005FFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only

RAW DATA #2
  00404000: 82 4E 00 00 A2 4E 00 00 B0 4E 00 00 C0 4E 00 00  .N..¢N..°N..ÀN..
  00404010: D6 4E 00 00 EA 4E 00 00 F8 4E 00 00 08 4F 00 00  ÖN..êN..øN...O..
  00404020: 16 4F 00 00 24 4F 00 00 3A 4F 00 00 4E 4F 00 00  .O..$O..:O..NO..
  00404030: 90 4E 00 00 00 00 00 00 B0 14 00 80 B2 14 00 80  .N......°...²...
  00404040: 9D 0A 00 80 EA 0F 00 80 54 12 00 80 B7 14 00 80  ....ê...T...·...
  00404050: A5 14 00 80 4E 16 00 80 A1 0B 00 80 46 0C 00 80  ¥...N...¡...F...
  00404060: B6 0C 00 80 6B 11 00 80 3B 0C 00 80 B9 0C 00 80  ¶...k...;...¹...
  00404070: A4 0B 00 80 04 0C 00 80 9B 0B 00 80 F1 0E 00 80  ¤...........ñ...
  00404080: F2 0E 00 80 EC 0E 00 80 02 0C 00 80 EB 0F 00 80  ò...ì.......ë...
  00404090: 08 12 00 80 42 11 00 80 95 0E 00 80 31 02 00 80  ....B.......1...
  004040A0: 39 03 00 80 2F 03 00 80 81 02 00 80 90 02 00 80  9.../...........
  004040B0: 68 02 00 80 20 03 00 80 CA 09 00 80 35 0A 00 80  h... ...Ê...5...
  004040C0: 6B 04 00 80 AC 04 00 80 DC 04 00 80 8D 14 00 80  k...¬...Ü.......
  004040D0: 12 11 00 80 EF 12 00 80 80 13 00 80 A0 17 00 80  ....ï...........
  004040E0: E7 06 00 80 9C 14 00 80 43 11 00 80 08 0E 00 80  ç.......C.......
  004040F0: 31 11 00 80 15 0E 00 80 63 09 00 80 DF 07 00 80  1.......c...ß...
  00404100: 75 10 00 80 0A 0A 00 80 A3 17 00 80 E9 0F 00 80  u.......£...é...
  00404110: E8 06 00 80 0D 0D 00 80 75 14 00 80 49 09 00 80  è.......u...I...
  00404120: 25 14 00 80 E2 18 00 80 FB 10 00 80 A6 14 00 80  %...â...û...¦...
  00404130: D1 0E 00 80 DF 12 00 80 53 11 00 80 50 0A 00 80  Ñ...ß...S...P...
  00404140: FF 07 00 80 E4 18 00 80 A0 0E 00 80 C3 13 00 80  ÿ...ä.......Ã...
  00404150: B8 06 00 80 89 14 00 80 86 09 00 80 44 08 00 80  ¸...........D...
  00404160: 99 14 00 80 45 0D 00 80 0D 12 00 80 21 06 00 80  ....E.......!...
  00404170: 77 04 00 80 8D 04 00 80 FA 0A 00 80 5D 03 00 80  w.......ú...]...
  00404180: 1C 02 00 80 37 02 00 80 44 01 00 80 F3 08 00 80  ....7...D...ó...
  00404190: 3A 09 00 80 F6 08 00 80 85 10 00 80 BA 18 00 80  :...ö.......º...
  004041A0: 33 18 00 80 5A 03 00 80 1C 10 00 80 19 02 00 80  3...Z...........
  004041B0: AC 03 00 80 43 18 00 80 1A 02 00 80 60 12 00 80  ¬...C.......`...
  004041C0: 43 09 00 80 F3 02 00 80 D6 01 00 80 1F 0F 00 80  C...ó...Ö.......
  004041D0: 17 02 00 80 99 02 00 80 B3 07 00 80 ED 18 00 80  ........³...í...
  004041E0: 61 01 00 80 A6 0D 00 80 CB 09 00 80 63 01 00 80  a...¦...Ë...c...
  004041F0: AD 04 00 80 54 09 00 80 49 14 00 80 41 04 00 80  ...T...I...A...
  00404200: 4D 0F 00 80 5F 16 00 80 C8 09 00 80 F2 09 00 80  M..._...È...ò...
  00404210: 80 11 00 80 E3 18 00 80 AD 10 00 80 3B 12 00 80  ....ã......;...
  00404220: 28 11 00 80 F9 0D 00 80 00 00 00 00 8A 4D 00 00  (...ù........M..
  00404230: 92 4D 00 00 A0 4D 00 00 A8 4D 00 00 B2 4D 00 00  .M...M..¨M..²M..
  00404240: C4 4D 00 00 D0 4D 00 00 E4 4D 00 00 F4 4D 00 00  ÄM..ÐM..äM..ôM..
  00404250: 04 4E 00 00 12 4E 00 00 24 4E 00 00 44 4E 00 00  .N...N..$N..DN..
  00404260: 52 4E 00 00 5C 4E 00 00 74 4E 00 00 80 4D 00 00  RN..\N..tN...M..
  00404270: 76 4D 00 00 6C 4D 00 00 60 4D 00 00 52 4D 00 00  vM..lM..`M..RM..
  00404280: 44 4D 00 00 38 4D 00 00 24 4D 00 00 1A 4D 00 00  DM..8M..$M...M..
  00404290: 10 4D 00 00 06 4D 00 00 FC 4C 00 00 F0 4C 00 00  .M...M..üL..ðL..
  004042A0: 00 00 00 00 C6 4F 00 00 6E 4F 00 00 7A 4F 00 00  ....ÆO..nO..zO..
  004042B0: 8A 4F 00 00 96 4F 00 00 A6 4F 00 00 BA 4F 00 00  .O...O..¦O..ºO..
  004042C0: 0E 50 00 00 D8 4F 00 00 EC 4F 00 00 FE 4F 00 00  .P..ØO..ìO..þO..
  004042D0: 00 00 00 00 C4 4C 00 00 00 00 00 00 00 00 00 00  ....ÄL..........
  004042E0: 10 1B 40 00 E8 42 40 00 11 01 00 00 00 00 00 00  ..@.èB@.........
  004042F0: 46 E1 00 00 46 E1 00 00 0C 00 00 00 26 2D 40 00  Fá..Fá......&-@.
  00404300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00404310: 00 00 00 00 00 00 00 00 F8 2D 40 00 50 1B 40 00  ........ø-@.P.@.
  00404320: B0 1D 40 00 A0 1D 40 00 B0 1D 40 00 F2 2D 40 00  °.@...@.°.@.ò-@.
  00404330: EC 2D 40 00 E6 2D 40 00 E0 2D 40 00 DA 2D 40 00  ì-@.æ-@.à-@.Ú-@.
  00404340: D4 2D 40 00 CE 2D 40 00 20 1B 40 00 C8 2D 40 00  Ô-@.Î-@. .@.È-@.
  00404350: C2 2D 40 00 BC 2D 40 00 B6 2D 40 00 B0 2D 40 00  Â-@.¼-@.¶-@.°-@.
  00404360: AA 2D 40 00 A4 2D 40 00 9E 2D 40 00 98 2D 40 00  ª-@.¤-@..-@..-@.
  00404370: C0 1B 40 00 92 2D 40 00 8C 2D 40 00 86 2D 40 00  À.@..-@..-@..-@.
  00404380: 80 2D 40 00 7A 2D 40 00 74 2D 40 00 6E 2D 40 00  .-@.z-@.t-@.n-@.
  00404390: 68 2D 40 00 62 2D 40 00 5C 2D 40 00 56 2D 40 00  h-@.b-@.\-@.V-@.
  004043A0: 50 2D 40 00 4A 2D 40 00 44 2D 40 00 3E 2D 40 00  P-@.J-@.D-@.>-@.
  004043B0: 38 2D 40 00 32 2D 40 00 2C 2D 40 00 00 00 00 00  8-@.2-@.,-@.....
  004043C0: C0 1F 40 00 C8 43 40 00 0F 00 00 00 00 00 00 00  À.@.ÈC@.........
  004043D0: 00 00 00 00 00 00 00 00 0C 00 00 00 00 24 40 00  .............$@.
  004043E0: 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  7...............
  004043F0: 23 00 00 00 C0 24 40 00 11 01 00 00 01 00 00 00  #...À$@.........
  00404400: E8 03 00 00 E8 03 00 00 0C 00 00 00 D0 24 40 00  è...è.......Ð$@.
  00404410: 11 01 00 00 00 00 00 00 EB 03 00 00 EB 03 00 00  ........ë...ë...
  00404420: 0C 00 00 00 30 26 40 00 11 01 00 00 00 00 00 00  ....0&@.........
  00404430: EC 03 00 00 EC 03 00 00 0C 00 00 00 60 26 40 00  ì...ì.......`&@.
  00404440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00404450: 00 00 00 00 00 00 00 00 76 2E 40 00 10 1F 40 00  ........v.@...@.
  00404460: B0 1D 40 00 A0 1D 40 00 B0 1D 40 00 70 2E 40 00  °.@...@.°.@.p.@.
  00404470: 30 2F 40 00 E6 2D 40 00 E0 2D 40 00 DA 2D 40 00  0/@.æ-@.à-@.Ú-@.
  00404480: D4 2D 40 00 CE 2D 40 00 D0 1F 40 00 C8 2D 40 00  Ô-@.Î-@.Ð.@.È-@.
  00404490: C2 2D 40 00 BC 2D 40 00 B6 2D 40 00 B0 2D 40 00  Â-@.¼-@.¶-@.°-@.
  004044A0: AA 2D 40 00 A4 2D 40 00 9E 2D 40 00 98 2D 40 00  ª-@.¤-@..-@..-@.
  004044B0: 24 2F 40 00 1E 2F 40 00 18 2F 40 00 12 2F 40 00  $/@../@../@../@.
  004044C0: 0C 2F 40 00 06 2F 40 00 00 2F 40 00 FA 2E 40 00  ./@../@../@.ú.@.
  004044D0: F4 2E 40 00 EE 2E 40 00 E8 2E 40 00 E2 2E 40 00  ô.@.î.@.è.@.â.@.
  004044E0: DC 2E 40 00 30 1F 40 00 70 28 40 00 80 28 40 00  Ü.@.0.@.p(@..(@.
  004044F0: 6A 2E 40 00 D0 2E 40 00 CA 2E 40 00 C4 2E 40 00  j.@.Ð.@.Ê.@.Ä.@.
  00404500: BE 2E 40 00 B8 2E 40 00 7C 2E 40 00 64 2E 40 00  ¾.@.¸.@.|.@.d.@.
  00404510: A6 2E 40 00 5E 2E 40 00 28 2E 40 00 E0 1F 40 00  ¦.@.^.@.(.@.à.@.
  00404520: 58 2E 40 00 52 2E 40 00 4C 2E 40 00 46 2E 40 00  X.@.R.@.L.@.F.@.
  00404530: 36 2F 40 00 90 28 40 00 B0 1D 40 00 A0 1D 40 00  6/@..(@.°.@...@.
  00404540: B0 1D 40 00 F2 2D 40 00 30 2F 40 00 E6 2D 40 00  °.@.ò-@.0/@.æ-@.
  00404550: E0 2D 40 00 DA 2D 40 00 D4 2D 40 00 CE 2D 40 00  à-@.Ú-@.Ô-@.Î-@.
  00404560: 2A 2F 40 00 C8 2D 40 00 C2 2D 40 00 BC 2D 40 00  */@.È-@.Â-@.¼-@.
  00404570: B6 2D 40 00 B0 2D 40 00 AA 2D 40 00 A4 2D 40 00  ¶-@.°-@.ª-@.¤-@.
  00404580: 9E 2D 40 00 98 2D 40 00 24 2F 40 00 1E 2F 40 00  .-@..-@.$/@../@.
  00404590: 18 2F 40 00 12 2F 40 00 0C 2F 40 00 06 2F 40 00  ./@../@../@../@.
  004045A0: 00 2F 40 00 FA 2E 40 00 F4 2E 40 00 EE 2E 40 00  ./@.ú.@.ô.@.î.@.
  004045B0: E8 2E 40 00 E2 2E 40 00 DC 2E 40 00 B0 1D 40 00  è.@.â.@.Ü.@.°.@.
  004045C0: 70 28 40 00 80 28 40 00 D6 2E 40 00 D0 2E 40 00  p(@..(@.Ö.@.Ð.@.
  004045D0: CA 2E 40 00 C4 2E 40 00 BE 2E 40 00 B8 2E 40 00  Ê.@.Ä.@.¾.@.¸.@.
  004045E0: B2 2E 40 00 AC 2E 40 00 A6 2E 40 00 A0 2E 40 00  ².@.¬.@.¦.@...@.
  004045F0: 9A 2E 40 00 94 2E 40 00 8E 2E 40 00 88 2E 40 00  ..@...@...@...@.
  00404600: 82 2E 40 00 B0 28 40 00 B0 1D 40 00 A0 1D 40 00  ..@.°(@.°.@...@.
  00404610: B0 1D 40 00 F2 2D 40 00 30 2F 40 00 E6 2D 40 00  °.@.ò-@.0/@.æ-@.
  00404620: E0 2D 40 00 DA 2D 40 00 D4 2D 40 00 CE 2D 40 00  à-@.Ú-@.Ô-@.Î-@.
  00404630: 2A 2F 40 00 C8 2D 40 00 C2 2D 40 00 BC 2D 40 00  */@.È-@.Â-@.¼-@.
  00404640: B6 2D 40 00 B0 2D 40 00 AA 2D 40 00 A4 2D 40 00  ¶-@.°-@.ª-@.¤-@.
  00404650: 9E 2D 40 00 98 2D 40 00 24 2F 40 00 1E 2F 40 00  .-@..-@.$/@../@.
  00404660: 18 2F 40 00 12 2F 40 00 0C 2F 40 00 06 2F 40 00  ./@../@../@../@.
  00404670: 00 2F 40 00 FA 2E 40 00 F4 2E 40 00 EE 2E 40 00  ./@.ú.@.ô.@.î.@.
  00404680: E8 2E 40 00 E2 2E 40 00 DC 2E 40 00 B0 1D 40 00  è.@.â.@.Ü.@.°.@.
  00404690: 70 28 40 00 80 28 40 00 D6 2E 40 00 D0 2E 40 00  p(@..(@.Ö.@.Ð.@.
  004046A0: CA 2E 40 00 C4 2E 40 00 BE 2E 40 00 B8 2E 40 00  Ê.@.Ä.@.¾.@.¸.@.
  004046B0: 7C 2E 40 00 AC 2E 40 00 A6 2E 40 00 A0 2E 40 00  |.@.¬.@.¦.@...@.
  004046C0: FF FF FF FF 61 31 40 00 75 31 40 00 08 47 40 00  ÿÿÿÿa1@.u1@..G@.
  004046D0: 10 32 40 00 00 00 00 00 90 63 40 00 00 00 00 00  .2@......c@.....
  004046E0: 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00  ....ÿÿÿÿ........
  004046F0: D8 46 40 00 00 00 00 00 00 00 00 00 00 00 00 00  ØF@.............
  00404700: 01 00 00 00 F0 46 40 00 00 00 00 00 00 00 00 00  ....ðF@.........
  00404710: 00 00 00 00 90 63 40 00 F8 46 40 00 00 00 00 00  .....c@.øF@.....
  00404720: 20 05 93 19 08 00 00 00 40 47 40 00 00 00 00 00   .......@G@.....
  00404730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00404740: FF FF FF FF F0 32 40 00 FF FF FF FF FB 32 40 00  ÿÿÿÿð2@.ÿÿÿÿû2@.
  00404750: 01 00 00 00 06 33 40 00 02 00 00 00 11 33 40 00  .....3@......3@.
  00404760: 03 00 00 00 1C 33 40 00 04 00 00 00 27 33 40 00  .....3@.....'3@.
  00404770: 05 00 00 00 32 33 40 00 06 00 00 00 3D 33 40 00  ....23@.....=3@.
  00404780: 20 05 93 19 07 00 00 00 A0 47 40 00 00 00 00 00   ........G@.....
  00404790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  004047A0: FF FF FF FF 60 33 40 00 00 00 00 00 68 33 40 00  ÿÿÿÿ`3@.....h3@.
  004047B0: 01 00 00 00 73 33 40 00 02 00 00 00 81 33 40 00  ....s3@......3@.
  004047C0: 03 00 00 00 8F 33 40 00 04 00 00 00 9D 33 40 00  .....3@......3@.
  004047D0: 05 00 00 00 AB 33 40 00 20 05 93 19 08 00 00 00  ....«3@. .......
  004047E0: F8 47 40 00 00 00 00 00 00 00 00 00 00 00 00 00  øG@.............
  004047F0: 00 00 00 00 00 00 00 00 FF FF FF FF D0 33 40 00  ........ÿÿÿÿÐ3@.
  00404800: 00 00 00 00 D8 33 40 00 01 00 00 00 E3 33 40 00  ....Ø3@.....ã3@.
  00404810: 02 00 00 00 F1 33 40 00 03 00 00 00 FF 33 40 00  ....ñ3@.....ÿ3@.
  00404820: 04 00 00 00 0D 34 40 00 05 00 00 00 1B 34 40 00  .....4@......4@.
  00404830: 06 00 00 00 29 34 40 00 20 05 93 19 08 00 00 00  ....)4@. .......
  00404840: 58 48 40 00 00 00 00 00 00 00 00 00 00 00 00 00  XH@.............
  00404850: 00 00 00 00 00 00 00 00 FF FF FF FF 50 34 40 00  ........ÿÿÿÿP4@.
  00404860: 00 00 00 00 5B 34 40 00 FF FF FF FF 66 34 40 00  ....[4@.ÿÿÿÿf4@.
  00404870: 02 00 00 00 71 34 40 00 03 00 00 00 7C 34 40 00  ....q4@.....|4@.
  00404880: 03 00 00 00 87 34 40 00 FF FF FF FF 92 34 40 00  .....4@.ÿÿÿÿ.4@.
  00404890: 06 00 00 00 9D 34 40 00 20 05 93 19 02 00 00 00  .....4@. .......
  004048A0: B8 48 40 00 00 00 00 00 00 00 00 00 00 00 00 00  ¸H@.............
  004048B0: 00 00 00 00 00 00 00 00 FF FF FF FF C0 34 40 00  ........ÿÿÿÿÀ4@.
  004048C0: 00 00 00 00 C8 34 40 00 20 05 93 19 07 00 00 00  ....È4@. .......
  004048D0: E8 48 40 00 01 00 00 00 20 49 40 00 00 00 00 00  èH@..... I@.....
  004048E0: 00 00 00 00 00 00 00 00 FF FF FF FF E0 34 40 00  ........ÿÿÿÿà4@.
  004048F0: 00 00 00 00 EB 34 40 00 01 00 00 00 00 00 00 00  ....ë4@.........
  00404900: 02 00 00 00 F3 34 40 00 01 00 00 00 00 00 00 00  ....ó4@.........
  00404910: 04 00 00 00 06 35 40 00 FF FF FF FF FB 34 40 00  .....5@.ÿÿÿÿû4@.
  00404920: 02 00 00 00 03 00 00 00 05 00 00 00 01 00 00 00  ................
  00404930: 38 49 40 00 00 00 00 00 00 00 00 00 A0 61 40 00  8I@..........a@.
  00404940: 00 00 00 00 DC 27 40 00 20 05 93 19 01 00 00 00  ....Ü'@. .......
  00404950: 68 49 40 00 00 00 00 00 00 00 00 00 00 00 00 00  hI@.............
  00404960: 00 00 00 00 00 00 00 00 FF FF FF FF 20 35 40 00  ........ÿÿÿÿ 5@.
  00404970: BC 4C 00 00 00 00 00 00 00 00 00 00 D6 4C 00 00  ¼L..........ÖL..
  00404980: D4 42 00 00 20 4A 00 00 00 00 00 00 00 00 00 00  ÔB.. J..........
  00404990: E4 4C 00 00 38 40 00 00 14 4C 00 00 00 00 00 00  äL..8@...L......
  004049A0: 00 00 00 00 38 4E 00 00 2C 42 00 00 E8 49 00 00  ....8N..,B..èI..
  004049B0: 00 00 00 00 00 00 00 00 60 4F 00 00 00 40 00 00  ........`O...@..
  004049C0: 8C 4C 00 00 00 00 00 00 00 00 00 00 1E 50 00 00  .L...........P..
  004049D0: A4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ¤B..............
  004049E0: 00 00 00 00 00 00 00 00 82 4E 00 00 A2 4E 00 00  .........N..¢N..
  004049F0: B0 4E 00 00 C0 4E 00 00 D6 4E 00 00 EA 4E 00 00  °N..ÀN..ÖN..êN..
  00404A00: F8 4E 00 00 08 4F 00 00 16 4F 00 00 24 4F 00 00  øN...O...O..$O..
  00404A10: 3A 4F 00 00 4E 4F 00 00 90 4E 00 00 00 00 00 00  :O..NO...N......
  00404A20: B0 14 00 80 B2 14 00 80 9D 0A 00 80 EA 0F 00 80  °...².......ê...
  00404A30: 54 12 00 80 B7 14 00 80 A5 14 00 80 4E 16 00 80  T...·...¥...N...
  00404A40: A1 0B 00 80 46 0C 00 80 B6 0C 00 80 6B 11 00 80  ¡...F...¶...k...
  00404A50: 3B 0C 00 80 B9 0C 00 80 A4 0B 00 80 04 0C 00 80  ;...¹...¤.......
  00404A60: 9B 0B 00 80 F1 0E 00 80 F2 0E 00 80 EC 0E 00 80  ....ñ...ò...ì...
  00404A70: 02 0C 00 80 EB 0F 00 80 08 12 00 80 42 11 00 80  ....ë.......B...
  00404A80: 95 0E 00 80 31 02 00 80 39 03 00 80 2F 03 00 80  ....1...9.../...
  00404A90: 81 02 00 80 90 02 00 80 68 02 00 80 20 03 00 80  ........h... ...
  00404AA0: CA 09 00 80 35 0A 00 80 6B 04 00 80 AC 04 00 80  Ê...5...k...¬...
  00404AB0: DC 04 00 80 8D 14 00 80 12 11 00 80 EF 12 00 80  Ü...........ï...
  00404AC0: 80 13 00 80 A0 17 00 80 E7 06 00 80 9C 14 00 80  ........ç.......
  00404AD0: 43 11 00 80 08 0E 00 80 31 11 00 80 15 0E 00 80  C.......1.......
  00404AE0: 63 09 00 80 DF 07 00 80 75 10 00 80 0A 0A 00 80  c...ß...u.......
  00404AF0: A3 17 00 80 E9 0F 00 80 E8 06 00 80 0D 0D 00 80  £...é...è.......
  00404B00: 75 14 00 80 49 09 00 80 25 14 00 80 E2 18 00 80  u...I...%...â...
  00404B10: FB 10 00 80 A6 14 00 80 D1 0E 00 80 DF 12 00 80  û...¦...Ñ...ß...
  00404B20: 53 11 00 80 50 0A 00 80 FF 07 00 80 E4 18 00 80  S...P...ÿ...ä...
  00404B30: A0 0E 00 80 C3 13 00 80 B8 06 00 80 89 14 00 80  ....Ã...¸.......
  00404B40: 86 09 00 80 44 08 00 80 99 14 00 80 45 0D 00 80  ....D.......E...
  00404B50: 0D 12 00 80 21 06 00 80 77 04 00 80 8D 04 00 80  ....!...w.......
  00404B60: FA 0A 00 80 5D 03 00 80 1C 02 00 80 37 02 00 80  ú...].......7...
  00404B70: 44 01 00 80 F3 08 00 80 3A 09 00 80 F6 08 00 80  D...ó...:...ö...
  00404B80: 85 10 00 80 BA 18 00 80 33 18 00 80 5A 03 00 80  ....º...3...Z...
  00404B90: 1C 10 00 80 19 02 00 80 AC 03 00 80 43 18 00 80  ........¬...C...
  00404BA0: 1A 02 00 80 60 12 00 80 43 09 00 80 F3 02 00 80  ....`...C...ó...
  00404BB0: D6 01 00 80 1F 0F 00 80 17 02 00 80 99 02 00 80  Ö...............
  00404BC0: B3 07 00 80 ED 18 00 80 61 01 00 80 A6 0D 00 80  ³...í...a...¦...
  00404BD0: CB 09 00 80 63 01 00 80 AD 04 00 80 54 09 00 80  Ë...c......T...
  00404BE0: 49 14 00 80 41 04 00 80 4D 0F 00 80 5F 16 00 80  I...A...M..._...
  00404BF0: C8 09 00 80 F2 09 00 80 80 11 00 80 E3 18 00 80  È...ò.......ã...
  00404C00: AD 10 00 80 3B 12 00 80 28 11 00 80 F9 0D 00 80  ...;...(...ù...
  00404C10: 00 00 00 00 8A 4D 00 00 92 4D 00 00 A0 4D 00 00  .....M...M...M..
  00404C20: A8 4D 00 00 B2 4D 00 00 C4 4D 00 00 D0 4D 00 00  ¨M..²M..ÄM..ÐM..
  00404C30: E4 4D 00 00 F4 4D 00 00 04 4E 00 00 12 4E 00 00  äM..ôM...N...N..
  00404C40: 24 4E 00 00 44 4E 00 00 52 4E 00 00 5C 4E 00 00  $N..DN..RN..\N..
  00404C50: 74 4E 00 00 80 4D 00 00 76 4D 00 00 6C 4D 00 00  tN...M..vM..lM..
  00404C60: 60 4D 00 00 52 4D 00 00 44 4D 00 00 38 4D 00 00  `M..RM..DM..8M..
  00404C70: 24 4D 00 00 1A 4D 00 00 10 4D 00 00 06 4D 00 00  $M...M...M...M..
  00404C80: FC 4C 00 00 F0 4C 00 00 00 00 00 00 C6 4F 00 00  üL..ðL......ÆO..
  00404C90: 6E 4F 00 00 7A 4F 00 00 8A 4F 00 00 96 4F 00 00  nO..zO...O...O..
  00404CA0: A6 4F 00 00 BA 4F 00 00 0E 50 00 00 D8 4F 00 00  ¦O..ºO...P..ØO..
  00404CB0: EC 4F 00 00 FE 4F 00 00 00 00 00 00 C4 4C 00 00  ìO..þO......ÄL..
  00404CC0: 00 00 00 00 19 00 47 65 74 41 64 61 70 74 65 72  ......GetAdapter
  00404CD0: 73 49 6E 66 6F 00 69 70 68 6C 70 61 70 69 2E 64  sInfo.iphlpapi.d
  00404CE0: 6C 6C 00 00 4D 46 43 34 32 75 2E 44 4C 4C 00 00  ll..MFC42u.DLL..
  00404CF0: CB 02 73 77 70 72 69 6E 74 66 00 00 DF 02 77 63  Ë.swprintf..ß.wc
  00404D00: 73 63 61 74 00 00 EB 02 77 63 73 72 63 68 72 00  scat..ë.wcsrchr.
  00404D10: C1 02 73 74 72 6E 63 70 79 00 C0 02 73 74 72 6E  Á.strncpy.À.strn
  00404D20: 63 6D 70 00 49 00 5F 5F 43 78 78 46 72 61 6D 65  cmp.I.__CxxFrame
  00404D30: 48 61 6E 64 6C 65 72 00 EA 01 5F 77 63 73 69 63  Handler.ê._wcsic
  00404D40: 6D 70 00 00 66 00 5F 5F 70 5F 5F 5F 77 61 72 67  mp..f.__p___warg
  00404D50: 76 00 62 00 5F 5F 70 5F 5F 5F 61 72 67 63 00 00  v.b.__p___argc..
  00404D60: D6 02 74 6F 77 75 70 70 65 72 00 00 E1 02 77 63  Ö.towupper..á.wc
  00404D70: 73 63 6D 70 00 00 E6 02 77 63 73 6C 65 6E 00 00  scmp..æ.wcslen..
  00404D80: E9 02 77 63 73 6E 63 70 79 00 D3 00 5F 65 78 69  é.wcsncpy.Ó._exi
  00404D90: 74 00 48 00 5F 58 63 70 74 46 69 6C 74 65 72 00  t.H._XcptFilter.
  00404DA0: 49 02 65 78 69 74 00 00 E7 01 5F 77 63 6D 64 6C  I.exit..ç._wcmdl
  00404DB0: 6E 00 8B 00 5F 5F 77 67 65 74 6D 61 69 6E 61 72  n...__wgetmainar
  00404DC0: 67 73 00 00 0F 01 5F 69 6E 69 74 74 65 72 6D 00  gs...._initterm.
  00404DD0: 83 00 5F 5F 73 65 74 75 73 65 72 6D 61 74 68 65  ..__setusermathe
  00404DE0: 72 72 00 00 9D 00 5F 61 64 6A 75 73 74 5F 66 64  rr...._adjust_fd
  00404DF0: 69 76 00 00 6A 00 5F 5F 70 5F 5F 63 6F 6D 6D 6F  iv..j.__p__commo
  00404E00: 64 65 00 00 6F 00 5F 5F 70 5F 5F 66 6D 6F 64 65  de..o.__p__fmode
  00404E10: 00 00 81 00 5F 5F 73 65 74 5F 61 70 70 5F 74 79  ....__set_app_ty
  00404E20: 70 65 00 00 CA 00 5F 65 78 63 65 70 74 5F 68 61  pe..Ê._except_ha
  00404E30: 6E 64 6C 65 72 33 00 00 4D 53 56 43 52 54 2E 64  ndler3..MSVCRT.d
  00404E40: 6C 6C 00 00 55 00 5F 5F 64 6C 6C 6F 6E 65 78 69  ll..U.__dllonexi
  00404E50: 74 00 86 01 5F 6F 6E 65 78 69 74 00 0E 00 3F 3F  t..._onexit...??
  00404E60: 31 74 79 70 65 5F 69 6E 66 6F 40 40 55 41 45 40  1type_info@@UAE@
  00404E70: 58 5A 00 00 B7 00 5F 63 6F 6E 74 72 6F 6C 66 70  XZ..·._controlfp
  00404E80: 00 00 2E 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00  ....CloseHandle.
  00404E90: 83 00 44 65 76 69 63 65 49 6F 43 6F 6E 74 72 6F  ..DeviceIoContro
  00404EA0: 6C 00 50 00 43 72 65 61 74 65 46 69 6C 65 57 00  l.P.CreateFileW.
  00404EB0: E0 01 47 65 74 56 65 72 73 69 6F 6E 45 78 57 00  à.GetVersionExW.
  00404EC0: 76 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E  v.GetModuleFileN
  00404ED0: 61 6D 65 57 00 00 7A 01 47 65 74 4D 6F 64 75 6C  ameW..z.GetModul
  00404EE0: 65 48 61 6E 64 6C 65 57 00 00 F5 01 47 6C 6F 62  eHandleW..õ.Glob
  00404EF0: 61 6C 46 72 65 65 00 00 00 02 47 6C 6F 62 61 6C  alFree....Global
  00404F00: 55 6E 6C 6F 63 6B 00 00 F9 01 47 6C 6F 62 61 6C  Unlock..ù.Global
  00404F10: 4C 6F 63 6B 00 00 EE 01 47 6C 6F 62 61 6C 41 6C  Lock..î.GlobalAl
  00404F20: 6C 6F 63 00 89 03 57 69 64 65 43 68 61 72 54 6F  loc...WideCharTo
  00404F30: 4D 75 6C 74 69 42 79 74 65 00 0F 01 47 65 74 43  MultiByte...GetC
  00404F40: 6F 6D 70 75 74 65 72 4E 61 6D 65 57 00 00 B0 01  omputerNameW..°.
  00404F50: 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 57 00  GetStartupInfoW.
  00404F60: 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 BE 01  KERNEL32.dll..¾.
  00404F70: 4C 6F 61 64 49 63 6F 6E 57 00 3F 02 53 65 6E 64  LoadIconW.?.Send
  00404F80: 4D 65 73 73 61 67 65 57 00 00 B6 00 44 72 61 77  MessageW..¶.Draw
  00404F90: 49 63 6F 6E 00 00 FF 00 47 65 74 43 6C 69 65 6E  Icon..ÿ.GetClien
  00404FA0: 74 52 65 63 74 00 5D 01 47 65 74 53 79 73 74 65  tRect.].GetSyste
  00404FB0: 6D 4D 65 74 72 69 63 73 00 00 A6 01 49 73 49 63  mMetrics..¦.IsIc
  00404FC0: 6F 6E 69 63 00 00 42 00 43 6C 6F 73 65 43 6C 69  onic..B.CloseCli
  00404FD0: 70 62 6F 61 72 64 00 00 49 02 53 65 74 43 6C 69  pboard..I.SetCli
  00404FE0: 70 62 6F 61 72 64 44 61 74 61 00 00 C1 00 45 6D  pboardData..Á.Em
  00404FF0: 70 74 79 43 6C 69 70 62 6F 61 72 64 00 00 F5 01  ptyClipboard..õ.
  00405000: 4F 70 65 6E 43 6C 69 70 62 6F 61 72 64 00 C4 00  OpenClipboard.Ä.
  00405010: 45 6E 61 62 6C 65 57 69 6E 64 6F 77 00 00 55 53  EnableWindow..US
  00405020: 45 52 33 32 2E 64 6C 6C 00 00                    ER32.dll..
```


问:
Debugging 32 bit MS DOS program
I have 32 bit MS DOS programs (used DOS extender DOS4GW.EXE). Program compiled with WATCOM C++ 32 bit, I am looking for debugger and disassembler for Win7, Win10 or WinME. Who knows?</p>

Title: Debugging 32 bit MS DOS program


问:
Please figure out how this Checksum was derived
I have hexadecimal data from first 5 blocks of T5557 125KHz RFID card. The 5th block appear to be some kind of checksum which I like to know how it is derived.

Below are 11 different samples of the data. Rows 1 to 5 in the tables represent block 1 to 5 of T5557 125 KHz RFID card.

(1)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
79 68 E1 0B

Block 4
00 E1 13 00

Block 5
ED 13 60 29

(2)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
81 68 E1 0B

Block 4
00 E1 13 00

Block 5
67 ED 6E A2

(3)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
7A 6A E1 0B

Block 4
00 E1 13 00

Block 5
67 42 43 F4

(4)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
82 6A E1 0B

Block 4
00 E1 13 00

Block 5
A4 1C 39 4B

(5)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
83 6A E1 0B

Block 4
00 E1 13 00

Block 5
AF DB 05 31

(6)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
7B 6C E1 0B

Block 4
00 E1 13 00

Block 5
7C 90 DD F8

(7)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
84 6C E1 0B

Block 4
00 E1 13 00

Block 5
9E 9F B5 FA

(8)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
7C 6E E1 0B

Block 4
00 E1 13 00

Block 5
26 35 F2 7B

(9)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
85 6E E1 0B

Block 4
00 E1 13 00

Block 5
59 40 B0 E4

(10)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
7E 62 E1 0B

Block 4
00 E1 13 00

Block 5
98 D7 99 2D

(11)

Block
Data

Block 1
C9 09 8C F1

Block 2
00 01 01 01

Block 3
8D 62 E1 0B

Block 4
00 E1 13 00

Block 5
94 E0 6E 12

Please note how changes in block 3 column 1 data  for samples 1,2,3 and 4,5 and 6,7 and 8,9 and 10,11 affect block 5 data.

Is anyone able to figure out how data in row 5 was derived?

Many thanks in advance.


问:
Why isn't IDA Freeware using my .idt file?
I'm trying to learn my way around IDA and using the IDA Free package. I've been trying to analyse a program that imports mfc140 which IDA Free doesn't ship signatures for.

I've loaded the .dll myself and used a small script to generate a .idt file which as far as I can tell is OK. However, when I load the IDT using the File -> Load File -> IDS/IDT File... dialog nothing happens.

I'm not entirely sure what I've gotten wrong here.

Heres a small sample of the program with the imports:

```<code>.idata:0000000140019618 ; __int64 __fastcall mfc140_265(_QWORD, _QWORD, _QWORD)
.idata:0000000140019618                 extrn __imp_mfc140_265:qword
.idata:0000000140019618                                         ; DATA XREF: mfc140_265↑r
.idata:0000000140019618                                         ; Import by ordinal 265
.idata:0000000140019620                 extrn __imp_mfc140_266:qword
.idata:0000000140019620                                         ; DATA XREF: mfc140_266↑r
.idata:0000000140019620                                         ; Import by ordinal 266
.idata:0000000140019628                 extrn mfc140_1639:qword ; CODE XREF: sub_140016210+9D↑p
.idata:0000000140019628                                         ; sub_1400165D0+3B↑p
.idata:0000000140019628                                         ; DATA XREF: ...
.idata:0000000140019628                                         ; Import by ordinal 1639
.idata:0000000140019630                 extrn mfc140_4937:qword ; CODE XREF: sub_140016340+38↑p
.idata:0000000140019630                                         ; sub_140016660+32↑p
.idata:0000000140019630                                         ; DATA XREF: ...
.idata:0000000140019630                                         ; Import by ordinal 4937
.idata:0000000140019638                 extrn mfc140_5656:qword ; CODE XREF: sub_140016210+72↑p
.idata:0000000140019638                                         ; sub_140016340+2D↑p ...
.idata:0000000140019638                                         ; Import by ordinal 5656
.idata:0000000140019640                 extrn mfc140_316:qword  ; CODE XREF: sub_140016070+2C↑p
.idata:0000000140019640                                         ; sub_140016070+37↑p
.idata:0000000140019640                                         ; DATA XREF: ...
.idata:0000000140019640                                         ; Import by ordinal 316
.idata:0000000140019648                 extrn mfc140_300:qword  ; CODE XREF: sub_1400161E0+20↑p
.idata:0000000140019648                                         ; DATA XREF: sub_1400161E0+20↑r
.idata:0000000140019648                                         ; Import by ordinal 300
.idata:0000000140019650                 extrn mfc140_310:qword  ; CODE XREF: sub_140001030+1B↑p
.idata:0000000140019650                                         ; sub_140001070+1B↑p ...
.idata:0000000140019650                                         ; Import by ordinal 310
</code>```

And here is a slice of my .idt file.

```<code>0 Name=mfc140.dll
256 Name=??$CopyElements@VCOleVariant@@@@YGXPAVCOleVariant@@PBV0@H@Z
257 Name=??$HashKey@ABUtagVARIANT@@@@YGIABUtagVARIANT@@@Z
258 Name=??$HashKey@PB_W@@YGIPB_W@Z
259 Name=?HashKey@CMapStringToPtr@@QBEIPBD@Z
260 Name=??$HashKey@VCComBSTR@ATL@@@@YGIVCComBSTR@ATL@@@Z
261 Name=??$SerializeElements@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@@YGXAAVCArchive@@PAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
262 Name=??$SerializeElements@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@@YGXAAVCArchive@@PAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
263 Name=??$SerializeElements@VCComBSTR@ATL@@@@YGXAAVCArchive@@PAVCComBSTR@ATL@@H@Z
264 Name=??$SerializeElements@VCOleVariant@@@@YGXAAVCArchive@@PAVCOleVariant@@H@Z
265 Name=??_U@YAPAXI@Z
266 Name=??3@YAXPAX@Z
267 Name=??0?$CSimpleStringT@_W$00@ATL@@QAE@ABV01@@Z
268 Name=??0?$CSimpleStringT@_W$00@ATL@@QAE@ABV01@@Z
269 Name=??0?$CSimpleStringT@D$00@ATL@@QAE@PAUIAtlStringMgr@1@@Z
270 Name=??0?$CSimpleStringT@_W$00@ATL@@QAE@PB_WHPAUIAtlStringMgr@1@@Z
271 Name=??0?$CSimpleStringT@_W$00@ATL@@QAE@PB_WPAUIAtlStringMgr@1@@Z
272 Name=??0?$CSimpleStringT@D$00@ATL@@QAE@ABV01@@Z
273 Name=??0?$CSimpleStringT@D$00@ATL@@QAE@ABV01@@Z
274 Name=??0?$CSimpleStringT@D$00@ATL@@QAE@PAUIAtlStringMgr@1@@Z
275 Name=??0?$CSimpleStringT@D$00@ATL@@QAE@PBDHPAUIAtlStringMgr@1@@Z
276 Name=??0?$CSimpleStringT@D$00@ATL@@QAE@PBDPAUIAtlStringMgr@1@@Z
277 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@_WH@Z
278 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@ABUtagVARIANT@@@Z
279 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@ABUtagVARIANT@@PAUIAtlStringMgr@1@@Z
280 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@ABV01@@Z
281 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@DH@Z
282 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PA_W@Z
283 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBD@Z
284 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBD@Z
285 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PAUIAtlStringMgr@1@@Z
286 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PA_W@Z
287 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PB_WH@Z
288 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PB_WHPAUIAtlStringMgr@1@@Z
289 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PB_WPAUIAtlStringMgr@1@@Z
290 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBD@Z
291 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBDH@Z
292 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBDHPAUIAtlStringMgr@1@@Z
293 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBDPAUIAtlStringMgr@1@@Z
294 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBE@Z
295 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PBEPAUIAtlStringMgr@1@@Z
296 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@XZ
297 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@_WH@Z
298 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@ABUtagVARIANT@@@Z
299 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@ABUtagVARIANT@@PAUIAtlStringMgr@1@@Z
300 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@ABV01@@Z
301 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@DH@Z
302 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PA_W@Z
303 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PBD@Z
304 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PBD@Z
305 Name=??0?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAE@PAUIAtlStringMgr@1@@Z
306 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PA_W@Z
307 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PB_WH@Z
308 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PB_WHPAUIAtlStringMgr@1@@Z
309 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PB_WPAUIAtlStringMgr@1@@Z
310 Name=??0?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@QAE@PBD@Z
</code>```

I'm absolutely certain I've missed some key detail but the documentation I've been able to find is pretty thin.


问:
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the camera's main board at baudrate 115200.

The UART interface gives me U-Boot shell (which I was able to dump firmware, see below) and access to a Busybox protected shell (psh).

The camera runs on ARM(v6) Linux, with a 3.0 kernel.

Here is the repo contains firmware dump and other stuff I found on the camera.

The problem is, the psh provide a really limited set of commands, and some even un-runable even when it's available in the help command:

Now I want to break out of that shell to get a full root shell.

From what I understand, this is the boot process: First, U-boot is loaded, then it loads kernel, then kernel boots, then it loads some sort of "init" (for some reason I can't find that exactly init script/executable). The init will then initialize the system, and finally it loads the vendor's main app ezapp and a protected Busybox shell.

What I have tried:

Follow this answer of adding single to boot cmdline: it stills boot to that psh, but the ezapp won't be loaded.

Modify the squashfs that contains the ezapp so it will load /bin/sh instead of ezapp, then pass the squashfs as initrd to kernel: not work, system still runs ezapp.

Add init=/bin/sh to cmdline: not work, kernel somehow ignore that option.

Here is the output from dmesg command (one of the very few command that can be executed on psh):

```<code>[    0.000000] Linux version 3.0.8[svn 59238] (tuyongliang@Cpl-Civil-Camera) (gcc version 4.3.2 (crosstool-NG 1.19.0) ) #219 Tue Jul 23 15:45:36 CST 2019
[    0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: HIK IPC
[    0.000000] devinfo=c6c_2019
[    0.000000] mem=38797312 byte
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] On node 0 totalpages: 9472
[    0.000000] free_area_init_node: node 0, pgdat c0438dc0, node_mem_map c045b000
[    0.000000]   Normal zone: 74 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 9398 pages, LIFO batch:1
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 9398
[    0.000000] Kernel command line: console=ttyS0,115200 root=/dev/ram0 mem=40M single mtdparts=spi_flash:256k(bld)ro,64k(env),64k(enc)ro,2304k(sys),3968k(ap0
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 37MB = 37MB total
[    0.000000] Memory: 33016k/33016k available, 4872k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
[    0.000000]     vmalloc : 0xc2800000 - 0xfe000000   ( 952 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc2500000   (  37 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .init : 0xc0008000 - 0xc00d4000   ( 816 kB)
[    0.000000]       .text : 0xc00d4000 - 0xc0417000   (3340 kB)
[    0.000000]       .data : 0xc0418000 - 0xc0439440   ( 134 kB)
[    0.000000]        .bss : 0xc0439464 - 0xc045a478   ( 133 kB)
[    0.000000] SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] timer mult: 0xfa000000, timer shift: 0x16
[    0.000000] sched_clock: 32 bits at 1000kHz, resolution 1000ns, wraps every 4294967ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.000409] Calibrating delay loop... 430.08 BogoMIPS (lpj=2150400)
[    0.060029] pid_max: default: 32768 minimum: 301
[    0.060412] Mount-cache hash table entries: 512
[    0.061131] CPU: Testing write buffer coherency: ok
[    0.061451] hw perfevents: enabled with v6 PMU driver, 3 counters available
[    0.062578] devtmpfs: initialized
[    0.066508] NET: Registered protocol family 16
[    0.071026] fh_pinctrl_init selected_devices_c6c_2019.
[    0.085091] hw-breakpoint: found 6 breakpoint and 1 watchpoint registers.
[    0.085137] hw-breakpoint: maximum watchpoint size is 4 bytes.
[    0.113497] bio: create slab <bio-0> at 0
[    0.119000] fh_dmac fh_dmac.0: FH DMA Controller, 8 channels
[    0.125564] Advanced Linux Sound Architecture Driver Version 1.0.24.
[    0.128599] cfg80211: Calling CRDA to update world regulatory domain
[    0.130430] Switching to clocksource fh_clocksource
[    0.185851] NET: Registered protocol family 2
[    0.186096] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.186698] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.186844] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.186923] TCP: Hash tables configured (established 2048 bind 2048)
[    0.186951] TCP reno registered
[    0.186981] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.187040] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.187726] NET: Registered protocol family 1
[    1.520113] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.530885] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    1.547273] msgmni has been set to 64
[    1.561028] NET: Registered protocol family 38
[    1.561127] io scheduler noop registered (default)
[    1.580949] PWM driver, Number: 8, IO base addr: 0xc2968000
[    1.591785] ttyS.0: ttyS0 at MMIO 0xf0700000 (irq = 30) is a ttyS
[    1.600942] fh serial probe done
[    1.601052] ttyS.2: ttyS2 at MMIO 0xf0880000 (irq = 35) is a ttyS
[    1.607981] fh serial probe done
[    1.627555] brd: module loaded
[    1.731122] loop: module loaded
[    1.759717] I2S probe
[    1.759763] I2S :996
[    1.817310] CLK misc driver init successfully
[    1.869242] m25p80 spi0.0: found gd25q64, expected m25p80
[    1.869444] m25p80 spi0.0: gd25q64 (8192 Kbytes)
[    1.869517] 8 cmdlinepart partitions found on MTD device spi_flash
[    1.869551] Creating 8 MTD partitions on "spi_flash":
[    1.869590] 0x000000000000-0x000000040000 : "bld"
[    1.896270] 0x000000040000-0x000000050000 : "env"
[    1.921226] 0x000000050000-0x000000060000 : "enc"
[    1.949632] 0x000000060000-0x0000002a0000 : "sys"
[    1.976362] 0x0000002a0000-0x000000680000 : "app"
[    2.001175] 0x000000680000-0x0000006f0000 : "cfg"
[    2.029686] 0x0000006f0000-0x0000007f0000 : "mini"
[    2.056291] 0x0000007f0000-0x000000800000 : "share"
[    2.131692] console [netcon0] enabled
[    2.131720] netconsole: network logging started
[    2.176354] fh_rtc fh_rtc.0: rtc core: registered rtc as rtc0
[    2.177280] i2c /dev entries driver
[    2.181064] I2C driver:
[    2.181086]  platform registration...
[    2.181179]  Clock: 15000khz, Standard-mode HCNT:LCNT = 62:74
[    2.181210]  tx fifo depth: 16, rx fifo depth: 16
[    2.196861]  I2C - (dev. name: fh_i2c - id: 0, IRQ #42
[    2.196882]          IO base addr: 0xc29b0000)
[    2.196950] I2C driver:
[    2.196964]  platform registration...
[    2.197053]  Clock: 15000khz, Standard-mode HCNT:LCNT = 62:74
[    2.197086]  tx fifo depth: 16, rx fifo depth: 16
[    2.210066]  I2C - (dev. name: fh_i2c - id: 1, IRQ #43
[    2.210087]          IO base addr: 0xc29b8000)
[    2.300492] ALSA device list:
[    2.300524]   No soundcards found.
[    2.307225] TCP cubic registered
[    2.307266] NET: Registered protocol family 17
[    2.307539] Bridge firewalling registered
[    2.307587] lib80211: common routines for IEEE802.11 drivers
[    2.307618] lib80211_crypt: registered algorithm 'NULL'
[    2.307643] Registering the dns_resolver key type
[    2.307713] VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
[    2.311028] mmc1 power register success!
[    2.311067] Change SD state from STOR_OFFLINE to STOR_OFFLINE
[    2.341258] GMAC driver:
[    2.341279]  platform registration...
[    2.357002] fh_gmac fh_gmac.0: eth0: mixed HW and IP checksum settings.
[    2.357051] fh_gmac fh_gmac.0: eth0: mixed no checksumming and other settings.
[    2.357314]  eth0 - (dev. name: fh_gmac - id: 0, IRQ #14
[    2.357334]          IO base addr: 0xc29d8000)
[    2.442672] gmac_rmii: probed
[    2.442716] eth0: PHY ID 001cc816 at 0 IRQ -1 (0:00) active
[    2.482073] fh_rtc fh_rtc.0: setting system clock to 1970-01-01 00:02:00 UTC (120)
[    2.495831] mmc0: new high speed SDIO card at address 0001
[    2.538461] aes driver registered
[    2.540197] Freeing init memory: 816K
[    2.610334] card0 disconnected!
</code>```

U-Boot commands:

```<code>HKVS # help
?       - alias for 'help'
arc_go  - start application at address 'addr'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootmini- load &    run mini sys
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
fastbootcmd- set boot command
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
format  - format flash except bootloader area
go      - go xxx.bin thru net
go_orig - start application at address 'addr'
gos     - go xxx.bin thru serial
gpio_get- get the direction and value of gpio
gpio_set- config the direction and value of gpio
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loadk   - load kernel to DRAM & verify kernel+app
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
pinctrl - Pin Ctrl
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sleep   - delay execution for some time
sspi    - SPI utility commands
tftpboot- boot image via network using TFTP protocol
upa     - update app image
upapp   - update app image
upb     - update bootloader
upbs    - update bootloader from serial
update  - update digicap.dav
updateb - update bootloader
upf     - update firmware, format and update (factory use)
upk     - update uImage
version - print monitor version
wdt     - WDT utility commands
HKVS #
</code>```

Something to note:

I don't know what passed mtdparts=spi_flash:256k(bld)ro,64k(env),64k(enc)ro,2304k(sys),3968k(ap0 and such stuff to kernel cmdline, but it's definitely not U-boot. Maybe cmdline build-in to kernel?

I can't seem to decompress the kernel to load into IDA

I saw some "mtd" blocks that could be modified using U-boot, but since I'm not sure, I will not modify them until someone gives a proper answer on modify them.

Why U-boot show HKVS? Maybe this is a clone of HKVision camera, or the company Ezviz use SDK from HKVS? Or HKVS is OEM?

UPDATE:

I tried modifying the squashfs and then rewrite it at the same address on the SPI flash, but when the camera boots, it claimed about mismatch checksum, then it drop me to a shell called finsh shell with rt-thread RTOS. I think it's that RTOS's shell. After that, I see a process start downloading firmware from Ezviz server, then write it to flash to revert my edits. I think I can't modify this firmware unless I find a proper way to disable firmware checksum.

Thank you!


问:
How to re-create media file from android sender output stream
I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not.

Ideas like the picture below:

Step 1: I prepared an image with metadata (location, time, etc.)

Step 2: I use an Android app to send the images on Step-1 and try to capture the sender bytes stream.

Step 3: Re-create the image from the bytes stream and check metadata.

I don't have much experience as a reverse engineer so please help me with some ideas or useful tools.

Thank you.


问:
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, paths and so on. Forward and reverse patches are applied to the files present on the Windows installation.

My question: How does Windows determine if a patch is compatible with a file, say we have something like:

```<code><File id="19562" name="amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22621.963_none_ce32ec967d51ffce\f\ntoskrnl.exe" length="524644" time="133144997320000000" attr="128">
  <Hash alg="SHA256" value="62FA6AAD80E7856024D55B0020585E3B1543FF48240EA825A3F3942C05A0DEE1" />
  <Delta>
    <Source type="RAW" offset="127071210" length="524644">
      <Hash alg="SHA256" value="62FA6AAD80E7856024D55B0020585E3B1543FF48240EA825A3F3942C05A0DEE1" />
    </Source>
  </Delta>
</File>
</code>```

From the .psf file, the delta is the part highlighted in yellow (first 4 bytes should be a CRC32, what follows is the actual patch):

Is there any way to retrieve the file ntoskrnl.exe that the patch should be applied on? How does Windows Updates ensure that it's applying patches on the right versions of the files? (I wasn't able to find a digest of the files before patches are applied)


问:
IDA Pro ignores present database with remote debugging
I have a qemu instance running a custom Linux distribution, within which I'd like to debug an (already running) application. I have already embedded a gdbserver inside (and have a root shell available), so I can start it with --attach <pid>. I also have extracted and analyzed the binary I am interested in and have an .idb file for it. However, when I connect to the remote GDB through IDA (via Debugger > Attach to process, and then selecting 0 - the running process), it completely ignores everything in the database. No functions, no comments, nothing. ASLR is disabled, but if somehow still needed, I can provide /proc/<pid>/maps. The question is, how do I inform IDA that the app it's looking at is the same as the database?

If it matters, I'm running IDA Pro 7.5 on Windows


问:
JTAG Version 2.0 or 2.1
I need to identify which device has JTAG Version 2.1 for TI TMS320DM8168CCYG4 (Digital Media Processor). What socket is recommended?</p>

Title: JTAG Version 2.0 or 2.1


问:
Checksum help savedata.bin PS4 Resident Evil 6 (help please)
I need help to calculate the checksum or locate it.

Basically I have a decrypted save of Resident Evil 6 and I tried editing the save's data and it keeps getting corrupted.

Can anyone please help? I did some research but can't find anything helpful. My discord is Yaroshi#3398 if you wanna help further :)!

Any help will be appreciated


问:
Android game reverse http request body
I'm trying to reverse request that are made to an android game to learn more about how it works.

I was able to find endpoints requests that are made with frida and mitmproxy but now I'm stuck because the body of requests looks like encoded and I don't know what to do next.

Example of request I got with mitmproxy :

```<code>Request:

POST /v1/game/heartbeat HTTP/1.1
Content-Type: application/x-protobuf
Accept: application/x-protobuf
Sign: V6E0BcEySdvhWka8qqronw==
Timestamp: 1677850264960
Offset: 576384618343
Token: ***
Accept-Encoding: gzip, deflate, br
Version: 2.0.31.248
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1.1; ONEPLUS A5000 Build/NMF26X)
Host: ****
Connection: Keep-Alive
Cookie: AWSALB=*** AWSALBCORS=***
Content-Length: 76

WWVUPUYlVg5DfGkmJnUtGGcuUW5cfAABRGgiJSMocw1kegE9QnNcc0s2Vks+bidScXcSGx9mGw==

Response:

HTTP/1.1 200 OK
Content-Type: application/x-protobuf;charset=UTF-8
Content-Length: 12
Connection: keep-alive
Date: Fri, 03 Mar 2023 13:31:05 GMT
Set-Cookie: AWSALB=***
Set-Cookie: AWSALBCORS=***
Token: ***
Sign: /n0stA/UOCtSC0BfFDjjvg==
X-Protobuf-Schema: GameLogicProto.proto
X-Protobuf-Message: api.HeartBeatResponse
requestId: 3c2b5566-f863-4390-af82-6aad9551eefb
Offset: 576384618343
X-Cache: Miss from cloudfront
Via: 1.1 ***.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CDG52-P1
Alt-Svc: h3=":443"; ma=86400
X-Amz-Cf-Id: LzO0HrZLu5BkCUfBFEjVfosNnkd2ViDHeFjgkf5Unq0buIoMnVTT_A==

S6q888yuVhkn
</code>```

It looks like body of request are base64 encoded obviously but I can't do anything with decoded body. I think I have to do something with protobuf but I'm a bit lost here.

Someone know what I can do next ? Or a lead to follow ?

Thanks and have a nice day !

Edit: Title typo

Title: Android game reverse http request body


问:
// This file does not contain any Objective-C runtime information
I am trying to reverse engineer a file with class-dump but it says objective-c header is not found. This is clearly an objective C file.</p>
```<code>2023-03-03 22:26:21.789 class-dump[5565:85760] Unknown load command: 0x80000034
2023-03-03 22:26:21.789 class-dump[5565:85760] Unknown load command: 0x80000033
2023-03-03 22:26:21.790 class-dump[5565:85760] Unknown load command: 0x00000032
//
//     Generated by class-dump 3.5 (64 bit).
//
//     class-dump is Copyright (C) 1997-1998, 2000-2001, 2004-2013 by Steve Nygard.
//

#pragma mark -

//
// File: eLS_LogIn
// UUID: 5C4B35BF-16BC-3EB4-BF3A-D28EF2C53CFA
//
//                           Arch: arm64
//                 Source version: 0.0.0.0.0
//

//
// This file does not contain any Objective-C runtime information.
//```
</code>```


问:
Identifying a hash function knowing both input and output
I am creating a custom client for an old game. Now I got stuck on login to the server. I made several experiments with wireshark but it doesn't seem to be any common hashes.
From my limited understanding, it doesn't seem to be salted because the same input gets the same output even if I change my account, device, ip...
Here are some inputs and outputs:

00000 - 5a5ef2

000000 - 9a5af4

0000000 - daacf7

11111 - 763443

01010 - 0660bf

22222 - 82eff1

123123123123 - 368188

password - 8606df

☺☺☺☺☺ - e27952


问:
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and family, and I was hoping that someone could give me a comparison of them, explaining the similarities and differences, which ones are outdated / obsolete, which are most popular, which are more well suited to certain tasks, etc.

Specifically, the Windows debuggers I have heard of and am most interested to learn more about are:

WinDbg

OllyDbg

Immunity Debugger

x32dbg / x64dbg

If there are any other debuggers that I didn't mention above that you feel should be part of the comparison, please feel free to include it in your answer.

Title: Comparison of Windows Debuggers


问:
Input file (Hello_World) is neither a Mach-O file nor a fat archive: Class-dump
I am trying to use class-dump in iPhone 14.3. However, there is an error. Can you advise?</p>
```<code>ANT-iPhone:/var/containers/Bundle/Application/61669A90-8CF9-4991-943F-5E9F097A3A5B/Hello_World.app root# otool -Vh Hello_World

Hello_World:
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags

MH_MAGIC_64   ARM64        ALL  0x00     EXECUTE    24       2840   NOUNDEFS DYLDLINK TWOLEVEL PIE

ANT-iPhone:/var/containers/Bundle/Application/61669A90-8CF9-4991-943F-5E9F097A3A5B/Hello_World.app root# class-dump Hello_World

2023-03-05 19:46:00.418 class-dump[8334:2699202] === SSL Kill Switch 2: Preference set to 1.
2023-03-05 19:46:00.425 class-dump[8334:2699202] We don't support 64-bit Mach-O files.

class-dump: Input file (Hello_World) is neither a Mach-O file nor a fat archive.
</code>```


问:
db section in hopper
There is a db section in hopper, which cause the code not being able to go to control follow graph mode
Do advise what cause this issue:

```<code>
        ; Section __cstring
        ; Range: [0x10000a2c0; 0x10000a4d5[ (533 bytes)
        ; File offset : [41664; 42197[ (533 bytes)
        ; Flags: 0x2
        ;   S_CSTRING_LITERALS

                     aViewcontroller:
000000010000a2c0         db         "ViewController", 0                         ; DATA XREF=cfstring_ViewController
                     aStrongpwd123:
000000010000a2cf         db         "StrongPwd123", 0                           ; DATA XREF=cfstring_StrongPwd123
                     aWrongPassword:
000000010000a2dc         db         "WRONG PASSWORD", 0                         ; DATA XREF=cfstring_WRONG_PASSWORD
                     aError:
000000010000a2eb         db         "ERROR", 0                                  ; DATA XREF=cfstring_ERROR
                     aOk:
000000010000a2f1         db         "Ok", 0                                     ; DATA XREF=cfstring_Ok
                     aAdminviewcontr:
000000010000a2f4         db         "AdminViewController", 0
</code>```
```<code>//
//  ViewController.m
//  eLS_LogIn2
//
//  Created by litsnarf on 10/20/13.
//  Copyright (c) 2013 litsnarf. All rights reserved.
//

#import "ViewController.h"
#import "AdminViewController.h"

@interface ViewController ()

@end

@implementation ViewController

@synthesize password;

@synthesize pwd;

- (void)viewDidLoad
{

    pwd = @"StrongPwd123";
    [super viewDidLoad];
    // Do any additional setup after loading the view, typically from a nib.

}
</code>```

Here is the actual implementation of the code

Title: db section in hopper


问:
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not one of the operands for this instruction. As an example, let's take rlc instruction:

```<code>rlc A
</code>```

It basically rotates A left with Carry (C). C is part of STATUS register (just one bit). I cannot modify anything within the ev_ana_insn callback as per IDA Pro documentation, so it looks like that:

```<code>def ev_ana_insn(self, insn):
    if b == 0x67:  # rlc
        insn.size = 1
        insn.itype = self.itype_rlc
        insn.Op1.type = ida_ua.o_reg
        insn.Op1.reg = self.ireg_A
</code>```

That's fine. But in ev_emu_insn I don't understand how and where should I modify the STATUS register, since it is missing (and shouldn't be there in the first place) from insn.

I had a couple of thoughts, but they are not good enough in my opinion:

Use auxprefs in insn or specvals in Op1 and save the information about needed changes to the STATUS register. But still, I need to make these changes and track them somewhere during the analysis and emulation stages.

Map the STATUS register to RAM segment and modify it there. Here as example of such an implementation: https://github.com/Treeki/TM155-tools/blob/master/ida-module/ht68fb560.py#L470, but I don't know if it's the correct approach.

Put another Op2 in my insn, assign it to the STATUS register and modify it during the emulation stage. However, this approach breaks the whole disassembler, since it expects 2 operands, but really there is only 1. I can play around with that during the output stage, but I don't think that it is a correct approach and is more like a hack.

So, any input is much appreciated.


问:
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the debugger when to open that file with IDA Pro.

This is becoming a problem, because for example right now I have a manually mapped driver with no header dumped and analyzed, and as you can guess, I cannot debug it with IDA pro's windbg.. I have to open another instance of IDA pro, and attach it to the kernel using IDA pro's windbg, and obviously this causes me to not be able to debug it using the analyzed IDB file.

How can I overcome this? How can I tell IDA pro to please just understand that you should treat this file as a normal PE file and let me just select the damn windbg as the debugger? This is funny because I can just open an instance of IDA pro and attach it to the kernel using IDA's windbg, but when I open my IDB file, then windbg is no longer there to select...

Tried it with the latest 7.7 version and this problem is still there. Right now I just have to make a fake PE header (driver) every time I have to do this, but there has to be a better way.


问:
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:

```<code>mov     rax, cs:KeDelayExecutionThrea
lea     r8, [rsp+28h+arg_0]
xor     edx, edx
xor     ecx, ecx
call    cs:trampolineFunction_Address
</code>```

and:

```<code>trampolineFunction_Address dq offset trampolineFunction

trampolineFunction proc near
jmp     rax
trampolineFunction endp
</code>```

So it just pushes the destination function in rax, and calls this trampolineFunction indirectly using call    cs:trampolineFunction_Address.

The problem is, in the decompiled output, every call is now shown as trampolineFunction_Address( ... ) :

```<code>if ( trampolineFunction_Address(&v34, 1i64, &v22, v31, 0i64, v13, v16) >= 0 )
        {
          *&v20 = trampolineFunction_Address(v7, v6, v8, v9, v11, v14, v17);
          if ( trampolineFunction_Address(&v33, 64i64, &v27, &v20, v12, v15, v18) >= 0 )
...
</code>```

So how can I make IDA's decompiler to show me the correct function name?

Note that for example, KeDelayExecutionThread in above assembly is basically the address of KeDelayExecutionThread, which this rootkits resolves during initialization and puts it in its data section, and as you can see after I renamed that address to that, IDA correctly knows the function definition:

```<code>.data:FFFFF80019E5F000 ; NTSTATUS (*KeDelayExecutionThread)(KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Interval)
.data:FFFFF80019E5F000 KeDelayExecutionThread dq 0FFFFF8001A2CFB30h
</code>```


问:
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to Solve this.
I have seen sandbox reports in those the file is running fine but in my IDA this error showed anyone knows why
and how to resolve</p>

Title: IDA pro Error how to resolve this error


问:
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.

What I have so far is a script that gets a list of files from an input folder and saves the list into a file, then I read the file line by line for each input file I want to process. My problem comes here, It seems I can't use loadfile() when I do not have a database opened, ready to receive the file, and when I try to load the file with a database opened and a loaded file I don't get any result back!

Is there a way to create an empty database via IDC script (free version)?

Is it even possible to process a large number of files in a folder programmatically one by one without using command line switches, as it seems I can't get IDA freeware to recognize any of the switches I use in the Kali terminal?

I am not even sure that I am using the correct arguments for the loadfile() function, if I want to load the whole file, what should I fill in as the pos parameter? 0?

And for the size how do I get file size from within IDC script?

Any answer to those questions would help greatly.


问:
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific kernel comes with an embedded initramfs which makes it all a lot more complicated. Worse still, all I have is a binary image, so recompiling is not possible. Binwalk describes the kernel structure as follows:

```<code>Microsoft executable, portable (PE)

gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)

Object signature in DER format (PKCS header length: 4, sequence length: 1509

Certificate in DER format (x509 v3), header length: 4, sequence length: 769
</code>```

Extracting and modifying the embedded initramfs is pretty straightforward - the second section of the kernel (as per binwalk output above) is a gzipped vmlinux which I can extract either using extract-vmlinux or by manually dding the .gz archive out of the kernel image and then extracting it with gunzip. The last section of resulting vmlinux is a gzipped cpio archive with initramfs I intend to modify. Unfortunately, sticking it all back together (with a great care taken to keep the unmodified fragments of the original kernel image intact) renders the kernel unbootable. Here's a more detailed description of my approach:

with dd, I separate the original kernel image into 3 parts: stuff before the gzipped vmlinux (call it a KERNEL_HEADER), the gzipped vmlinux, and stuff after it (call it a KERNEL_TRAILER).

I extract vmlinux from the middle part using gunzip.

like in step 1 above, I use dd to separate vmlinux into 3 parts: stuff before the gzipped cpio archive (call it a VMLINUX_HEADER), the gzipped cpio archive with initramfs, and stuff after it (call it a VMLINUX_TRAILER).

I extract the cpio archive from the middle part using gunzip, then extract initramfs from it using cpio and modify it according to my needs.

I embed modified initramfs into a new cpio archive and gzip it.

I concatenate VMLINUX_HEADER, new gzipped cpio archive and VMLINUX_TRAILER to recreate vmlinux.

I gzip new vmlinux.

I concatenate KERNEL_HEADER, new gzipped vmlinux and KERNEL_TRAILER into a new kernel image which, unfortunately, fails to boot.

Side notes:

I'm aware of the fact that .gz archive can have trailing bytes appended to it and still get extracted correctly to produce the desired result. Since such bytes would be discarded by gunzip as "trailing garbage", I took extra care to separate both .gz archives from surrounding bytes in such a way as to avoid any redundancy - after all, those "trailing garbage" bytes are part of the kernel and can't simply be discarded. I did that by searching for ISIZE members at the end of each archive. I naively assumed that if I'd modify only the .gz archives and then prepend and append exactly the same data blocks they were originally attached to to them, I'd end up with a new working kernel. Unfortunately, it doesn't seem that simple.

while experimenting I noticed that mere gunzipping a gzipped vmlinux and gzipping it back again is enough to destroy the kernel image - unless the new .gz archive has exactly the same contents (or at least the same length) as the original one, prepending and appending the aforementioned KERNEL_HEADER and KERNEL_TRAILER to it, respectively, results in a new, unbootable kernel. This holds true even if old and new .gz archives have identical payload bytes and differ only by metadata. Depending on exact difference between old and new .gz archives, the following invocation:

```<code>qemu-system-x86_64 -kernel <NEW KERNEL IMAGE FILE>
</code>```

results either in a freeze or an infinite boot loop with a "Booting from ROM..." message displayed in both cases.

My wild guess is that even a slight change in gzipped vmlinux data layout confuses the kernel decompression routine located earlier in the image. Is there a simple way to fix it by means of a raw binary edit? I don't have a detailed knowledge of Linux kernel internal structure (I do know about piggy.o and other object files a kernel image consists of, but a serious research is still ahead of me). I'm ready to learn, but I hope someone more experienced will at least point me in the right direction. My question boils down to: how to safely embed a (possibly modified) vmlinux back into its corresponding kernel image? Any help will be appreciated.