问:
Hooking an interface method with Frida in an Android application
I'm trying to understand what an android application is sending over the network and as such am trying to hook into it with Frida, specifically a method called storeKeys .

I was able to perform the Android tutorial from Frida's website, so I know it's working. But when I issue this command, it tells me it hooked 0 functions:

```<code>frida-trace -U -i storeKeys com.vendor.app
</code>```

I thus fired up apktool to get a readable set of source files and I could find storeKeys in two places. The first is the place where it gets called:

```<code># virtual methods
.method public a(Ljava/lang/String;)I
    .locals 2

    const-string v0, "jwtToken"

    invoke-static {p1, v0}, Lkotlin/e/b/i;->b(Ljava/lang/Object;Ljava/lang/String;)V

    .line 20
    invoke-virtual {p0}, Lcom/vendor/alljoynbridge/provisioning/f;->getProxyObject()Lorg/alljoyn/bus/ProxyBusObject;

    move-result-object v0

    const-class v1, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;

    invoke-virtual {v0, v1}, Lorg/alljoyn/bus/ProxyBusObject;->getInterface(Ljava/lang/Class;)Ljava/lang/Object;

    move-result-object v0

    check-cast v0, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;

    .line 21
    invoke-interface {v0, p1}, Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;->storeKeys(Ljava/lang/String;)S

    move-result p1

    return p1
.end method
</code>```

The second appears to be its declaration:

```<code>.class public interface abstract Lcom/vendor/alljoynbridge/provisioning/ProvisioningMediationTransport;
.super Ljava/lang/Object;
.source "ProvisioningMediationTransport.java"

# interfaces
.implements Lorg/alljoyn/bus/BusObject;

# annotations
.annotation runtime Lorg/alljoyn/bus/annotation/BusInterface;
    announced = "true"
    name = "com.app.standard.infrastructure.api.device.mediation.client"
.end annotation

.annotation runtime Lorg/alljoyn/bus/annotation/Secure;
.end annotation

# static fields
.field public static final INTERFACE_NAME:Ljava/lang/String; = "com.app.standard.infrastructure.api.device.mediation.client"

.field public static final OBJ_PATH:Ljava/lang/String; = "/Provisioning"

# virtual methods
.method public abstract storeKeys(Ljava/lang/String;)S
    .annotation system Ldalvik/annotation/Throws;
        value = {
            Lorg/alljoyn/bus/BusException;
        }
    .end annotation

    .annotation runtime Lorg/alljoyn/bus/annotation/BusMethod;
        replySignature = "n"
        signature = "s"
    .end annotation
.end method
</code>```

What I'm most interested in seeing is the content of the String parameter given to storeKeys

It seems that because the method is virtual abstract, there is nothing for Frida to hook into.

What have I missed here?

What would you suggest that I try next?


问:
Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles
I have a weird bug that causes this crap:

There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to cache icon for Vivaldi. I confirmed it by checking cache data at:
%localappdata%\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\
It contains 3 binary files:

```<code>TileCache_125_3_PNGEncoded_Data.bin
TileCache_125_3_PNGEncoded_Header.bin
StartUnifiedTileModelCache.dat
</code>```

For us, only TileCache_125_3_PNGEncoded_Data.bin and TileCache_125_3_PNGEncoded_Header.bin are relevant.

WHAT I KNOW

[TileCache_125_3_PNGEncoded_Data.bin]
Contains raw binary PNG data in chunks, smallest chunk seems to be 1024b, padded with 0 if PNG data is smaller than chunk size. If PNG data is bigger than chunk size it is expanded by 2x i.e. becomes 2x by 1024 - 2048 and so on. Probably optimized for binary reading. Extracting all PNG data reveals it is missing exactly that one Vivaldi icon.

[TileCache_125_3_PNGEncoded_Header.bin]
The layout is also fairly simple, first 40 bytes is some header/meta data, 4bytes integer at offset 12 describes amount of entries, in my case 18, but should be 19. After the header, there are entries itself, 18 entries, each 112 bytes:

Highlighted in red are: [offset], [all chunks size], [padding size] and [height]x[width]

WHAT I DONT KNOW

The data highlighted in blue is unknown to me, but I'm fairly sure it is somehow describes the relation between cache entry and the Start Menu tile. I assume some of them might be GUIDs, especially 16bytes long ones, but quick search for these guides in Registry resulted in nothing.

Knowing how that relation works could help me to manually insert the entry and fix this shit.

Or I could reinstall whole system like a buffon, yes.

ContentLicense: CC BY-SA 4.0


问:
LIN bus frame replacement
I am searching for a way to replace certain frames on a LIN bus network. My aim is to be able to intercept a frame in transmission, and change certain bits. Naturally, that involves recalculating the checksum.

The problem I encounter is that after a bit is overwritten on the bus, the transmitting device stops sending data, as it senses the discrepancy on the bus and assumes there's a collision. Is there a way to overcome that behavior?

Title: LIN bus frame replacement


问:
When sampling the call stack, what is the point of grouping it just because the function addresses are close?
https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times-by-70/

Normally Luke would group the same functions together but since I don’t have debugging symbols I had to eyeball nearby addresses to guess if it’s the same place. And what do we see? Not one bottleneck but two of them!

Why does it make sense to group them together just because they are close?


问:
Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?
I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs correctly on my 64bit ubuntu machine however when I load it into radare2 I don't get the same disassembly result as the tutorial.
An example is this portion of the "main" function:

On my machine the argc and envp are not displayed as main's arguments:

```<code>int main (char **argv);
           ; var uint32_t var_ch @ ebp-0xc
           ; var int32_t var_4h @ ebp-0x4
           ; arg char **argv @ esp+0x34
           0x08048424      8d4c2404       lea ecx, [argv]
           0x08048428      83e4f0         and esp, 0xfffffff0
</code>```

While on the tutor's version not only are those parameters displayed, but the effective address loaded into ecx is that of the "argc" instead of "argv" as is the case on my code:

```<code>main (int argc, char **argv, char **envp);
           ; var unsigned int local_ch @ ebp-0xc
           ; var int local_4h @ ebp-0x4
           ; arg int arg_4h @ esp+0x4
           ; DATA XREF from entry0 (0x8048327)
           0x08048424      8d4c2404       lea ecx, [arg_4h]           ; 4
</code>```

My question is, how can I fix this issue and get the correct disassembled code on radare2 and why won't radare2 find the main's parameters?


问:
Symbolic gloabal variables in angr
I am learning angr and for that I wrote a code containing two global variables.

```<code>char pwd[8];
char flag[16];
int main()
{
        printf("\n\nEnter your password and the flag: ");
        validator();
        return 0;
}
void validator()
{
        scanf("%s %s",pwd,flag);
        printf("\nThank You\n");//want to start the symbolic execution from here
        cipher_function();//works on pwd
        shuffle_function();//works on flag
        ...
       }
</code>```

and here is the solution script:

```<code> project = angr.Project(path_to_binary)

  start_address = 0x004011BB
  initial_state = project.factory.blank_state(addr=start_address)

  initial_state.regs.rbp = initial_state.regs.rsp
  initial_state.regs.rdx = 0x00404080
  initial_state.regs.rsi = 0x00404070

  pwd = claripy.BVS('pwd', 8*8)
  flag = claripy.BVS('flag',16*8)

  initial_state.memory.store(0x00404070, pwd)
  initial_state.memory.store(0x00404080, flag)

  simulation = project.factory.simgr(initial_state)

</code>```

Finally, the angr output is:

```<code>WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING | 2021-03-02 08:11:19,750 | angr.storage.memory_mixins.default_filler_mixin | Filling register cc_ndep with 8 unconstrained bytes referenced from 0x40125e (cipher_function+0x2d in out2 (0x40125e))
</code>```

can anyone please take a look and help me find what I am doing wrong.
Thank you

Title: Symbolic gloabal variables in angr


问:
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename identifiers to be in compliance with the compilers standard.

I looked at the Hex-Rays SDK but I gave up at the point there was a comment in the headers stating that deleting local variables would require to fix-up references.

Maybe there is a way to aid the decompilation process instead of trying to apply fixups later. Or maybe it wouldn't be so scary to transform all the locals into a structure. Has anyone attempted something similar before?


问:
Is this a checksum/CRC response or cryptography?! Thanks
I've been pointed here from the Cryptography Stack Exchange so hopefully you can help me here!

Long version of the story at the end....the short version is...

I want to identify this CRC/cipher/crypto and then I'll code it in C.

It's a challenge and response based exchange; a 4 byte challenge, and 4 byte response. They both change each time the exchange is carried out. Here's a real example

```<code>    12   35   5B   74
    00010010    00110101    01011011    01110100    Challenge
    00111000    10010000    00001001    10110101    Response
    38 90 09 B5
</code>```

I'm able to feed it challenges and observe the responses without penalty - so I have this data too

```<code>    00  00  00  00
    00000000    00000000    00000000    00000000    Challenge
    10110101    00100000    01100011    10111011    Response
    B5  20  63  BB

    FF  FF  FF  FF
    11111111    11111111    11111111    11111111    Challenge
    11010101    00010000    10100001    00011110    Response
    D5  10  A1  1E
</code>```

If anyone can break/hack this for me I'll love you forever etc etc

Thanks Joe

Long version The exchange happens between the engine control module, the instrument pack, and the body control module in my car...it takes place over the CAN networks and authorises the engine control module to start the engine. I really want to use this engine in a project car but need to get rid of this immobilisation issue (and body controller and instrument pack too) first.


问:
How to replace a segment with a single structure consisting of the data in that segment - programmatically?
So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then recreating the stack frame as a single variable with the new struct type):

```<code>ea_t currea;

    for (auto i : ranges::iota_view{ (size_t)0, get_segm_qty() })
        if (auto segment = getnseg(i); segment->type & SEG_DATA) {
            currea = segment->start_ea;

            auto newstructid = add_struc(BADADDR, nullptr);

            auto newstruct = get_struc(newstructid);

            struc_error_t strucerr;

            do {
                strucerr = add_struc_member(newstruct, /*name*/, currea, /*flags*/, /*member info*/, /*size*/);
            } while ((currea = next_head(currea, segment->end_ea)) != BADADDR);
        }
</code>```

Anyone can help me fill the blanks. I need to get information about the current head such as type and name.


问:
SSL pinning and bypass
I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I assumed, app itself doesn't use system proxy settings so trying to MITM it with Fiddler was a failure because requests weren't present in the window over there. I assumed that app doesn't accept system default proxy server settings but rather just using default NIC and not using any loopbacks which MITM softwares such as Fiddler relay on. I found out that app was written in C# and I tried reverse engineering it and noticed this interesting function which seems to do SSL pinning

```<code>internal bool method_2(
    HttpRequestMessage httpRequestMessage_0,
    X509Certificate2 x509Certificate2_0,
    X509Chain x509Chain_0,
    SslPolicyErrors sslPolicyErrors_0)
  {
    return x509Certificate2_0.Thumbprint == "32WQEE518D60E0A21D56BFBC3CDFB28701710C"
  }
</code>```

It seems that upon SSL handshake it checks for certificate and if it doesn't match this thumbprint it just declines connection. I want to understand what are my options on trying to sniff packages and see its content?

I understand I can do following:

Sniff traffic via Wireshark and intercept TLS ciphersuit configs, key exchange and just manually take the data and try to decrypt.

Placing return true before checking validity of certificate using debugger (dnSPY or similar IL c# decompilers / debuggers)

Is there something more I can try and what could be potentially best way to get incoming and outcoming data from this app?

Title: SSL pinning and bypass


问:
x64dbg & Ghidra change combobox properties app in Visual C++ MFC
Hello in the program code the property combobox is changed from enable to disable I would like to change that the program does not change this property. I have found commands that assign new items to combobox then the code suddenly enters the user32.dll module and after exiting it the property is changed. I think some value is passed to this user32.dll that defines the property change. Could someone please guide me on how to find the piece of code responsible for the property change? The program is written in Visual C++ MFC. I used x64dbg and Ghidra.</p>


问:
Reversing Windows binary to find where the error is with Ollydbg
I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).

The problem now is on a Windows program. I start it up but after a few seconds a popup appears with the message "You are not connected to the Internet", although I am regularly connected to the Internet. I am trying to parse the assembly code and debug with OllyDbg. First I searched for the string "You are not connected" but I didn't find it anywhere. On closer analysis, I found that the error popup appears when the eip is inside the ntdll dll library and sometimes win32u. I am attaching two screenshots to explain myself better. How do I know where the problem lies? Is it correct to say that the problem lies within a dll? Thank you

With your help, I found the function that calls the MessageBox. But unfortunately I think it is part of a very long loop and it is difficult for me to be able to identify the problem. I was noticing, that when the program starts, the ASCII string "Error writing temporary file .." is loaded. Does it correspond to an allocated variable or is it a message I should see when I start the program? Maybe that's the problem


问:
How to apply complete type information from PDB for multiple images in one IDA database?
IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top of that the PDB files ntdll.pdb and kernel.pdb have been loaded using File -> Load file -> PDB file... with specifying the address of the respective image base.

It's working quite well, e. g. all the functions and symbols are visibly and usable. Nevertheless, some type information are missing. Most importantly: correct function declarations and argument types.

Here's what the decompiler gets me when using the approach described above for an example function RtlUnwindEx:

```<code>__int64 __fastcall ntdll_RtlUnwindEx(int a1, int a2, int a3, int a4, __int64 a5, __int64 a6);
</code>```

However, this is how it looks like when analyzing ntdll.dll in its own database and applying the PDB accordingly:

```<code>void __stdcall RtlUnwindEx(PVOID TargetFrame, PVOID TargetIp, PEXCEPTION_RECORD ExceptionRecord, PVOID ReturnValue, PCONTEXT ContextRecord, PUNWIND_HISTORY_TABLE HistoryTable);
</code>```

Why is IDA not correctly determining the function declaration/argument types in the multi-image database even though the information should be there?

Additional information:

Settings under Options -> Compiler options in the multi-image database have been adjusted to match what the settings are for the single ntdll.dll database

Working with 64-bit images here

The Reanalyze program action has been executed after loading all PDB files


问:
Radare2 is showing weird disassembly as compared to disassembly of gcc
Today i was playing around with c code in r2.
I compiled a file which had the following code.

```<code>#include <stdio.h>

int main(){
        int a=9;
        float b=1.1;
        int sum;
        sum = a+b;
        printf("%d", sum);
        return 0;
</code>```

When I compiled it with gdb with the -S option, the assembly code that I got was normal, it had call to printf, some floating operations everything normal, but when I loaded it to r2 and runned aaa then pdf @main, it showed weird assembly which had no call to printf, only a single floating operation. I don't know why is it happening. If anyone of you can explain me, It would be great.
Here is the weird disassembly :

```<code>┌ 108: int main (int argc, char **argv, char **envp);
│           0x00402070      83ec1c         sub esp, 0x1c
│           0x00402073      8b442420       mov eax, dword [esp + 0x20]
│           0x00402077      c744240c801f.  mov dword [esp + 0xc], 0x1f80 ; [0x1f80:4]=-1
│           0x0040207f      83f8fd         cmp eax, 0xfffffffd
│       ┌─< 0x00402082      7431           je 0x4020b5
│       │   0x00402084      83f8fc         cmp eax, 0xfffffffc
│      ┌──< 0x00402087      743a           je 0x4020c3
│      ││   0x00402089      85c0           test eax, eax
│     ┌───< 0x0040208b      7448           je 0x4020d5
│     │││   ; CODE XREF from main @ 0x4020da
│    ┌────> 0x0040208d      83f8ff         cmp eax, 0xffffffff
│   ┌─────< 0x00402090      742d           je 0x4020bf
│   │╎│││   0x00402092      83f8fe         cmp eax, 0xfffffffe
│  ┌──────< 0x00402095      7436           je 0x4020cd
│  ││╎│││   0x00402097      d920           fldenv [eax]
│  ││╎│││   0x00402099      0fb7401c       movzx eax, word [eax + 0x1c]
│  ││╎│││   0x0040209d      8944240c       mov dword [esp + 0xc], eax
│  ││╎│││   ; CODE XREFS from main @ 0x4020c1, 0x4020d3
│ ┌───────> 0x004020a1      f60524704000.  test byte [0x407024], 0x10  ; [0x407024:1]=0
│ ────────< 0x004020a8      7405           je 0x4020af
│ ╎││╎│││   0x004020aa      0fae54240c     ldmxcsr dword [esp + 0xc]
│ ────────> 0x004020af      31c0           xor eax, eax
│ ╎││╎│││   0x004020b1      83c41c         add esp, 0x1c
│ ╎││╎│││   0x004020b4      c3             ret
│ ╎││╎││└─> 0x004020b5      c70514404000.  mov dword [0x404014], 0xffffffff ; [0x404014:4]=-1
│ ╎│└─────> 0x004020bf      dbe3           fninit
│ ────────< 0x004020c1      ebde           jmp 0x4020a1
│ ╎│ ╎│└──> 0x004020c3      c70514404000.  mov dword [0x404014], 0xfffffffe ; [0x404014:4]=-1
│ ╎└──────> 0x004020cd      ff159c814000   call dword [0x40819c]
│ └───────< 0x004020d3      ebcc           jmp 0x4020a1
│    ╎└───> 0x004020d5      a114404000     mov eax, dword [0x404014]   ; [0x404014:4]=-1
└    └────< 0x004020da      ebb1           jmp 0x40208d
</code>```


问:
Referenced Memory in runtrace for OllyDBG 1.x
I wanted to know if there is any way I could get the referenced memory in the run trace?
I tried using OllyDBG 2.x but it doesnt seem to work.</p>


问:
Editing assembly language to bypass the condition
I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this condition?

Here is the condition (if statement)

And here is ASM code

I was trying change the HEX from
83 F8 FF
to
83 F8 01
but application crashes.

I don't want crack anything, i want remove version checked because library is older than actual game version


问:
Where to start analyzing a 16 bit dos program?
I've tried to analyze this small exe online.

I've tried with https://onlinedisassembler.com/odaweb/ (link) but it's hard for me to get the first question:

Why the tool doesn't try to detect the set of instruction by itself? Dos program could run on architectures different from x86? The base address wasn't the same for every dos program?

I tried also with IDA Free, but it says there are tons of problems

I also tried with radare2 but it's really hard for me..

```<code>I've found this info through virustotal:
File type   DOS EXE
Magic   MS-DOS executable, MZ for MS-DOS
TrID    EXEPACK compressed DOS Executable (68.2%)
TrID    Clipper DOS Executable (10.5%)
TrID    Generic Win/DOS Executable (10.5%)
TrID    DOS Executable Generic (10.4%)
TrID    VXD Driver (0.1%)
File size   63.16 KB (64680 bytes)
</code>```

EDIT: thanks to the advice I used radare + a graphical interface called Cutter. It seems to work properly but I can't understand how to export the whole pseudocode


问:
exports kernel Windows for informations on hardware
Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel mode modules to get the PC hardware ID. It seems that game programs use such approaches for deanonymization...</p>


问:
Can I ignore this Ghidra USTACK var?
I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can safely ignore this output.

Machine Code + ASM:

```<code>...
1800170da    8b fa           - MOV EDI, EDX
1800170dc    48 8b d9        - MOV RBX, RCX
1800170df    ba 01 00 00 00  - MOV EDX, 1
1800170e4    3b fa           - CMP EDI, EDX
1800170e6    75 05           - JNZ some_label
1800170e8    e8 a7 d2 00 00  - CALL some_function
some_label:
1800170ed    8b d7           - MOV EDX, EDI
...
</code>```

What I think this should equate to:

```<code>if (param_2 == 1) {
    some_function(); // function definition and args don't matter
}
</code>```

What Ghidra gives:

```<code>if (param2 == 1) {
    uStack47 = 0x1800170ed;
    some_function();
}
</code>```

Since this uStack47 looks like it's just the EIP value after some_label I'm not sure why ghidra would even bother showing this. As far as I can tell you would just "fall through" the control statement right into the label with EIP incrementing as normal. Is this just a case of decompilers being not very good?

Title: Can I ignore this Ghidra USTACK var?


Title: How do I decode or decompile this class It seems codes are encrypted?

Body:
I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions.

Code:

```<code>public class \ua6ad\ua6ad\ua6b3\ua6ae extends GuiScreen
{
    public ArrayList<\ua6ae\ua6b3\ua6b3\ua6ad> \ua6b2\ua6ad\ua6ae\ua6b0;
    public static final boolean \u2006\u2009\u2003\u2003\u2009\u2003\u200c;

    public \ua6ad\ua6ad\ua6b3\ua6ae() {
        final boolean \u2006\u2009\u2003\u2003\u2009\u2003\u200c = \ua6ad\ua6ad\ua6b3\ua6ae.\u2006\u2009\u2003\u2003\u2009\u2003\u200c;
        if (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c && !\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
            this.\ua6b2\ua6ad\ua6ae\ua6b0 = new ArrayList<\ua6ae\ua6b3\ua6b3\ua6ad>();
            if (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c && !\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                int n = (int)((long)(-81003269) ^ (long)(-81003266));
                if (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c && !\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                    final \ua6af\ua6ae\ua6ad\ua6ad.Category[] \ua6af\ua6ae\ua6ad\ua6b3;
                    final int length = (\ua6af\ua6ae\ua6ad\ua6b3 = \ua6af\ua6ae\ua6ad\ua6ad.Category.\ua6af\ua6ae\ua6ad\ua6b3()).length;
                    if (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c && !\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                        int n2 = (int)((long)(-163476696) ^ (long)(-163476696));
                        if (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                            while (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                if (n2 < length && !\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c || \u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    final \ua6af\ua6ae\ua6ad\ua6ad.Category category = \ua6af\ua6ae\ua6ad\ua6b3[n2];
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c || \u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    final \ua6ae\ua6b3\ua6b3\ua6ad \ua6ae\ua6b3\ua6b3\ua6ad = new \ua6ae\ua6b3\ua6b3\ua6ad(category);
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c || \u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    \ua6ae\ua6b3\ua6b3\ua6ad.\ua6ae\ua6b1\ua6b1\ua6ae(n);
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c || \u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    this.\ua6b2\ua6ad\ua6ae\ua6b0.add(\ua6ae\ua6b3\ua6b3\ua6ad);
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c || \u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    n += \ua6ae\ua6b3\ua6b3\ua6ad.\ua6b1\ua6b0\ua6ae\ua6b1() + (int)((long)1900478814 ^ (long)1900478815);
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c || \u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    ++n2;
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        break;
                                    }
                                    if (\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        throw null;
                                    }
                                    continue;
                                }
                                else {
                                    if (!\u2006\u2009\u2003\u2003\u2009\u2003\u200c) {
                                        return;
                                    }
                                    break;
                                }
                            }
                        }
                    }
                }
            }
        }
    }
</code>```


问:
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module  SuppressIldasmAttribute? feel free to cringe at my questions. and thank you to anyone that takes the time to help. here is some of the code from dotpeek so you can see what I'm getting back.

// Decompiled with JetBrains decompiler
// Type:
// Assembly: rgdfgdfg, Version=1.9.2.1, Culture=neutral, PublicKeyToken=null
// MVID: 59450446-F2C7-4225-B831-8B4909494F7E
// Assembly location: C:\Users\ryank\Desktop\Malware_Samples\PastebinPayload\HWWKFile.exe

using System;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;

internal class \u003CModule\u003E
{
private static byte[] ѢﬧѡﬦﬣﬧשׁﬨשׁѠѠѡשׁѠѣﬨѡѣѡѤﬧﬠﬣﬣѢѡѡﬤѡﬨѠѣﬥѠﬤ\uFB29ﬨﬤﬣﬡbnlVMImALUAXucSYKZSYsqgmdhsGA\u007B\u007B_\u0029V15r\u003C\u0021kLW\u003ENdX\u003C\u0024\u007D\u0022\u003C\u005Bo\u002B;
static \u003CModule\u003E.ѥﬥѡѠﬠѥﬣﬣﬥﬨﬠﬡ\uFB29ѥﬣﬢѠѢѢﬠﬦѠﬢѥѥѥﬢѤﬤﬦѤﬠﬣﬧѠ\uFB29\uFB29שׁﬡflxShkcwFFVAPdOfCzepHwOVWfaE\u002433\u0040o\u0022\u003BFv6\u002Bg\u002B6\u007C5sp9wD\u007EyC ﬣѤﬦﬢѢѢѡﬤﬣﬧﬢﬠѣﬠѢﬤﬠѠשׁѠ\uFB29ѥ\uFB29ѠﬧﬣﬢﬦﬧﬨﬣﬢﬡﬡѥﬡﬥﬤﬥﬡfQscSDUEIJNhHvHHiWXFWeKtNFvskUWP\u0027N\u0024\u003E\u003FL\u003D1\u002B_\u005E\u003Eh6XGD\u005Bg\u0026; internal static byte[] ѣﬠѤѢѠﬤשׁשׁﬡѣѢ\uFB29ﬨﬢѤשׁﬤﬣﬢѤﬡﬣ\uFB29Ѥ\uFB29ﬦѠﬤѡﬡﬡѣשׁﬢѣﬠﬢﬠﬨbssMtdECXrgBvOIKMujEzlplcZvmY\u003A\u007D\u007CSJa\u007C9\u002D12ML4IT\u005Esq5\u0021YL\u0022; internal static \u003CModule\u003E.ﬤ\uFB29\uFB29ﬦѠﬣﬣѥﬤﬨﬨѠѥﬦﬡѥѢﬦѣѢѣѣﬤ\uFB29שׁѡѣﬦﬡﬣﬧﬧѤﬥѥﬢѥﬡ\uFB29wEbxdRjWoqHCDKlqKsLbdJbFAixR\u0020s\u002A7L\u003B\u005D572l\u003F\u0029wv\u0021F\u007BMeZ\u0028\u0028Q\u0023 ﬠѠﬦﬤﬢﬦѢﬥﬨѢﬡﬠѢﬦﬧﬥﬠѢﬥѤ\uFB29ѠﬨשׁﬢѤﬢѥ\uFB29ﬧѥѤשׁﬦﬥѤﬢѣשׁWztnNkAwNHFRaniAlRkFgHLlyuvkPJ9m\u003DJW\u00254\u007E\u003Bg3d7b\u003C\u005B\u003FPKKgi\u0021; internal static Assembly ѥﬨѤﬡﬥﬡﬤﬨѢﬠѣѢѥﬤﬧѥﬡﬦѣﬧﬢﬠѠﬠѢﬡ\uFB29ѤﬥﬥﬢѢѠﬧﬠﬢѡﬢѥstBblIAkNABTObjujFJETiAegJxUA\u0026\u003Cpe\u0029f\u003FLB\u0027FKQQy\u007C\u003C\u00405nK\u007EJw\u0022; internal static \u003CModule\u003E.ﬥﬧѢѣﬥѠ\uFB29ѤﬢѢѣﬢﬧﬣשׁѠﬥﬦѠﬨ\uFB29ﬥѠﬡﬨѥﬤѠѥѢѣ\uFB29ﬢﬠﬡﬤﬢѤﬤPBUjQBqDxlPPWLlUjmxzDRkTbdIInTNA\u005CA\u0024C\u0028bx\u0021\u0025\u003E\u003FYg5BsRoU\u002D\u0024 ﬡﬣﬡ\uFB29ﬠשׁﬣѣﬧﬣѠ\uFB29ﬢﬥﬥשׁѢﬢﬤשׁﬦﬠѢѤѥѠﬡѠ\uFB29ﬣﬣѠﬧﬤ\uFB29\uFB29ﬦѥﬧyVsFZntXHrdCYJeLmjtSgBamjxOmOxe\u003A\u007DQ\u002B\u003EI\u007D\u0023\u007C6\u005DmdBW\u002F\u007DIRH\u0025;

private static GCHandle ѢﬣﬥﬢשׁѣﬠﬨﬨשׁѠﬣﬦﬣﬥﬧﬥשׁﬦѢﬤѥѥﬠﬣﬤѥﬧѤﬣﬨﬣѢﬦѡﬢשׁѤﬦnJUXgIvjdASdQQDhYLNjwiuNcIPo\u003FD\u007E6\u0025aK0\u0040jtZaBf\u002D\u007D9\u0028kNfVd(
[In] uint[] obj0,
[In] uint obj1)
{
// ISSUE: unable to decompile the method.
}

[STAThread]
[STAThread]
private static int ѡﬥﬧѠﬨѥѤﬥﬢﬨﬦѡﬨﬣѥﬢѢﬠﬡﬥѠѣשׁﬣѠﬤﬥﬤﬥ\uFB29ѠѢﬢﬦѠﬣﬥﬥﬡISKzKEdGfUOmdKDGJGVocSUOHPLB\u005Ct\u003B\u0022Ti\u007C\u0020\u0023\u003E\u0028\u005E6\u005Cc\u007EnanE2v\u003A\u0040(
[In] string[] obj0)
{
// ISSUE: unable to decompile the method.
}

private static Assembly ѡѣﬦﬢשׁﬨﬠﬠѤѤѤѠשׁﬡ\uFB29ﬨѢﬦﬠﬢﬢﬡѥﬣשׁѡﬦﬣѥﬡѢﬢﬨﬡﬦѢﬧﬣѥzxSugbwvptbiOFZLTdkkVWBgTCTTijt\u0022\u002A5\u007Dq\u003BMJEt6p\u005DG\u003Bt\u0025I\u005C\u0040\u005E\u0025(
[In] object obj0,
[In] ResolveEventArgs obj1)
{
// ISSUE: unable to decompile the method.
}

internal static byte[] ѡﬥѣﬤﬧ\uFB29ﬣﬠﬤѤѤѡﬥѡﬢﬤﬤﬠﬨﬢﬦ\uFB29ﬨﬠﬥﬠѠﬦﬣѡשׁѠﬦﬠѥѡ\uFB29ѢZyEhQghovjVWbJgGDnrmotBOZdVA2\u005Ds8\u005C\u002Aqm\u0027\u003A\u003F8ELqH\u003BKq2\u0027t\u003F\u0026(
[In] byte[] obj0)
{
// ISSUE: unable to decompile the method.
}

static \u003CModule\u003E()
{
\u003CModule\u003E.ﬢﬦﬦﬠѢ\uFB29ѣﬠѥﬢﬠﬡѠѢѥѢﬤ\uFB29ѣﬦ\uFB29ѠﬠﬠﬥﬢѡﬧﬣﬧﬣѠﬢ\uFB29\uFB29ѥѡﬥﬦSkDHyitoJRLTycHqdmhEdmaaAyLkH\u0029\u005CA1\u0020\u002F6\u007C\u003A\u003DGOS\u0020SSX7s\u003Bac\u002D\u0023();
label_1:
int num1 = -1875365012;
while (true)
{
uint num2;
switch ((num2 = (uint) (num1 ^ -271784619)) % 4U)
{
case 0:
\u003CModule\u003E.ﬦשׁﬢﬢѣѠﬦﬧﬦשׁﬢѥﬥѠѣﬨѡѤשׁﬣﬤ\uFB29Ѣﬢﬤﬡѥ\uFB29ﬦﬨﬢѡѣﬢﬤﬧﬧѥwPLLzcwMdVwcfrvCmppXFPiMoZABMx0\u0024m1D7\u002C\u0022\u0028\u002C7\u002FWgyPpsXoh9();
\u003CModule\u003E.ѢﬡﬢѡѢ\uFB29ﬨשׁѢﬨѥﬤ\uFB29ѣ\uFB29ﬦѥѥﬨﬦﬡﬨﬨѣﬨ\uFB29ﬨﬤѢѤﬤﬠѠﬨѠѠ\uFB29ѡﬡﬡApKPgUUOKblqtEevuuZlgtayWSpur\u00262q\u003Cf8\u0026\u005D\u005DFFW\u003F\u002DPgaaK\u007EOE\u0023(); \u003CModule\u003E.ﬧѣѢѥﬦﬡﬦѢﬣѡѤﬣ\uFB29ﬡѠﬢﬣ\uFB29ﬥשׁﬢѡѥﬦﬤﬡﬦѡﬧѢѠﬦﬨ\uFB29שׁѢשׁﬡﬢﬢuQPwBFIkAaoMtcDDQDtlidqOtQWjA7\u0021\u00234XKzX\u005DKI\u003FH\u003E_\u005D1e\u005BD\u0029Db\u002F();
num1 = (int) num2 * -1151438799 ^ 62872991;
continue;
case 1:
\u003CModule\u003E.ﬧﬥﬣѡﬢ\uFB29ѤѤﬧѠѤﬨѥﬧﬤѠשׁﬡѥﬦﬧﬢﬠﬣѠﬧﬣѢשׁﬠѥѣﬦﬥѤﬥѡשׁשׁtIuygSaoMqiAuyaSuniGYsAaloiw\u002C6\u005BMJAyv7x\u0021\u007BU\u003E9\u003D5\u0029\u003E\u0025Of\u003B\u005B\u002D();
num1 = (int) num2 * 1706151344 ^ 1056318149;
continue;
case 2:
goto label_3;
case 3:
goto label_1;
default:
goto label_6;
}
}
label_3:
return;
label_6:;
}

private static void ﬧѣѢѥﬦﬡﬦѢﬣѡѤﬣ\uFB29ﬡѠﬢﬣ\uFB29ﬥשׁﬢѡѥﬦﬤﬡﬦѡﬧѢѠﬦﬨ\uFB29שׁѢשׁﬡﬢﬢuQPwBFIkAaoMtcDDQDtlidqOtQWjA7\u0021\u00234XKzX\u005D`KI\u003FH\u003E_\u005D1e\u005BD\u0029Db\u002F()
{
// ISSUE: unable to decompile the method.
}

private static void \uFB29\uFB29שׁѠﬢשׁﬠѤﬨﬤѢѤﬡѥѡѢѢﬧѠﬨשׁﬦѤﬤѣﬣﬤѢשׁﬠﬦѡѡѢﬠשׁﬦﬦ\uFB29mygDmwCKLtFLrCGPNtsYZSTckkAIb_\u0021aCoZ4b\u002C\u003C\u0028MFT\u002BQg\u0023nX\u002F\u003D9\u0023\u0027(
[In] object obj0)
{
// ISSUE: unable to decompile the method.
}

///most of the rest of the code has this //ISSUE and of course the code that is unreadable
here is where i found the SuppressIldasmAttribute module

```<code>using System.Diagnostics;
</code>```

using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.Versioning;

// Assembly rgdfgdfg, Version=1.9.2.1, Culture=neutral, PublicKeyToken=null
// MVID: 59450446-F2C7-4225-B831-8B4909494F7E
// Assembly references:
// mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
// Module references:
// kernel32.dll

[assembly: CompilationRelaxations(8)]
[assembly: RuntimeCompatibility(WrapNonExceptionThrows = true)]
[assembly: Debuggable(DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)]
[assembly: AssemblyTitle("SuperSoft")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyTrademark("")]
[assembly: ComVisible(true)]
[assembly: AssemblyFileVersion("1.9.2.1")]
[assembly: TargetFramework(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")]
[assembly: AssemblyVersion("1.9.2.1")]

[module: SuppressIldasm]

\\thank you anyone who takes the time to help. sorry if this hurt to read.


问:
SSL pinning deep problem
I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app fails upon reaching this function

```<code>SSLEngineResult unwrap = this.f13022c.f13031h.unwrap(byteBuffer, a2);
</code>```

This object is part of javax.net.ssl.SSLEngineResult

The exception that this function triggers is javax.net.ssl.SSLHandshakeException: Handshake failed. I had feeling that they check system proxy and if its present that they mess with byteBuffer but that wasn't the case. I attached proxy without serving self signed certificate and app works normally, just the moment i attach self signed certificate trough Fiddler, it crashes on this function and exception occurs. It seems like this entire proccess of handshaking is causing problems and i don't know why. Could it be that the app devs did this on purpose somehow on lower level or could it be that this function itself is not working properly with my certificate (which should be the case really)

Fiddler config

Title: SSL pinning deep problem


问:
What type of file has the file signature 'BOOT'?
I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is actually in the .bin file.

After opening my file in a hex editor, I found that the file started with the data 42 4F 4F 54, which translates to BOOT. I feel like I've scoured the whole internet, but I can't find what type of file this is meant to be (I have a suspicion that the whole .bin file is just a renamed extension). I've even checked this Wikipedia page about file signatures to see if there was a match, but no luck.

Seeing as I had no luck with manually inspecting the hex data, I turned to binwalk. I ran it against my file, but the only data it managed to find was the following. As you can see, it only found HPACK data which, on a quick Google search, reveals almost nothing relevant to the binary data (my Google search found some info about HPACK archive data which is relevant to the HTTP/2.0 protocol, however I am almost positive my .bin file is relevant in some way to firmware, as it is one of the files on my calculator's hard drive). The most relevant info I was able to find about HPACK was this wiki page which specifies that the archive format was released in the 1990s, which makes more sense in relation to the age of my calculator, however still does not entirely solve my question of what the whole .bin file type is.

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2627058       0x2815F2        HPACK archive data
</code>```

I will leave here the first 50 hex bytes of the file (parsed with HexEd.it), in case it helps the identification process..

```<code>00000000 42 4F 4F 54:00 00 00 38|11 46 D0 08:56 33 00 01
00000010 60 00 D0 04:FF FF FF FF|FF FF FF FF:AD 01 60 2C
00000020 53 50 49 46:32 30 31 31|31 31 30 39:BD 03 7E 24
00000030 48 02
</code>```

I wish to gain more insight about what type of data this file contains, and if it is possible to identify what the file type is from the BOOT file signature. If it is possible to identify it, then what file type is the data?


问:
Cannot find audio file type
I'm trying to find the audio file type of this file (extension wtj) around 8 minutes). I extracted it from a music box.

I've tried many things:

Open in Winamp and VLC => no luck

Open with Audacity (no luck). I tried to import as a raw audio (every format) => no luck

I tried the command line file on my mac (by the way is there any difference with the linux one?) => no luck

I tried TrId => no luck

I tried Spek and GSpot => They cannot open the file

I opened it in a hex editor, this is what I have

09 0D 42 F2 F6 F9 06 F6 F6 9F F6 F6 F6 FE F6 F6 FB D6 F6 F6 F7 F6 F6 F7 52 F6 F6 F6 D6 F6 F6 C2 76 F6 F6 F2 BA B7 BB B3 C5 D8 CF CF D8 C3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 BA B7 BB B3 C5 D8 CF CF D8 C3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3

09 0D 42 F2 F6 F9 06 F6 F6 9F F6 F6 F6 FE F6 F6 (//the sequence starts again 41 times and then we have)

09 0D 42 F2 F6 F9 06 F6 F6 9F F6 F6 F6 FE F6 F6 FB D6 F6 F6 F7 F6 F6 F7 52 F6 F6 F6 D6 F6 F6 C2 76 F6 F6 F2 BA B7 BB B3 C5 D8 CF CF D8 C3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 A3 E6 75 C2 56 0D F1 6C 84 D4 78 6C 95 40 84 2A EA 94 9B EC 15 B5 F4 3E E1 E7 82 B0 E9 34 E0 93 30 D3 F7 8E FC B6 66 D3 F3 8A F7 B6 D1 E2 D4 28 D0 9E 05 06 1E AB 77 66 AE E1 D5 20 AA 21 B4 2E D8 F8 D1 D4 74 A0 CE 06 E3 7A 64 6A 70 74 74 DF 89 E4 86 23 78 C3 26 6D 71 CD C7 9A D8 FD FC 83 ED A7 CD B1 5F FB F2 D7 5A AD 31 EC 96 D5 15 0B D6 CB F2 47 62 41 61 C1 D4 28 AA 2F 01 BC A4 67 E9 49 48 07 B9 1F E8 B0 F0 BE D1 CF CD EA 9A B5

The files size are between 11MB to 46 MB for something like 16 minutes and between 5MB to 18MB for the short version (8 minutes). So I guess that it is compressed. I don't think it is encrypted because in the hex version, the starting sequence is repeated 41 times (unless the encryption key length is a multiple of the starting sequence).

Now I am stuck. Do you have any idea where I can dig?

Title: Cannot find audio file type


问:
How to patch C# binary?
I have C# binary. I was able to use dnSpy to decompile it, and analyze. The binary was obfuscated with xenocode obfuscator.

I figured out that I can directly manipulate IL instructions if I just find correct instruction offset, and replace instruction byte(s).

Original bytes and C# code (replaced with letters so it is readable):

```<code>a.b().c.d = (int)e.f;

 06 6F A0010006 6F 9302000A
 ^  ^  ^        ^  ^-------- T2
 |  |  |        \----------- callvirt to set_d
 |  |  \-------------------- T1
 |  \----------------------- callvirt to get_f
 \-------------------------- ldloc.0
</code>```

What I want to achieve and resulting bytes:

```<code>a.b().c.d = 6;

 1C 00 00000000 6F 9302000A
 ^  ^           ^  ^-------- T2
 |  |           \----------- callvirt to set_d
 |  |
 |  \----------------------- 5x nop, so the length of file is same
 \-------------------------- ldc.i4.6
</code>```

I am able to decompile changed binary without error, and I can observe my changed instructions, but when binary executes this region, it dies. Any ideas?

Title: How to patch C# binary?


问:
Finding which binary (library, driver, etc) caused an event log
I found some events in the Windows Event Log, and I was wondering which binary caused them.

The event I am curious about is Event ID 27 from Hyper-V

Hyper-V launch failed; the Hyper-V boot loader was unable to allocate sufficient resources to perform the launch.

Any ideas on how to track which binary was in charge of emitting that event? I want to understand what resource is the one failing.


问:
Debug multithreaded program in X32dbg
I am still quite inexperienced in reverse engineering. I have a small program that establishes an HTTP connection to a server and send data via POST method to the servert. I see strings like Winhttp.dll, WinHttpOpen, WinHttpOpenRequest, etc. I have added breakpoints for all the commands I have found. However, the breakpoints never hit. I see that the program connects to the server and sends encrypted data via POST to the server. I see that the sample starts multiple threads. I'm guessing that I need to jump into the correct thread, right? If this is true, how do I do this in X32dbg? I this sample I have set breakpoint at 12345678 and abababab. These addresses are pseudo adresses.</p>
```<code>12345678 | mov eax,sample.123343|String="winhttp.dll"
abababab | mov eax,sample.5B33E0|String="WinHttpOpenRequest"
...
</code>```

Title: Debug multithreaded program in X32dbg


问:
How to retrieve the encryption key from a dll file?
I have a dll file that makes an http post request to a webserver , request looks something like this :

```<code>UmdUsFrEB3wGMuuAz1Znywuedx6+ee9cHDyzqM3Gc0FW8TxKFitPfkoC23aJeW39rPhAIpkg7vyzYzRwsloEfUM3y1LnehrJVR5tQuoZ8EUa6uFgzFauuaiP1Ea9+lRg5OU
</code>```

i am not much of an expert but to me it looks like Base64 , but when i try and decode it using online decoders , most of them just gives an error that its not base64 format ,  and other decoders gives out Chinese characters,

and some gives results like this:

```<code>RgT°ZÄ|2ë€ÏVgËžw¾yï\<³¨ÍÆsAVñ<J+O~JÛv‰ymý¬ø@"™ îü³c4p²Z}C7ËRçzÉUmBêðEêá`ÌV®¹¨ÔF½úT`äå
</code>```

I am assuming that its been encrypted and then encoded ?
if so then is there a way to decrypt it ? i opened the dll file in JustDecompile and it does give me readable code , but i am not sure where to look for the encryption method or key in the code

i did find out a certain part of decompiled code somewhat interesting though :

```<code>    private byte[] (byte[] u0002, byte[] u0003)
    {
        byte[] numArray;
        byte[] numArray1 = new byte[89];
        ((Array)u0003).CopyTo((Array)numArray1, 0);
        ((Array)u0002).CopyTo((Array)numArray1, 16);
        if (0 == 0)
        {
            ((Array)Encoding.ASCII.GetBytes("MTRandom")).CopyTo(numArray1, 80);
        }
        do
        {
            numArray = (new MD5CryptoServiceProvider()).ComputeHash(numArray1);
        }
        while (3 == 0);
        return numArray;
    }

    private new unsafe void (byte[] u0002)
    {
        void* length = (void*)stackalloc IntPtr[9];
        this. = (ulong)0;
        *(length + 4) = this. <= 1101;
        if ((sbyte)(*(length + 4)) == 0)
        {
            . _u0001 = new .();
            byte[] numArray = base.(8);
            _u0001. = BitConverter.ToUInt16(numArray, 0);
            _u0001. = BitConverter.ToUInt16(numArray, 2);
            _u0001. = BitConverter.ToUInt16(numArray, 4);
            _u0001. = BitConverter.ToUInt16(numArray, 6);
            byte[] numArray1 = base.((int)_u0001.);
            byte[] numArray2 = this.(numArray1, u0002, _u0001);
            *length = null;
            while (true)
            {
                if (((int)(*length) >= (int)numArray2.Length ? true : (int)numArray2.Length - (int)(*length) < 8))
                {
                    return;
                }
                byte[] numArray3 = new byte[8];
                Array.Copy(numArray2, (int)(*length), numArray3, 0, 8);
                *length = (int)(*length) + 8;
                _u0001 = this.(numArray3, u0002);
                *(length + 5) = (int)numArray2.Length - (int)(*length) < _u0001.;
                if ((sbyte)(*(length + 5)) != 0)
</code>```

is it possible that this part of the code is responsible for encryption or is it the case of barking at the wrong tree?


问:
How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?
TL;DR:

Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file.

Long Version:

- What I have:

A cheap unpopular GPON (Fiber ONU) device, which I have root shell
access to.

A computer

Beginner skills (binwalk, gdb, basic
stackoverflow etc.)

High enthusiasm towards hacking

- What I want:

The router runs an ancient webserver called Boa and this has several publicly available vulnerabilties. But, I have tested each and every one against the target router ; but none of it worked. The firmware is  released on this year; so, I'm almost sure that the vendor has patched them.
However, I have already found an vulnerability, which I've disclosed to the vendor. But, I don't want to stop there, as I am pretty sure that this webserver contains tons of other vulnerabilities.
My research found out that vendor has precompiled the webserver binaries as a stripped file and all of the server side processing functions are compiled as a stripped custom library file.
What I want is to dynamically analyze the library file and catch the function calls from the webserver to the library file using gdb.
To do that, I have tried the following steps:

Placed a pre-compiled gdbserver binary and tried to run it directly in the router. But, whenever I try to do this, it gets killed automatically. (Most probably due to the low ram)

Tried to execute the webserver binary using QEMU user mode. But, failed with custom error messages. These custom error messages aren't very descriptive and has no documentation available on the whole internet

Emulated a MIPS system via QEMU (using debian kernel image and drive image from here), copied the extraced file system from  the firmware to QEMU , chrooted into the copied file system and executed BusyBox shell from the firmware file system. Even though the BusyBox shell works inside QEMU, I cannot start the webserver inside QEMU as it throws the same custom errors as before.

Tried to statically analyze the library using Ghidra. But, since the symbols are stripped, it didn't made any sense to me at all.

Converted the rootfs to qcow2 image and used it with debian kernel image, but QEMU couldn't boot from it, since it couldn't detect the disk image.

As far as my research went, the only option for me to dynamically analyze the web server is to make the web server run in QEMU with the kernel image and rootfs image I extracted from the firmware.
So, what are my next steps? How can I perform a  full system emulation with QEMU, using the squashfs image and uBoot kernel image?


问:
How to decompile a unity apk to a project?
I have tried to decompile a variety of APK's built with unity, but the tools i have used (uTinyRipper, iLSpy, some others) give me some files which give me errors and incomplete code/assets. I see DevX-Unpacker Magic Tools recommended frequently, but I would prefer to avoid paying hundreds of dollars just to decompile some games. Does anyone know a tool which would let me decompile a compiled unity game into a editable project? Preferably one with no cost, or one in the double digits? (I am new to the reverse-engineering scene, sorry if this is a dumb question)</p>


问:
Ghidra unable to find the JDK
Unzipped the ghidra application. When I run the .bat file I get the following message

```<code>LaunchSupport expected 2 to 4 arguments but got 1
LaunchSupport expected 2 to 4 arguments but got 1
LaunchSupport expected 2 to 4 arguments but got 1

Failed to find a supported JDK. Please refer to the Ghidra Installation Guide's Troubleshooting section. Press any key to continue . . .
</code>```

Even though the JDK is installed and I have set the path too in environment variables.

What could be the reason for this ?

Title: Ghidra unable to find the JDK


问:
How to modify checksum after making changes in Nokia 215 4G firmware?
If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function.

After further searching, I found out about the checksum and that in order to flash the custom firmware, you need to calculate it and modify it in the firmware.

This is the firmware:

https://www.mediafire.com/file/ok2c0qodao5fld1/Nokia_215_4G_readed_test.pac/file

I use HxD to read the file.

If I search for checksum, I got some results ->

Also, I searched for sha ->

So here, I tried to change == with != and also I changed it to 1 == 1 but, It always failed to flash

I am lost. I don't know what to search for or from where to start.

I hope that someone could help me out!

Note: I can provide access to my PC to try the flash tool (nokia tool v0.060 using easybox) and maybe debugging in the phone.


问:
How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?
Lets say there is a variable x in f1, and f1 calls f2 with the variable x

I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed its type. how can i do this? because right if x is getting passed to 100 functions, i need to manually redefine EVERY SINGLE one!


问:
Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment
I'm working on a sample that contains packing and anti-analysis measures.

Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried messing with this a bit) I am able to attach the debugger to the process but I am observing some behavior I haven't encountered before.

Looking in x64dbgs Memory Map tab, the processes main memory segment is layed out differently to what I've seen in the past. Normally it is of type IMG and contains the usual .text, .data, etc memory segments. This samples main segment is of type MAP and doesn't contain the normal sections. Is this a technique? What is it called?

There are multiple segments in this sample, here is how they look:

```<code>Address=00004FF61EC70000
Size=0000000001EE0000
Page Information=malware_sample.exe
Allocation Type=MAP
Current Protection=ER---
Allocation Protection=ER---

Address=00004FF620B50000
Size=0000000000650000
Page Information=malware_sample.exe
Allocation Type=MAP
Current Protection=-RW--
Allocation Protection=-RW--

Address=00004FF6211A0000
Size=000000000013B000
Page Information=malware_sample.exe
Allocation Type=MAP
Current Protection=-R---
Allocation Protection=-R---
</code>```

When trying to set breakpoints or patch memory x64dbg fails on the first segment I listed. I am able to place breakpoints on the second segment so my guess is the protection is preventing breakpoints/patching (Current Protection=ER---)?

When trying to alter the protection of the memory segment in x64dbg using Set Page Memory Rights to test if that is the cause of the failure to patch/bps I get an error saying there was a failure to change the memory protection. What can cause this? Is there anti-debugging tricks to prevent changing memory protection?


问:
reversing a grpc call
im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the request headers

```<code>        "content-type": "application/grpc; charset=utf-8",
        "grpc-accept-encoding": "identity,deflate,gzip",
        "accept-encoding":  "identity,gzip",
</code>```

and this is the decoded protcolbuffer

```<code>
   "1": {
        "1": "¸z =PÞCw.\u001e}».*\u001f\u0011"
    },
    "2": some value,
    "3": {
        "1": {
            "1": {
                "1": "©ÄS¢ÄþP\f.½\fÑWÄK>"
            }
        }
    },
    "4": {
        "2": 1,
        "4": {
            "2": {
                "1": "other value"
            }
        },
        "7": 2
    }
}
</code>```

i already tried gunzip on cyberchef but i could not decompress anything without a file signature so how should i decompress the other unreadable values into plain text?? when ever i send the same binary data above the intended functionality works so i know the server is turning them back into readable text somehow and say i want to intercept the data on the android app before it gets serialized what is the best  place to do that?

update: this is the result decoding the data using proto with the same structure as above what is this data how do i decode it?

```<code>s {
  string1: "\270z =P\336Cw\211\036}\273\214*\037\021"
}
id: 1640553558
d {
  d0 {
    d1 {
      string2: ">D_.\233d\\\177\210\274\320\000}\253\')"
    }
  }
}
g {
  id2: 1
  f {
    f0 {
      string3: "Eiei"
    }
  }
  id3: 2
}
</code>```

this is the .proto i built

```<code>syntax = "proto2";

message body {
    message b1 {
        optional string s0 = 1;
    }

    optional b1 s = 1;

    optional int32 id = 2;
    message b2 {

        message b3 {

            message body4 {
                optional string string2 = 1;
            }
            optional body4 d1 = 1;
        }
        optional b3 d0 = 1;
    }
    optional b2 d = 3;

    message b4 {
        optional int32 id2 = 2;
        message b5 {
            message b6 {

                optional string message0 = 1;
            }
            optional b6 f0 = 2;
        }
        optional b5 f = 4;
        optional int32 id3 = 7;

    }

    optional b4 g = 4;
}
</code>```

Title: reversing a grpc call


问:
How do I calculate where to put the canary value in a program
I am trying to exploit a program with a buffer overflow for a class. The program has a canary enabled and when you smash the stack it exits. When running the program in gdb you can set a breakpoint right before the call for user input and grab the canary off the stack. I attemped adding X amounts of A values to find where the canary is overwritten. Partial relro is on and ALSR is disabled. After 71 A's the 72nd causes a stack smash detected and bricks. I tried to enter the canary after the 71 A's in little endian like so AA...A\x00..etc but its still detecting the smash. Am I missing something here? The program is difficult to brute force as it opens a netcat listener on port 1215. From there you have to nc and then are prompted for the message. Ive tried manually entering it and passing it to the listener as a python script.</p>


问:
Trying to call the Exit Shellcode in a c program
```<code>#include<stdio.h>
#include<stdint.h>

char shellcode[] = "\xb8\x3c\x00\x00\x00"
                   "\xbf\x14\x00\x00\x00"
                   "\x0f\x05";

int main()
{
    uint64_t *ret;
    ret = (uint64_t *)&ret + 2;
    (*ret) = (uint64_t)shellcode;
}
</code>```

so here what i am trying to do is run the exit shellcode by modifying the rets address to the shellcodes address and exiting the c program with status 20.

```<code>Reading symbols from ./Shellcode...
(gdb) l
1       #include<stdio.h>
2       #include<stdint.h>
3
4       char shellcode[] = "\xb8\x3c\x00\x00\x00"
5                          "\xbf\x14\x00\x00\x00"
6                          "\x0f\x05";
7
8       int main()
9       {
10
(gdb)
11          uint64_t *ret;
12          ret = (uint64_t *)&ret + 2;
13          (*ret) = (uint64_t)shellcode;
14      }
(gdb)
Line number 15 out of range; Shellcode.c has 14 lines.
(gdb) break 12
Breakpoint 1 at 0x1129: file Shellcode.c, line 12.
(gdb) run
Starting program: /home/kali/oscp/asm/32/Shellcode

Breakpoint 1, main () at Shellcode.c:12
12          ret = (uint64_t *)&ret + 2;
(gdb) print /x &shellcode
$1 = 0x555555558028
(gdb) x/8xg $rsp
0x7fffffffdf70: 0x0000555555555150      0x00007ffff7e12d0a
0x7fffffffdf80: 0x00007fffffffe068      0x0000000100000000
0x7fffffffdf90: 0x0000555555555125      0x00007ffff7e127cf
0x7fffffffdfa0: 0x0000000000000000      0xd60b04d41db666f5
(gdb) s
13          (*ret) = (uint64_t)shellcode;
(gdb) x/8xg $rsp
0x7fffffffdf70: 0x0000555555555150      0x00007ffff7e12d0a
0x7fffffffdf80: 0x00007fffffffe068      0x0000000100000000
0x7fffffffdf90: 0x0000555555555125      0x00007ffff7e127cf
0x7fffffffdfa0: 0x0000000000000000      0xd60b04d41db666f5
(gdb) print /x $rip
$2 = 0x555555555135
(gdb) s
14      }
(gdb) x/8xg $rsp
0x7fffffffdf70: 0x0000555555555150      0x0000555555558028
0x7fffffffdf80: 0x00007fffffffe068      0x0000000100000000
0x7fffffffdf90: 0x0000555555555125      0x00007ffff7e127cf
0x7fffffffdfa0: 0x0000000000000000      0xd60b04d41db666f5
(gdb) print /x $rip
$3 = 0x555555555148
(gdb) s
0x0000555555558028 in shellcode ()
(gdb) print /x $rip
$4 = 0x555555558028
(gdb) x/8xg $rsp
0x7fffffffdf80: 0x00007fffffffe068      0x0000000100000000
0x7fffffffdf90: 0x0000555555555125      0x00007ffff7e127cf
0x7fffffffdfa0: 0x0000000000000000      0xd60b04d41db666f5
0x7fffffffdfb0: 0x0000555555555040      0x0000000000000000
(gdb) s
Single stepping until exit from function shellcode,
which has no line number information.

Program received signal SIGSEGV, Segmentation fault.
0x0000555555558028 in shellcode ()
</code>```

The shellcode address does fall into rip but the shellcode does not execute or something that i am unable to understand.
so like what should I do to make my shellcode run and have an exit status of 20.


问:
Twitter scraping using Python
I've been working on a project to reverse-enginner twitter's app to scrape public posts from Twitter using an unofficial API, with Python. (I want to create an "alternative" app, which is simply a localhost that can search for a user, and get its posts)

I've been searching and reading everything related to REST, AJAX, and the python modules requests, requests-html, BeautifulSoup, and more.

I can see when looking at twitter on the devtools (for example on Marvel's profile page) that the only relevant requests being sent (by POST and GET) are the following: client_event.json and UserTweets?variables=... .
I understood that these are the relevant messages being received by cleaning the network tab and recording only when I scroll down and load new tweets - these are the only messages that came up which aren't random videos (I cleaned the search using -video -init -csp_report -config -ondemand -like -pageview -recommendations -prefetch -jot -key_live_kn -svg -jpg -jpeg -png -ico -analytics -loader -sharedCore -Hebrew).

I am new to this field, so I am probably doing something wrong. I can see on UserTweets the response I'm looking for - a beautiful JSON with all the data I need - but I am unable, no matter how much I've been trying to, to access it.

I tried different modules and different headers, and I get nothing. I DON'T want to use Selenium since it's tiresome, and I know where the data I need is stored.

I've been trying to send a GET reuest to:
https://twitter.com/i/api/graphql/vamMfA41UoKXUmppa9PhSw/UserTweets?variables=%7B%22userId%22%3A%2215687962%22%2C%22count%22%3A20%2C%22cursor%22%3A%22HBaIgLLN%2BKGEryYAAA%3D%3D%22%2C%22withHighlightedLabel%22%3Atrue%2C%22withTweetQuoteCount%22%3Atrue%2C%22includePromotedContent%22%3Atrue%2C%22withTweetResult%22%3Afalse%2C%22withUserResults%22%3Afalse%2C%22withVoice%22%3Afalse%2C%22withNonLegacyCard%22%3Atrue%7D

by doing:

```<code>from requests_html import HTMLSession
from bs4 import BeautifulSoup

response = session.get('https://twitter.com/i/api/graphql/vamMfA41UoKXUmppa9PhSw/UserTweets?variables=%7B%22userId%22%3A%2215687962%22%2C%22count%22%3A20%2C%22cursor%22%3A%22HBaIgLLN%2BKGEryYAAA%3D%3D%22%2C%22withHighlightedLabel%22%3Atrue%2C%22withTweetQuoteCount%22%3Atrue%2C%22includePromotedContent%22%3Atrue%2C%22withTweetResult%22%3Afalse%2C%22withUserResults%22%3Afalse%2C%22withVoice%22%3Afalse%2C%22withNonLegacyCard%22%3Atrue%7D')
response.html.render()
s = BeautifulSoup(response.html.html, 'lxml')
</code>```

but I get back an HTML script that either says Chromium is unsupported, or just a static page without the javascript updating the DOM.

All help appreciated.

Thank you

Title: Twitter scraping using Python


问:
Why PTRACE_POKEDATA returns I/O error?
I learning usage of ptrace.

I tried following simple example but raises a I/O Error.

I would like to overwrite "Hello, world" (printing string) from other process.

A target program prints "Hello, world" string until stop then I want to change this prints string from another program that use ptrace.

However the ptrace program failed to POKEDATA with I/O Error.

I have no idea why it failed.

I have tried on:

x86_64 Linux 5.11.

AMD Ryzen 7 4750U

ptrace code: (This ptrace code refer from http://0xcc.net/blog/archives/000077.html (Japanese))

```<code>#include <assert.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <stdio.h>

int
main (int argc, char **argv)
{
    assert(argc == 4);
    pid_t pid = atoi(argv[1]);
    void *addr = (void *)strtol(argv[2], NULL, 0);
    void *word = (void *)strtol(argv[3], NULL, 0);

    assert(ptrace(PTRACE_ATTACH, pid, NULL, NULL) == 0);
    wait(NULL);
    if (ptrace(PTRACE_POKEDATA, pid, addr, word) != 0) {
        printf("Error: %s\n", strerror(errno));
        return 0;

    }
    assert(ptrace(PTRACE_DETACH, pid, NULL, NULL) == 0);
    return 0;
}
</code>```

target code:

```<code>#include <stdio.h>
#include <stdbool.h>

int main() {
    while (true) {
        printf("%s\n", "Hello, world");
    }
}
</code>```

A address of target string in target binary (in my environment):

```<code>Contents of section .rodata:
 2000 01000200 48656c6c 6f2c2077 6f726c64  ....Hello, world
</code>```

exection (shell):

```<code>./ptrace target_process_id 0x2004 0x60616263   //try to replace from Hell to abcdl
</code>```

Title: Why PTRACE_POKEDATA returns I/O error?


问:
Unrecognized function
There is function:

```<code>push    65h
push    edi
call    sub_5D8750
</code>```

In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with zeros. I put breakpoint, this function is called before the WinMain, and immediately at the beginning of the WinMain. What kind of function could it be if IDA didn't recognize it? Maybe ZeroMemory? But why IDA not recognize it? Thanks in advance.

Title: Unrecognized function


问:
How do I disassemble mips .o object files in ida elf 64bit
So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to get them back to c. Most likely they were compiled in mips4 aka mips pro as a 64 bit module. It shows decently in assembly. Probably not all correct, I’d like to use mips2c or epanos( mips2c but it works with ida used to disassemble electro paint) however I have no idea how to load libraries or use python with ida in windows.

I need python 3.6 I believe so the question is :

A. How do I load libraries and things with ida and use them to disassemble

B. What are some great ways to disassemble mips object files .o


问:
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.

How do I actually disassemble RegSetValueExW_0?


问:
Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything
I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0</code> and <code>!db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It works fine on RwEverything. Any ideas?


问:
Tool/parser for symbol tables produced with objdump -t to be used with IDA / Ghidra?
Working with a binary (arm64) file that seems to be some sort of a broken ELF file. The header data is missing and for some reason it contains a symbol table in a format that to me seem to be equal to the output when running objdump -t <filename.elf> on a valid ELF, concatenated after all the code.

(To avoid misunderstandings; if I run mentioned command on a different, valid ELF, I get a symbol table output in the format below, and it's a symbol table in this format that I find inside the broken ELF.)

However, neither IDA pro nor Ghidra manage to utilize this information, so for now the only way I've managed to use some of this to my advantage is to write a (IDA)python script and parse it "manually" to add functions, function names, etc based on the content of the symbol table.

This procedure works to some extent but it's not that great (probably due to my limited experience with writing good IDA-python parsers). It got me wondering if there maybe exist some other tool for this already?

I'm not very experienced with IDA or Ghidra, so it could be one/both of them have a feature to load symbol tables in this format, but if so, I've overlooked that at least.

Here's a small excerpt from the symbol-table data included in the broken ELF (just changed some of the names). As mentioned, the format is equal to what you get when running objdump -t randomfile.elf > table.txt on a valid ELF file.

```<code>randomfile.elf:     file format elf64-littleaarch64

SYMBOL TABLE:
0000000010c00000 l    d  .text  0000000000000000 .text
0000000010e2a550 l    d  __ex_table 0000000000000000 __ex_table
0000000010e2a570 l    d  .text.unlikely 0000000000000000 .text.unlikely
0000000010e2a5a0 l    d  .data  0000000000000000 .data
0000000010ebf380 l    d  .got.plt   0000000000000000 .got.plt
0000000010ebf398 l    d  .module    0000000000000000 .module
0000000010ebf740 l    d  .bss   0000000000000000 .bss
0000000000000000 l    d  .debug_info    0000000000000000 .debug_info
0000000000000000 l    d  .debug_abbrev  0000000000000000 .debug_abbrev
0000000000000000 l    d  .debug_loc 0000000000000000 .debug_loc
0000000000000000 l    d  .debug_aranges 0000000000000000 .debug_aranges
0000000000000000 l    d  .debug_line    0000000000000000 .debug_line
0000000000000000 l    d  .debug_str 0000000000000000 .debug_str
0000000000000000 l    d  .comment   0000000000000000 .comment
0000000000000000 l    d  .debug_frame   0000000000000000 .debug_frame
0000000000000000 l    d  .debug_ranges  0000000000000000 .debug_ranges
0000000000000000 l    df *ABS*  0000000000000000 init.o
0000000000002000 l       *ABS*  0000000000000000 STACK_SIZE
0000000010c00034 l       .text  0000000000000000 init_start
0000000010c00024 l       .text  0000000000000000 fw_magic
0000000010c00328 l       .text  0000000000000000 feature_init
0000000010c00370 l       .text  0000000000000000 subfeature_init
0000000010c001d4 l       .text  0000000000000000 twee_init
.
.
.
0000000010d541a0 g     F .text  0000000000000004 memset
0000000010e5e510 g     O .data  0000000000000080 acFont_ASCII
0000000010c2bd5c g     F .text  0000000000000004 get_curve
0000000010c29d24 g     F .text  0000000000000118 inject_mem
</code>```

Based on an older version of the ELF file that I found, which contains both headers and a "proper" symbol table (proper as in I can run objdump, readelf etc on the file without errors), I've started on "reconstructing" a header for the broken ELF - basically copying the header from the older ELF version and adjusting the load address, etc. It's far from 100% correct, but it seems to make things a bit easier for me since IDA pro is analyzing the file automatically. Ghidra, on the other hand, doesn't manage to load the ELF at all if I include my partial ELF-header.

If I also could either load the symbol table from the broken ELF - as is - in IDA with some feature, that'd be great. Even better if there is a way to incorporate the symbol table in some other format into the ELF so that IDA/Ghidra automatically manage to use this information while analyzing.

Might be this is a far fetched dream, but worth a shot. For all I know there could be some existing feature for this.


问:
reversing an HDL file
I was given an HDL file with the following content:

 CHIP Box { !     IN in[128]; !     OUT out[128]; !  !     PARTS: !     Xor(a=in[0..31], b=in[96..127], out=red); !     Xor(a=in[32..63], b=in[64..95], out=king); !     Xor(a=in[64..95], b=in[96..127], out=dave); !     Concat(a=in[0..31], b=dave, c=red, d=king, out=ayk); !     Switch(a=ayk[3..6], b=ayk[19..22]); !     Switch(a=ayk[54..61], b=ayk[32..39]); !     Switch(a=ayk[63..70], b=ayk[120..127]); !     Switch(a=ayk[95..98], b=ayk[81..84]); !     Xor(a=ayk[0..31], b=ayk[64..95], out=earl); !     Xor(a=ayk[64..95], b=ayk[96..127], out=cosmo); !     Xor(a=ayk[32..63], b=ayk[96..127], out=abbott); !     Concat(a=abbott, b=comso, c=ayk[0..31], d=earl, out=phoenix); !     Reverse(in=phoenix, out=out); }

i was asked to reverse it and retrieve the value of in , how can i do it please knowing that i have the value of out? thanks

Title: reversing an HDL file


问:
Loading a U-Boot ARM flash image into IDA Pro
I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing  the U-Boot shell so that I could flash a modified firmware back onto the board.

The problem is that I don't know how to find out the values that IDA needs in the "Disassembly memory organization" window. I have used IDA before with normal x86 and ARM executables but binary files are new to me in this context so guidance would be greatly appreciated.
Here is the file if it helps: dropbox link

This is mostly a learning project so as much detail as possible would be good.


问:
Nokia 105(TA-1114) Firmware analysis using Binwalk
First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best.
Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a firmware Dump by using Miracle Box. It gave me .Bin file. with size some other files. AT this point my primary goal was extract famous Snake game From firmware and flash it to other phone(cheap Chinese type, I have few lying around) with same processor  i thought it would be easy(like i do do with android phone)
it was not easy to find something useful about this phone. After looking at hardware I realized there is MediaTek MT6261DA processor inside this Phone, after googling and getting datasheet I have theses information:
it is based on the 32-bit ARM7EJ-STM RISC processor, with build in gsm, gprs class 12 modem. with support for many peripherals like battery charging, keyboard scanning, camera and LCD interface literally everything you need to build a phone inside a single chip(quite amazing right?).
Now back to firmware :
I used binwalk to quickly analyze firmware it showed nothing result was empty. then i googled around this CPU which got me 2015 form mentioning about MediaTek proprietary compression method called Viva.
now firmware contain 4 files.

ROM file called VIVA.

jump table

language pack

and another ROM file.

All these files have a header starting with

00000000:  4D 4D 4D 01-38 00 00 00-46 49 4C 45-5F 49 4E 46 4F
ASCII: MMM 8   FILE_INFO

one thing more came up with this MediaTek processor, a open source firmware that was used to reverse engineer cheap Chinese smart watches with same type of CPU's.
Fernvale research OS

Now here is my Question

do i have any chance in extracting resources from original firmware files?

What is this "Viva compression(or something else)"?

does anyone have some experience with reverse engineering MediaTek
firmware(not android)?

what else i can do in order to get something use full.?

please correct me if I am doing something wrong while writing this post. it is my first post here.
and keep it in consider that computer science is not my primary field(i am Master at zoology). i am doing  this just for learning something and of course due to curiosity. i can provide files if anyone requests
thanks


问:
Can you strip a mips64 object file?
-strip doesn’t know what this file is but read elf and objdump recognize it read elf gives entry and all the headers. I’m trying to find main() or the start function. Can I strip the file? Do I need to? Using ghidra as well and searching for it reveals nothing so maybe it’s hidden? Entry is  0x0</p>

Title: Can you strip a mips64 object file?


问:
Automated data tracking during runtime in IDA PRO
What I mean specifically is that I want to turn a certain piece of memory into a virus that will attach itself to anything that has anything to do with it. For example:

```<code>call sub_404505
; Lets say that sub_404505 returns a 32-bit integer in EAX register
; Here, I want to turn the EAX register into a virus
mov [esp + 0x?? + var_14], eax
mov some_global_offset, eax
; Here, I want this virus to extend to some_global_offset and var_14 stack address
; Later, if any read/write intructions has any reference to these addresses, I want IDA PRO to dump the intructions as well as the address of the intructions to output window
; This virus will remain in place until the value is reset, for example:
xor eax, eax
</code>```

Is it possible to do something like this in IDA PRO, Windows 10?


问:
/bin/sh shell not execute when performing ret2libc attack
I have attempted to do a ret2libc attack. It's a simple buffer overflow with the return address pointed to the system call with the string "/bin/sh" on the stack. For some reason, when I try to execute the program, although the program perform a system call with string "/bin/sh", but no shell was spawned, and I'm not sure why that is the case. Below snapshots of the stack before and after entering system call.

The stack before entering system call. (From left to right) red underlines emphasize the address of the system call, the address of the exit() function call, and the address to the string "/bin/sh". Note: the ebp (starts at 0xbffff7b8) had been overwritten with junk data.

Here is what happen after I attempted to step through each instructions and reach the end. I try to type in id, and whoami, but nothing happen.


问:
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):

```<code>lkd> !pfn 0xf0
    PFN 000000F0 at address FFFFFA8000002D00
    flink       FFFFFFFFFFFFFFFF  blink / share count FFFFFFFFFFFFFFFF  pteaddress FFFFFFFFFFFFFFFF
    reference count FFFF    used entry count  FFFF      NotMapped color 3F   Priority 7
    restore pte FFFFFFFFFFFFFFFF  containing page        FFFFFFFFFFFFF  Trans      MPRWEXY
    Modified Shared ReadInProgress WriteInProgress InPageError ParityError RemovalRequested
</code>```

On VM (legacy BIOS):

```<code>kd> !pfn 0xf0
    PFN 000000F0 at address FFFFFA8000002D00
    flink       00000000  blink / share count 00000000  pteaddress 00000000
    reference count 0000    used entry count  0000      NonCached color 0   Priority 0
    restore pte 00000000  containing page        000000  Zeroed
</code>```

For the record !db 0xf0000 works correctly on both machines, and the PFN entry is the same before and after the momentary mapping performed by !db  on both machines. Could the first one be a stupid kd -kl / livekd issue again?

Curious. I thought it could be that 0xf0 has never been mapped as opposed to mapped then unmapped, and for some reason left as MiNonCached and not MiNotMapped (and it may or may not return it to MiNotMapped when unmapping a cached area, but I don't know). I would have thought that this range would never have been mapped on ntoskrnl because it's not supposed to be using BIOS services.

On the host:

```<code>lkd> !pfn 0xf1
    PFN 000000F1 at address FFFFFA8000002D30
    flink       FFFFFFFFFFFFFFFF  blink / share count FFFFFFFFFFFFFFFF  pteaddress B47756FFFFE9FFFF
    reference count 517C    used entry count  B4E9      Cached    color 2D   Priority 7
    restore pte FFFFFFFFFFFFFFFF  containing page        756FFFFE9FFFF  Bad           WEXY
          WriteInProgress InPageError ParityError RemovalRequested
</code>```

This time it's 'Cached', and clearly contains garbage, so the MiNotMapped part of the question may be irrelevant, and should have perhaps been whats the difference between a garbage PFN entry and a zero intialised one?


问:
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:

http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium.github.io/blog/posts/windows-full-memory-introspection-with-icebox/ https://cyberforensicator.com/wp-content/uploads/2017/08/Scanning-memory-with-Yara.pdf https://www.sciencedirect.com/science/article/pii/S1742287619301574

None of them explain when a PTE is actually of the VAD prototype format.

Seeing as PPTEs are created when the section object is created for images, and for data files the PPTEs are created when the view is mapped (which is when the VAD entry is created) [1], I can't see a case where the PTEs in the VAD allocation would ever not be able to point directly to the prototype PTEs.

If the PPTEs weren't created once the view is mapped, it would make sense to be a VAD type, because there is no PPTE virtual address to point to, but this is not the case. From now on, there is always a PPTE virtual address to point to. The PPTE itself will point to a subsection object (_MMPTE_SUBSECTION format) in the event that it is a file-backed and not in RAM, and point to a pagefile location if it is pagefile-backed and not in RAM.

I did some further investigation and noticed that the VAD prototype PTEs were all on mapped files, and mapped images had regular prototype pointer PTEs (which is strange because PPTEs are available when you map a view in the VAD in the case of data, and when the section object is created in the case of image, which is before the mapping of the view in the VAD). Also something strange I noticed is that CoW PTEs are blank when they are not pointing to a page in the file, as opposed to pointing to the PPTE. They need to point to a page in the file when they are read and before any writes occur. I'd like that to also be answered.

I have seen a case where more space has been reserved for a data file than the size of the file -- on VMMap it shows 16KiB committed and 512KiB reserved. The committed PTEs are VAD prototypes and the reserved ones are blank (unknown PTEs)

I previously asked this on SO, but obviously nobody replied, so I'm moving it to the correct forum. Before anyone tells me I should have debugged it before asking, this question will be number 1 in the search for 'VAD prototype PTE' and '0xFFFFFFFF0000' and so on, and people will be looking it up when those sources don't elaborate. There is no googlable information on this detail written in a human language, and I know I spent a good few hours on advanced and verbatim search, and it's a fundamental piece of information for people to know.


问:
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.

Most of the time I use rundll32.exe to load and debug any DLL and I just get this behavior with a few binaries.

The current lib I am debugging is quite simple, most of the logic of the program is executed by a thread created at the DLL's entry point. Then, its single export(DllRegisterServer) has a loop which checks if a flag has been set to finally call ExitProcess.

When I enter the main's logic thread I suspend any other thread and single step through it as always. As I go, randomly the DLL is unloaded, reloaded, and the dbg sets me again at DllEntryPoint, which makes the RE job quite annoying.

What could be the reason for that behavior?

Edit: Within x64dbg this does not happen. Same file, same command line.


问:
Change return value of a boolean function in arm library
I have an android library (arm cpu) that have a function named GetEisLinkWithDfr() that have a single line that returns boolean value of "true", and I want it to return a value of "false".

I included isAWBEnabled() witch returns boolean value of "true" too, and isFlashAWBv2Enabled() witch returns boolean value of "false" as a show case.

I have attached the output when I run iE command and izz command in radare2.

nth   paddr      vaddr      len size section type    string

―――――――――――――――――――――――――

3462 0x000d45a4 0x000d85a4 GLOBAL FUNC   4         GetEisLinkWithDfr()

3461 0x000d45a4 0x000d85a4 GLOBAL FUNC   4         int isAWBEnabled<(NSIspTuning::ESensorDev_T)2>()

883  0x000d45a8 0x000d85a8 GLOBAL FUNC   4         isFlashAWBv2Enabled()

nth   paddr      vaddr      len size section                type    string

――――――――――――――――――――――――――――――

6158  0x0007a4c1 0x0007e4c1 22  23   .dynstr                ascii   _Z17GetEisLinkWithDfrv

105   0x00019951 0x0001d951 52  53   .dynstr                ascii   _Z12isAWBEnabledILN11NSIspTuning12ESensorDev_TE2EEiv

141   0x00019f6f 0x0001df6f 24  25   .dynstr                ascii   _Z19isFlashAWBv2Enabledv


问:
Determining a password-hashing function knowing plaintext + output
I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database.

The plaintext password is:

k4oK203$

And the password as it is stored 'crypted' in my database is:

6xqmRr0QNUrc0uvwGchWqA==

How would I go about figuring out what transformation (base64? sha1? md5? etc.) that were used in order to get the plain text password in to the database value?


问:
unix executable Error: Reading 0x1b50 bytes extends past end of file for string table
info on the file it is called ld it is a command for linking elfs called link editor. Does Error: Reading 0x1b50 bytes extends past end of file for string table mean I am missing some kind of offset? readelf says: readelf: Error: no .dynamic section in the dynamic segment strange here is all the readelf info:

```<code>~/Desktop/ld$ eu-readelf --all ./ld
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, big endian
  Ident Version:                     1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS
  Version:                           1 (current)
  Entry point address:               0x10002350
  Start of program headers:          52 (bytes into file)
  Start of section headers:          91924 (bytes into file)
  Flags:                             0x20000024
  Size of this header:               52 (bytes)
  Size of program header entries:    32 (bytes)
  Number of program headers entries: 7
  Size of section header entries:    40 (bytes)
  Number of section headers entries: 23
  Section header string table index: 22

Section Headers:
[Nr] Name                 Type         Addr     Off    Size   ES Flags Lk Inf Al
[ 0] <corrupt>            <unknown>: 1090519040 001cffff ffff0100 4fcffff 1090519040       -1 -65216 155197191
[ 1] <corrupt>            <unknown>: 1638399 04fcffff ffffffff ffff0140 454561792 NOE   155197191 1090519040 1048576
[ 2] <corrupt>            <unknown>: 47451165 696e7465 7270002e 4d495053 1734962790 AXS   779055220 1768910451 3043941
[ 3] <corrupt>            SHT_LOPROC+96e616d 6c69626c 69737400 2e64796e 2037281657 AXSO  1937011200 778592627 1744842340
[ 4] <corrupt>            <unknown>: 1230000942 6962002e 6d73796d 2e636f 779318389 XSINTCO 1852206185 1668546606 1296650323
[ 5] <corrupt>            SHT_LOPROC+4657874 6974002e 726f6461 7461002e 1651733248 AXSINC 1684108385 3041135 1946168947
[ 6] <corrupt>            SHT_LOOS+1746100 002e6465 6275675f 6c696e65 1634559347 WAMSING 3040357 1651861343 1886741102
[ 7] <corrupt>            SHT_LOOS+275675f 6576002e 64656275 675f696e 1634559232 AMSIGO 1718550574 1684365941 1734305394
[ 8] <corrupt>            SHT_LOPROC+5675f77 616d6573 2e6465 6275675f 1700951399 AXSINGCO 1718972003 1851878757 1929391716
[ 9] <corrupt>            SHT_LOOS+e676573 6d6d656e 74002e4d 4950532e 1296650323 WAXSING 1768846437 1919312227 1702035502
[10] <corrupt>            SHT_LOOS+e74732e 002e4d49 50532e65 76656e74 778268526 XMSICO 1932421486 1769209902 1296650323
[11] <corrupt>            <unknown>: 779251556 2e4d4950 532e636f 6e74656e 1920229730 NO    1949197409 1952514094 1936225140
[12] <corrupt>            NULL         00000000 000000 000000  0        0   0  0
[13] <corrupt>            <unknown>: 256 00000210 011400 011400 1024 N     5376   0  0
[14] <corrupt>            <unknown>: 2416 00000210 013000 013000 2048 NTC   32768   0  0
[15] <corrupt>            <unknown>: 6000 00000210 01b000 01b000 1024 GT    6144   0  0
[16] <corrupt>            <unknown>: 8192 00000210 01c800 01c800 1024 GT    73728 1536  0
[17] <corrupt>            <unknown>: 10608 00000210 02e800 02e800 1024       5120 1536 256
[18] <corrupt>            <unknown>: 12800 00000210 02fc00 02fc00 1024 NG    453376   0  0
[19] <corrupt>            <unknown>: 14848 00000210 09e800 09e800 1024 NT    431104 2048  0
[20] <corrupt>            <unknown>: 16384 00000210 107c00 107c00  4 NGC   854576   6 16
[21] <corrupt>            <unknown>: 72 00000002 10001aac 001aac  1 SO    163   8  5
[22] <corrupt>            <unknown>: 85 00000002 10001b50 001b50  4 WO    1304   6  0

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz  MemSiz   Flg Align
  PHDR           0x000034 0x10000034 0x10000034 0x0000e0 0x0000e0 R   0x4
  INTERP         0x000114 0x10000114 0x10000114 0x000015 0x000015 R   0x4
  LOPROC+2       0x000130 0x10000130 0x10000130 0x000080 0x000080 R   0x8
  LOPROC+0       0x0001b0 0x100001b0 0x100001b0 0x000018 0x000018 R   0x4
  DYNAMIC        0x0001c8 0x100001c8 0x100001c8 0x000120 0x000120 R   0x4
  LOAD           0x000000 0x10000000 0x10000000 0x012cd8 0x012cd8 R E 0x10000
  LOAD           0x014000 0x10014000 0x10014000 0x000d0a 0x4300000c     0x6000040

 Section to Segment mapping:
  Segment Sections...
   00
   01
   02
   03
   04
   05
   06
b@b:~/Desktop/ld$ readelf -h ./ld
ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x10002350
  Start of program headers:          52 (bytes into file)
  Start of section headers:          91924 (bytes into file)
  Flags:                             0x20000024, cpic, abi2, mips3
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         7
  Size of section headers:           40 (bytes)
  Number of section headers:         23
  Section header string table index: 22
readelf: Error: Reading 0x1b50 bytes extends past end of file for string table
readelf: Error: no .dynamic section in the dynamic segment
</code>```

Maybe readelf is the incorrect thing to use for this but ghidra also doesnt load much of anything so I need more info to load it as a raw binary.

its stripped to this sounds like fun: ./ld: ELF 32-bit MSB executable, MIPS, N32 MIPS-III version 1 (SYSV), dynamically linked, interpreter empty, stripped aka difficult


问:
How to create an algorithm in C...(or C# or C++, basically in "a programming language")
After a LOT of sending challenges and recording the responses I've 'broken' the "encryption" in my car's immobiliser...the reason for doing it is so I can use the engine and transmission in a project car, keeping the HS canbus - for the ECM to TCM comms, but removing the MS canbus - and all modules associated with it...including the body control module which handles the immobiliser functionality in the stock car.

So, "encryption" - it's basically a substitution cipher with a bunch of modifiers. The format is a 32-bit challenge, and 32-bit response - formatted into 4 bytes and 4 bytes.

I've currently coded it in C (for arduino) using arrays for the responses and a bunch of logic and it's working - however there's got to be a better way...right?

I'm a mechanic, not a programmer, and definitely not a mathematician...I just don't have the knowledge (or IQ XD) to make the jump from what I've done so far, to coding a functioning mathematical model/algorithm to do the same job.

As a couple of examples of the logic for the modifiers it's things like if challenge byte 2 >= 0xEC then increment the response by 1, or if bit 2 of challenge byte 3 >= 0x14 then do something else to the appropriate response etc.

But honestly...would love to reduce my 600 lines of code to 50!

I can post up as many C/R pairs as necessary to get some help here and post the flow chart of logic too.

Just hoping for a white knight right now!

Edited to add coded block and other info...

```<code>void CalcResp()

  //Calculate response

{

  uint32_t  ResponsePreXOR = 0x00000000;
  uint32_t  ResponsePostXOR;
  uint8_t   ChalByte[4];
  uint8_t   RawRespByte[4];
  uint8_t   XORRespByte[4];
  CAN_FRAME ChalFrame;
  CAN_FRAME RespFrame;

  Can0.watchFor(0x00040020);

  if (Can0.available() > 0)
    {
      Can0.read(ChalFrame);

  // Split the Challenge into raw bytes

  ChalByte[0] = ChalFrame.data.byte[0];
  ChalByte[1] = ChalFrame.data.byte[1];
  ChalByte[2] = ChalFrame.data.byte[2];
  ChalByte[3] = ChalFrame.data.byte[3];

  // if Challenge Byte 3 bit 1 is set

  if (ChalByte[3]&0x02)
  {
    if (ChalByte[3]>=0x16)
      {
        RawRespByte[3] = TableB2A[(ChalByte[2]+1)&0xFF];
      }
    else
      {
        RawRespByte[3] = TableB2A[ChalByte[2]];
      }

  RawRespByte[2] = TableB3[ChalByte[3]];
  RawRespByte[1] = TableB1A[ChalByte[1]];

    if (ChalByte[1]>=0xEC)
      {
        RawRespByte[0] = TableB0A[(ChalByte[0]+1)&0xFF];
      }
      else
      {
        RawRespByte[0] = TableB0A[ChalByte[0]];
      }

  }
  // if Challenge Byte 3 bit 1 is not set

  else

  // Build Response Byte 0
  {;
      RawRespByte[3] = TableB3[ChalByte[3]];

  // Build Response Byte 2
        if (RawRespByte[3]>=0x14)
          {
            RawRespByte[2] = TableB2N[(ChalByte[2]+1)&0xFF];
          }
         else
          {
            RawRespByte[2] = TableB2N[ChalByte[2]];
          }

  // if Challenge byte 1 is above or equal to 0xEC
  // Build Response Byte 1

        if (ChalByte[1]>=0xEC)
          {
            if (ChalByte[0]&0x0F==0x0F)
              {
                RawRespByte[1] = TableB016s[(ChalByte[0]/16)];
              }
            else
              {
              RawRespByte[1] = TableB0N[(ChalByte[0]+1)&0xFF];
              }
        if (ChalByte[1]<0xEC)
          {
            RawRespByte[1] = TableB0N[ChalByte[0]];
          }

  //Build Response Byte 0

    RawRespByte[0] = TableB1N[ChalByte[1]];

  }

  //Construct the response out of the response bytes

  ResponsePreXOR = uint32_t (RawRespByte[0])<<24;

  ResponsePreXOR += uint32_t (RawRespByte[1])<<16;

  ResponsePreXOR += uint32_t (RawRespByte[2])<<8;

  ResponsePreXOR += uint32_t (RawRespByte[3]);
</code>```

The car's ECM is a Siemens SID 203 - the immo algo for this hasn't yet been broken I don't think...no-one produces an emulator for it.

I think the synchro is this code snippet from the ECM

```<code>u8
data_cs[8]={0xEC,0x68,0x27,0x65,0xEC,0x8E,0x14,0xE6};
</code>```


问:
Automotive engine management - reversing a PIN that has locked an MTX8 ECU
I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the manufacturer and have it reset to default, there is no way that a user can do this, and the manufacturer charges about AU$200 including postage for the service.

The ECU in question is a Microtech MTX-8. It uses an HC11 microcontroller. The user interface is via a handset with 6 buttons and a 4 line character display. Now I didn't lock this computer, a friend had a perfectly running car and out of curiosity loaded a saved configuration that unfortunately had a PIN assigned. The unit was second hand. It is now a paper weight. The computer is ancient history these days so we're not interested in spending money on it by sending it back. For reasons of regaining function of the computer and also as an academic exercise I'm continuing to look into this.

I have a bit of background in HC11 but reversing someone else's complex code isn't something I've had anything to do with. What I've been able to work out so far is:

I've pulled the processor from the mtx-8 computer and put it into a circuit I have hanging around from my Uni days. I am able to pull the firmware off the chip no problem.

I can decompile the s19 file with IDAPro and get the ASM.

I can read various text strings which all make sense given the purpose of the device, things like air temp, water temp, basically all the text fields that would be displayed on the handset.

I have a second mtx-8 that isn't locked and I can lock it, dump the firmware, compare it to the unlocked code from the same device.

I have performed dozens of tweaks to the settings on my second, unlocked mtx-8 and compared with Notepad++ without luck. The PIN is six digits so crunching through 999999 combinations isn't that appealing. It seems to live somewhere other than EEPROM of the processor and given that I think there is some type of external serial EEPROM in use it is a possibility that the PIN or it's hash is living there.

Looking at the memory used by the code, I think the processor is an HC11 MC68HC11E20. The device circuit board has the chip numbers scrubbed off unfortunately. The E20 has 20k of ROM program space from $D000 to $FFFF and from $9000 to $AFFF. I do know that the circuit board has some type of external memory in which the additional tune configs are stored - memcals - there are four slots for saved configs available and the user manual says that these are stored on the handset. There is an 8 pin IC in the hand controller but the numbers are scrubbed off. There are also numerous 8 pin ICs on the main computer board which may or may not also be external EEPROM. The device CONFIG register appears to indicate the the processor is in single chip mode which I think still makes sense if there is an external serial EEPROM involved.

I've just started having a look at HC11 simulators, THRSim11 seems most promising although I really didn't want to start analysing the the code just to find the PIN. I'm not interested in the engine tune which is hiding behind the PIN, I just want to identify this PIN.

So I guess I'm wondering if anyone has any suggestions, or might be curious about having a look at the ASM/S19?

Sorry for the long post! Thanks


问:
Nice way to get Windows API call arguments in WinDBG
How do I get a nice list of call arguments for well documented functions such as kernel32!CreateRemoteThread in windbg? Right now when a breakpoint hits I manually decode them considering the architecture and stdcall vs fastcall convention. I feel there must be a better way.</p>