问:
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit.

I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture file changes and save a duplicate of all files that were created, edited, or deleted.

I know you can manually copy all files or set permissions on a certain folder to avoid deletion, but isn't there something like to capturebat?

thanks a lot,


问:
Does IDA support segment:offset operands?
Can I tell IDA that an operand is a segment:offset address? It doesn't seems to be any of the posibilities in the Offset (user-defined) dialog, however IDA uses them when decoding instructions with explicit segment addresses.</p>

ContentLicense: CC BY-SA 3.0


问:
Decode data in wireshark
I am trying to decode data packet in Wireshark but I don't know what type of encoding is that

ContentLicense: CC BY-SA 4.0

Title: Decode data in wireshark


问:
Find an address of injected code via GetModuleHandleA
I am reversing really old game (20 years old).

l2.exe loads Dsetup.dll Network.dll. (not sure about order)

inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. That changes 1 network packet.

The injection:

A list of loaded modules:

The question is how to find a place where this injection was done. Base address of initial Network.dll + offset like 177126 ? As a result i have not valid address


问:
Ghidra python - retrieve the name of the called method
I am using Ghidra to build the function call graph of a method in java and therefore I am analyzing the bytecode of java and when I read an "invoke" instruction I have to go back to the name of the called method.

Do you know how to do this through a python script?


问:
Malware apk in Android
Is there some website where i'm able to find malware apk filtering by permission (for instance: RECORD_AUDIO)? I'm looking for website similar to pithus</p>

Title: Malware apk in Android


问:
can't detect the archtitcture of a file
i extracted a file from a .JPEG with outguess the file extension is .data i tried to identify the file type but the result is application/octet-stream  and i can't figure which extension is it even with file command or online file identifier.hex_view2</p>

OwnerDisplayName: med najjar

Title: can't detect the archtitcture of a file


问:
How to decode a bluetooth package from PH bluetooth meter
I'm trying to perform some Bluetooth reverse engineering with a PH/ORP/TEMP probe.

I know where the data comes, but I don't know how to translate it.
The probe shows these values in its Android app:

```<code>ID  Model Name  Date    EC  EC(Unit)    TDS TDS(Unit)   SALT(%) SALT(TDS)   SALT(TDS)(Unit) SALT(S.G.)  pH  Humidity(%) ORP(mV) H2(ppb) H2(ppm) DO(mg/L)    DO(%)   CF  CL(mg/L)    Temperature(°C) Temperature(°F) Location    Notes
1   BLE-C600    2022-06-16 12:54:44 110 μS/cm   55  ppm 0.0 55  ppm 0.999   8.56    -   141 -   -   -   -   -   -   26.0    78.8    Madrid
</code>```

The wireshark show this:

```<code>> Bluetooth Attribute Protocol
    Opcode: Read Response (0x0b)
        0... .... = Authentication Signature: False
        .0.. .... = Command: False
        ..00 1011 = Method: Read Response (0x0b)
    [Handle: 0x0026 (Unknown: Unknown)]
        [Service UUID: Unknown (0xff01)]
        [UUID: Unknown (0xff02)]
    Value: ffa9fc5afe73ffc0ffc4ffeefdf7fd7ffabc65fea4ddbb55
    [Request in Frame: 4765]
</code>```

No idea how to match ffa9fc5afe73ffc0ffc4ffeefdf7fd7ffabc65fea4ddbb55 with the value received.

Update:

I think where the PH value is, but I don't know how the translation is performed. It could be the second pair of bytes.
Bellow, all the data gathered until now and its hex received:

```<code>5,17    6,95    7,3     7,39    7,4    7,43     7,43    7,46    7,46    7,47    7,5     7,52    7,53    7,53    7,53    7,54    7,56    7,56    7,58    7,59    7,59    7,59    7,64    7,68    7,68    7,68    7,68    7,68    7,71    7,72    8,56
fef0    fed0    fe5a    fe78    fe72    fe70    fe70    fe7a    fe7a    fe78    fe72    fe5a    fe58    fe58    fe58    fe5a    fe52    fe52    fe52    fe50    fe50    fe50    fe52    fcfa    fcfa    fcfa    fcfa    fcfa    fcf8    fcf2    fc5a
</code>```

I would bet also that Temperature is in the 14th position:
Some reading below:

```<code>22,3ºC ff a9 fe 50 fe fe ff ff ff ff ff ff ff 55 ff 98 fb ad 65 fc 8c f7 54 ff
22,4ºC ff a9 fe 52 fe ee ff ff ff ff ff ff ff 7f ff a7 fb ac 65 fe 0e 7f aa 55
22,4ºC ff a9 fe 50 fe fb ff ff ff ff ff ff ff 7f ff af fb ac 65 fe 0c ff 51 ff
22,3ºC ff a9 fe d0 fe fe ff ff ff ff ff ff ff 55 ff b8 fb ad 65 fc 2c 75 41 ff
22,3ºC ff a9 fe d0 fe fe ff ff ff ff ff ff ff 55 ff 92 fb b9 65 fc ae 7d 15 00
22,4ºC ff a9 fe 5a fe aa ff ff ff ff ff ff ff 7f ff 8d fb b9 65 fe a4 dd 10 ff
22,4ºC ff a9 fe d0 fe fb ff ff ff ff ff ff ff 7f ff 87 fb bc 65 fc 2e 55 fe 55
22,4ºC ff a9 fe 78 fe ee ff ff ff ff ff ff ff 7f ff 8f fb bd 65 fe 24 57 01 ff
22,3ºC ff a9 fe f0 fe fa ff ff ff ff ff ff ff 55 ff b2 fb b8 65 fc 8c f5 ba 55
</code>```

But no idea how to translate it.


问:
Is there a way to reprint the screen in gdb gef?
I am using gdb-gef and I've searched the manual several times for the answer to this question. Sometimes I run a lot of commands and I would like to re-draw the current program state the way gef displays it when I step through the program (registers + stack + list view, etc...). Yes, I am able to get much of the same info with the info registers, info frame, etc... But I have not found a way to do this and it would be helpful.


问:
Using output of a command as argument in radare2
I'm trying to use the output of a command as argument for my program that i'm trying to debug.

I created the following profile, similar to using a command output for stdin

```<code>$ cat profile.rr2
#!/usr/bin/rarun2
arg1=!cat payload
</code>```

However, this does not add a argument and gives the following warning if the debug process is started using the profile

```<code>WARNING: r_str_trim_tail: assertion 'str' failed (line 173)
</code>```

Is it even possible to define the output of a command as argument with a profile?


问:
Invalid address when overwriting saved rip with buffer's address
I have an executable vulnerable to buffer overflows. The program takes a buffer of 104 chars and prints it (unfortunately, there is no format string vulnerability) until we feed it with a 0 or a \n, in that case it just exits.

The program adopts a stack canary mitigation, so I am trying to leak it in order to inject a shellcode. To do so I:

Overflow the buffer to leak the canary the first time.

Send this payload:

```<code>NOPx65 + shellcode (39 bytes long) + leaked_canary + "bbbbbbbb" (used to fill the space between canary and sRIP) + <buff_address>
</code>```

This is the stack after sending the payload and pressing enter to stop the execution.

```<code>0x7ffd2a5d6e80: 0x909090909090900a             0x9090909090909090
0x7ffd2a5d6e90: 0x9090909090909090             0x9090909090909090
0x7ffd2a5d6ea0: 0x9090909090909090             0x9090909090909090
0x7ffd2a5d6eb0: 0x9090909090909090             0x9090909090909090    <-end of NOP sled
0x7ffd2a5d6ec0: 0x48fe89485f12eb90             0x3bb8f2894808c683    <-shellcode
0x7ffd2a5d6ed0: 0xffe9e8050f000000             0x732f6e69622fffff
0x7ffd2a5d6ee0: 0x0000000000000068             0xdfcedb209c33f900    <-leaked canary
0x7ffd2a5d6ef0: 0x6262626262626262  <-filler   0x00007fffffffddc0    <-sRIP overwritten with buf_address
</code>```

As you can see, at the end of the snippet there is the sRIP overwritten with the buffer address I got from the previous execution. (That means that I launched the first overflow, and I used gdb to find where the buffer resides in memory, that's where I got <0x00007fffffffddc0>).

The problem here is that the address above changes as the stack is always random. I think that is the reason why, at the end of the execution I get:

```<code>Invalid address 0x7fffffffddc0
</code>```

and the program sigfaults.
I need to build a strategy, but I am too inexperienced with this topic. How can I get away with this issue?


问:
Ghidra: Reference to external symbols not resolved in decompile
In main() the references to external functions are not resolved in the decompile window, while they seem correct in the assembly:

The other functions of the same application are fine, and the references to external and internal symbols are showed also in the decompile.

The references to internal functions are showed correctly also in main().

The application is for MIPS.

EDIT:
Context around the initialization of local_518:

```<code>                  //
                  // .text
                  // SHT_PROGBITS  [0xde0 - 0x7f6f]
                  // ram:00010de0-ram:00017f6f
                  //
                  **************************************************************
                  *                          FUNCTION                          *
                  **************************************************************
                  int __stdcall main(int argc, undefined4 * argv)
                       assume gp = 0x32030
                       assume t9 = 0x10de0
     int               v0:4           <RETURN>
     int               a0:4           argc
     undefined4 *      a1:4           argv
     undefined4        Stack[-0x4]:4  local_4          XREF[2]:     00010df8(W),
[CUT...]
     undefined4        Stack[-0x518   local_518        XREF[181]:   00010df4(W),
                                                                    00010e40(R),
                                                                    00010e60(R),
                                                                    00010e7c(R),
                                                                    00010e98(R),
                                                                    00010eb4(R),
                                                                    00010ed0(R),
                                                                    00010eec(R),
                                                                    00010f08(R),
                                                                    00010f24(R),
                                                                    00010f40(R),
                                                                    00010f5c(R),
                                                                    00010f80(R),
                                                                    00010f90(R),
                                                                    00010fb0(R),
                                                                    00010fd4(R),
                                                                    00010fe8(R),
                                                                    00010ffc(R),
                                                                    00011044(R),
                                                                    0001109c(R)
[CUT...]
     undefined4        Stack[-0x5b0   local_5b0        XREF[10]:    00011018(W),
                                                                    00011168(W),
                                                                    0001139c(W),
                                                                    000115d4(W),
                                                                    000116ec(W),
                                                                    00011b94(W),
                                                                    00011bfc(W),
                                                                    00011fa0(W),
                                                                    00012360(W),
                                                                    000124a8(W)
                     _ftext       XREF[4]:     Entry Point(*),
                     main                      __start:0001262c(*), 0002a048(*),
                                               _elfSectionHeaders::0000014c(*)
00010de0 02 00 1c 3c     lui        gp,0x2
     assume t9 = <UNKNOWN>
     assume gp = <UNKNOWN>
00010de4 50 12 9c 27     addiu      gp,gp,0x1250
00010de8 21 e0 99 03     addu       gp,gp,t9
00010dec 40 fa bd 27     addiu      sp,sp,-0x5c0
00010df0 02 00 82 28     slti       v0,argc,0x2
00010df4 a8 00 bc af     sw         gp=>_gp_1,local_518(sp)
00010df8 bc 05 bf af     sw         ra,local_4(sp)
00010dfc b8 05 be af     sw         s8,local_8(sp)
</code>```

Is there a way to fix this?


Title: How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

Body:
I am looking at the following CTF challenge:

```<code> 0x56555779 <+0>:   lea    ecx,[esp+0x4]
   0x5655577d <+4>: and    esp,0xfffffff0
   0x56555780 <+7>: push   DWORD PTR [ecx-0x4]
   0x56555783 <+10>:    push   ebp
   0x56555784 <+11>:    mov    ebp,esp
   0x56555786 <+13>:    push   ebx
   0x56555787 <+14>:    push   ecx
   0x56555788 <+15>:    sub    esp,0x40
   0x5655578b <+18>:    call   0x56555600 <__x86.get_pc_thunk.bx>
   0x56555790 <+23>:    add    ebx,0x1820
   0x56555796 <+29>:    mov    eax,DWORD PTR [ebx+0x44]
   0x5655579c <+35>:    mov    eax,DWORD PTR [eax]
   0x5655579e <+37>:    push   0x0
   0x565557a0 <+39>:    push   0x0
   0x565557a2 <+41>:    push   0x2
   0x565557a4 <+43>:    push   eax
   0x565557a5 <+44>:    call   0x56555580 <setvbuf@plt>
   0x565557aa <+49>:    add    esp,0x10
=> 0x565557ad <+52>:    mov    DWORD PTR [ebp-0xc],0x2
   0x565557b4 <+59>:    mov    DWORD PTR [ebp-0x10],0x0
   0x565557bb <+66>:    sub    esp,0xc
   0x565557be <+69>:    lea    eax,[ebx-0x1620]
   0x565557c4 <+75>:    push   eax
   0x565557c5 <+76>:    call   0x56555550 <puts@plt>
   0x565557ca <+81>:    add    esp,0x10
   0x565557cd <+84>:    sub    esp,0xc
   0x565557d0 <+87>:    lea    eax,[ebx-0x15b5]
   0x565557d6 <+93>:    push   eax
   0x565557d7 <+94>:    call   0x56555550 <puts@plt>
   0x565557dc <+99>:    add    esp,0x10
   0x565557df <+102>:   mov    eax,DWORD PTR [ebx+0x40]
   0x565557e5 <+108>:   mov    eax,DWORD PTR [eax]
   0x565557e7 <+110>:   sub    esp,0x4
   0x565557ea <+113>:   push   eax
   0x565557eb <+114>:   push   0x2b
   0x565557ed <+116>:   lea    eax,[ebp-0x3b]
   0x565557f0 <+119>:   push   eax
   0x565557f1 <+120>:   call   0x56555530 <fgets@plt>
   0x565557f6 <+125>:   add    esp,0x10
   0x565557f9 <+128>:   sub    esp,0x8
   0x565557fc <+131>:   lea    eax,[ebx-0x159f]
   0x56555802 <+137>:   push   eax
   0x56555803 <+138>:   lea    eax,[ebp-0x3b]
   0x56555806 <+141>:   push   eax
   0x56555807 <+142>:   call   0x56555510 <strcmp@plt>
   0x5655580c <+147>:   add    esp,0x10
   0x5655580f <+150>:   test   eax,eax
   0x56555811 <+152>:   je     0x5655582f <main+182>
   0x56555813 <+154>:   sub    esp,0xc
   0x56555816 <+157>:   lea    eax,[ebx-0x1584]
   0x5655581c <+163>:   push   eax
   0x5655581d <+164>:   call   0x56555550 <puts@plt>
   0x56555822 <+169>:   add    esp,0x10
   0x56555825 <+172>:   sub    esp,0xc
   0x56555828 <+175>:   push   0x0
   0x5655582a <+177>:   call   0x56555560 <exit@plt>
   0x5655582f <+182>:   sub    esp,0xc
   0x56555832 <+185>:   lea    eax,[ebx-0x1564]
   0x56555838 <+191>:   push   eax
   0x56555839 <+192>:   call   0x56555550 <puts@plt>
   0x5655583e <+197>:   add    esp,0x10
   0x56555841 <+200>:   mov    eax,DWORD PTR [ebx+0x40]
   0x56555847 <+206>:   mov    eax,DWORD PTR [eax]
   0x56555849 <+208>:   sub    esp,0x4
   0x5655584c <+211>:   push   eax
   0x5655584d <+212>:   push   0x2b
   0x5655584f <+214>:   lea    eax,[ebp-0x3b]
   0x56555852 <+217>:   push   eax
   0x56555853 <+218>:   call   0x56555530 <fgets@plt>
   0x56555858 <+223>:   add    esp,0x10
   0x5655585b <+226>:   sub    esp,0x8
   0x5655585e <+229>:   lea    eax,[ebx-0x154d]
   0x56555864 <+235>:   push   eax
   0x56555865 <+236>:   lea    eax,[ebp-0x3b]
   0x56555868 <+239>:   push   eax
   0x56555869 <+240>:   call   0x56555510 <strcmp@plt>
   0x5655586e <+245>:   add    esp,0x10
   0x56555871 <+248>:   test   eax,eax
   0x56555873 <+250>:   je     0x56555891 <main+280>
   0x56555875 <+252>:   sub    esp,0xc
   0x56555878 <+255>:   lea    eax,[ebx-0x1584]
   0x5655587e <+261>:   push   eax
   0x5655587f <+262>:   call   0x56555550 <puts@plt>
   0x56555884 <+267>:   add    esp,0x10
   0x56555887 <+270>:   sub    esp,0xc
   0x5655588a <+273>:   push   0x0
   0x5655588c <+275>:   call   0x56555560 <exit@plt>
   0x56555891 <+280>:   sub    esp,0xc
   0x56555894 <+283>:   lea    eax,[ebx-0x1534]
   0x5655589a <+289>:   push   eax
   0x5655589b <+290>:   call   0x56555550 <puts@plt>
   0x565558a0 <+295>:   add    esp,0x10
   0x565558a3 <+298>:   sub    esp,0xc
   0x565558a6 <+301>:   lea    eax,[ebp-0x3b]
   0x565558a9 <+304>:   push   eax
   0x565558aa <+305>:   call   0x56555520 <gets@plt>
   0x565558af <+310>:   add    esp,0x10
   0x565558b2 <+313>:   cmp    DWORD PTR [ebp-0x10],0xdea110c8
   0x565558b9 <+320>:   jne    0x565558c2 <main+329>
   0x565558bb <+322>:   call   0x565556fd <print_flag>
   0x565558c0 <+327>:   jmp    0x565558d4 <main+347>
   0x565558c2 <+329>:   sub    esp,0xc
   0x565558c5 <+332>:   lea    eax,[ebx-0x1584]
   0x565558cb <+338>:   push   eax
   0x565558cc <+339>:   call   0x56555550 <puts@plt>
   0x565558d1 <+344>:   add    esp,0x10
   0x565558d4 <+347>:   mov    eax,0x0
   0x565558d9 <+352>:   lea    esp,[ebp-0x8]
   0x565558dc <+355>:   pop    ecx
   0x565558dd <+356>:   pop    ebx
   0x565558de <+357>:   pop    ebp
   0x565558df <+358>:   lea    esp,[ecx-0x4]
   0x565558e2 <+361>:   ret
End of assembler dump.
</code>```

Ghidra decompiler shows me this:

```<code>{
  int iVar1;
  char user_buf [43];
  int overwrite_me;
  undefined4 local_14;
  undefined *local_10;

  local_10 = &stack0x00000004;
  setvbuf(stdout,(char *)0x2,0,0);
  local_14 = 2;
  overwrite_me = 0;
  puts(
        "Stop! Who would cross the Bridge of Death must answer me these questions three, ere the other  side he see."
        );
  puts("What... is your name?");
  fgets(user_buf,0x2b,stdin);
  iVar1 = strcmp(user_buf,"Sir Lancelot of Camelot\n");
  if (iVar1 != 0) {
     puts("I don\'t know that! Auuuuuuuugh!");
                            /* WARNING: Subroutine does not return */
     exit(0);
  }
  puts("What... is your quest?");
  fgets(user_buf,0x2b,stdin);
  iVar1 = strcmp(user_buf,"To seek the Holy Grail.\n");
  if (iVar1 != 0) {
     puts("I don\'t know that! Auuuuuuuugh!");
                            /* WARNING: Subroutine does not return */
     exit(0);
  }
  puts("What... is my secret?");
  gets(user_buf);
  if (overwrite_me == -0x215eef38) {
     print_flag();
  }
  else {
     puts("I don\'t know that! Auuuuuuuugh!");
  }
  return 0;
}
</code>```

Ok, some of those vars I obviously named, but the decompiler knows that there's an int, followed by a 43-byte char buffer, followed by an int up at the top of the function. How do decompilers and disassemblers learn this info? By looking at the disassembly in gdb, I do not know that the buffer is 43 bytes for example because there is a single sub esp, 0x40 instruction, which overs all of that in one motion. However, I can infer the size based on these instructions:

```<code>   0x565557eb <+114>:   push   0x2b
   0x565557ed <+116>:   lea    eax,[ebp-0x3b]
</code>```

However, in some situations, it may not be that obvious.

NOTE: I am not trying to solve this challenge, I've already solved it - this is a curiosity/educational question.


问:
Extracting contents of unknown file format
I would love some help on working with this file format.

I have this archived file from this abandonware game that I like to mess around with, and I have tried all sorts to try and expand it to extract the files from inside (They are .vag audio files).

I am lost on what to do from now on. I have tried using TrID but no result from it. I have also tried using software like WinRAR, 7-zip etc, which cannot recognise the file.

I do not think this is a known file extension since I have never seen it anywhere before, and the internet has no idea what it is when I try to search about it.

I'd also love to ideally create an extraction tool so I can extract content from other file types ending in this .xbd format.

I will really appreciate any help given, thank you :)

.xbd file download (OneDrive)


问:
How to leak buffer address on the stack?
I am new to buffer overflows and I was trying to overwrite the saved RIP to point to a buffer containing a shellcode. The buffer is located onto the stack so its address is randomized. How can I leak it?</p>


问:
How to use IDA pro to convert a batch of binary PE files into assembly code?
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?</p>


问:
Reversing Novation's Circuit Tracks firmware
Motivation:

The Circuit Tracks is a great little groovebox made by Novation, but it feels like they intentionally limited it's capabilities. They also sell the Circuit Rhythm, which has some of the features the Tracks is missing but lacks others. It has several MIDI outputs and would make a fantastic MIDI controller, but it's firmware only allows the intended use (many users feel this way).

First steps:

The Circuit Track's firmware can be updated using the Components website (and a standalone version) via MIDI Sysex messages. This led me to discover a bunch of their firmwares, all directly accessible with incrementing indices :)

NOTE: This link won't work without the authetication from Components:
https://circuit-librarian.s3.eu-west-1.amazonaws.com/uploads/firmware/file/89/circuittracks-firmware-3891.syx

I was able to download the firmware as a .syx file (416 KB) and first tried running binwalk. No results. As I'm pretty new to this kind of reverse engineering I'm not quite sure how to continue.
As I understand it, the file probably is compressed and/or encrypted. Looking at it with binvis.io yields an interesting pattern, though I have no idea what to make of it or whether it holds any relevance:

So my question is: How/where should I continue? I'm thankful for any kind of pointer, even if it's related literature/resources so I'll have some clue :)


问:
plugin/script for radare2 similar to mona for immunity debugger
I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a plugin/script that I am not aware of? Or is there a better way to do it in general?</p>


问:
Can't view instructions inside the dll main function

I have a dll that is loaded by the program i'm reverse engineering, this dll only contains .text section without any exported functions, my guess is that dll main function contains something interesting. I have a breakpoint trigger when the dll is loaded with the LoadLibraryA function and can see the EIP jump to the beginning of .text section of the dll, and see all the register update as the code is executed inside the dll, however, the instructions I'm looking at seem to not change and still are in the address of the program. also worth mentioning is that the dll is not loaded at the requested address so idk if it's a bug or what, I'm using x32dbg. Any help would be greatly appreciated, thanks


问:
Cutter cannot parse AUTDA instruction
I work on reverse engineering of an iOS software using Cutter, and receive several opcodes as "invalid". For example:

```<code><addr>      301ac1da               invalid
</code>```

Looking up the hex code, I found out this is the AUTDA instruction. Seems like for some reason Cutter / rizin cannot parse this kind of instructions.

I tried to write pd in the console directly, but it gave the same results.
Version info:

```<code>Version 2.1.2
Using rizin 0.4.1 (9023f8b)
Based on Qt 5.15.5 (Clang 13.0 (Apple), 64 bit)
Optional Features:
Python: ON
Python Bindings: ON
</code>```

Is there a way to make Cutter recognize this instruction?

Title: Cutter cannot parse AUTDA instruction


问:
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.

This is my python script:

```<code>import sys
import idc
import idautils

f = open(idc.ARGV[1], 'w') if len(idc.ARGV) > 1 else sys.stdout
log = f.write

# log current file path
log(idc.get_input_file_path() + '\n')

# wait for auto-analysis to complete
idc.auto_wait()

# count functions
log( 'count %d\n' % len(list(idautils.Functions())) )

for func in idautils.Functions():
    flags = idc.get_func_attr(func, FUNCATTR_FLAGS)
    if flags & FUNC_LIB or flags & FUNC_THUNK:
        continue
    dism_addr = list(idautils.FuncItems(func))
    for line in dism_addr:
        #log(idc.print_insn_mnem(line) + '\n' )
        disass = idc.generate_disasm_line(line, 0)
        log(disass + '\n' )

# if logging to a file, close it and exit IDA Pro
if f != sys.stdout:
    f.close()
    idc.qexit(0)

</code>```

I'm using this script with the batch mode of IDA Pro 7.7sp1, can you suggest me a method to do it?
Thank you in advance.


问:
Reverse engineering of Process manager apk
Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is obfuscated and I don’t know how can proceed</p>


问:
Data placement in memory
I am playing with buffer overflow attacks in C. I have the following code:

```<code>int foo(void*, void*);        // Calculates the distance (in bytes) between two addresses in memory

int main(int argc, char** argv) {
   int a = 15;
   int b = 16;
   int c = 90;

   char buffer[4];

   /* Memory layout */
   printf("[LAYOUT]\n");
   printf("foo(&a, &b) is %d\n", foo(&a, &b));
   printf("foo(&a, &c) is %d\n", foo(&a, &c));
   printf("foo(&c, &string) is %d\n", foo(&c, &string));
   printf("foo(&a, &string) is %d\n\n", foo(&a, &string));

   /* Memory content before copying into the buffer */
   printf("[BEFORE]\n");
   printf("a is at %p and is %d (0x%08x)\n", &a, a, a);
   printf("b is at %p and is %d (0x%08x)\n", &b, b, b);
   printf("c is at %p and is %d (0x%08x)\n", &c, c, c);
   printf("string is at %p and is %s\n\n", &string, string);

   strcpy(buffer, "aaaaaaaaa");

   /* Memory content after copying into the buffer */
   printf("[AFTER]\n");
   printf("a is at %p and is %d (0x%08x)\n", &a, a, a);
   printf("b is at %p and is %d (0x%08x)\n", &b, b, b);
   printf("c is at %p and is %d (0x%08x)\n", &c, c, c);
   printf("string is at %p and is %s\n", &string, string);

   return EXIT_SUCCESS;
}

int foo(void* addr_1, void* addr_2) {
   return (addr_1 - addr_2);
}
</code>```

After the compilation with gcc main.c -o main -O0 -g -fno-stack-protector -D_FORTIFY_SOURCE=0 flags with optimization turned off, the output is following (on my machine):

```<code>[LAYOUT]
foo(&a, &b) is 4
foo(&a, &c) is 8
foo(&c, &string) is 4
foo(&a, &string) is 12

[BEFORE]
a is at 0x7ffee13d5b68 and is 16 (0x00000010)
b is at 0x7ffee13d5b64 and is 15 (0x0000000f)
c is at 0x7ffee13d5b60 and is 90 (0x0000005a)
string is at 0x7ffee13d5b5c and is

[AFTER]
a is at 0x7ffee13d5b68 and is 16 (0x00000010)
b is at 0x7ffee13d5b64 and is 97 (0x00000061)
c is at 0x7ffee13d5b60 and is 1633771873 (0x61616161)
string is at 0x7ffee13d5b5c and is aaaaaaaaa
</code>```

Obviously, the buffer is located at the leftmost position, before integer variables. I can think of it as:

0x5c
0x5d
0x5e
0x5f
0x60
0x61
0x62
0x63
0x64

0x61
0x61
0x61
0x61
0x61
0x61
0x61
0x61
0x61

It completely overwrites c's data (all four bytes) and the one byte of b's data (little-endian machine).

After compiling the same program with the optimization turned on, -O1 for example, it produces the output:

```<code>[LAYOUT]
foo(&a, &b) is -4
foo(&a, &c) is -8
foo(&c, &string) is 12
foo(&a, &string) is 4

[BEFORE]
a is at 0x7ffee056db3c and is 16 (0x00000010)
b is at 0x7ffee056db40 and is 15 (0x0000000f)
c is at 0x7ffee056db44 and is 90 (0x0000005a)
string is at 0x7ffee056db38 and is

[AFTER]
a is at 0x7ffee056db3c and is 1633771873 (0x61616161)
b is at 0x7ffee056db40 and is 97 (0x00000061)
c is at 0x7ffee056db44 and is 90 (0x0000005a)
string is at 0x7ffee056db38 and is aaaaaaaaa
</code>```

It seems to me that integer variables are placed in memory in reversed order.

The questions are:

How does a variable declaration and/or initialization in C affect its placement in memory?

Does the optimization affect on variable placement in memory? If so, then how?

The working environment is macOS Mojave 10.14.6, Apple LLVM version 10.0.1 (clang-1001.0.46.4)

Title: Data placement in memory


Title: PDF file have two trailers?

Body:
If I analyse multiple PDF files with a hex editor, I see that all of them have two trailers.
That's possible if an object has changed or renewed (https://blog.idrsolutions.com/multiple-trailers-in-a-pdf-file/), but in my case, the PDF files are not edited.
Does anyone know why all of the analysed files have two trailers?

This is a PDF file that contains a lot of text and also two images:

```<code>0001a30bh: 74 72 61 69 6C 65 72 0D 0A 3C 3C 2F 53 69 7A 65 ; trailer..<</Size
0001a31bh: 20 34 37 2F 52 6F 6F 74 20 31 20 30 20 52 2F 49 ;  47/Root 1 0 R/I
0001a32bh: 6E 66 6F 20 31 35 20 30 20 52 2F 49 44 5B 3C 45 ; nfo 15 0 R/ID[<E
0001a33bh: 42 33 46 46 33 41 31 45 33 37 33 43 36 34 45 39 ; B3FF3A1E373C64E9
0001a34bh: 31 30 45 33 46 42 43 34 45 37 38 39 31 33 43 3E ; 10E3FBC4E78913C>
0001a35bh: 3C 45 42 33 46 46 33 41 31 45 33 37 33 43 36 34 ; <EB3FF3A1E373C64
0001a36bh: 45 39 31 30 45 33 46 42 43 34 45 37 38 39 31 33 ; E910E3FBC4E78913
0001a37bh: 43 3E 5D 20 3E 3E 0D 0A 73 74 61 72 74 78 72 65 ; C>] >>..startxre
0001a38bh: 66 0D 0A 31 30 36 33 32 33 0D 0A 25 25 45 4F 46 ; f..106323..%%EOF
0001a39bh: 0D 0A 78 72 65 66 0D 0A 30 20 30 0D 0A 74 72 61 ; ..xref..0 0..tra
0001a3abh: 69 6C 65 72 0D 0A 3C 3C 2F 53 69 7A 65 20 34 37 ; iler..<</Size 47
0001a3bbh: 2F 52 6F 6F 74 20 31 20 30 20 52 2F 49 6E 66 6F ; /Root 1 0 R/Info
0001a3cbh: 20 31 35 20 30 20 52 2F 49 44 5B 3C 45 42 33 46 ;  15 0 R/ID[<EB3F
0001a3dbh: 46 33 41 31 45 33 37 33 43 36 34 45 39 31 30 45 ; F3A1E373C64E910E
0001a3ebh: 33 46 42 43 34 45 37 38 39 31 33 43 3E 3C 45 42 ; 3FBC4E78913C><EB
0001a3fbh: 33 46 46 33 41 31 45 33 37 33 43 36 34 45 39 31 ; 3FF3A1E373C64E91
0001a40bh: 30 45 33 46 42 43 34 45 37 38 39 31 33 43 3E 5D ; 0E3FBC4E78913C>]
0001a41bh: 20 2F 50 72 65 76 20 31 30 36 33 32 33 2F 58 52 ;  /Prev 106323/XR
0001a42bh: 65 66 53 74 6D 20 31 30 35 39 37 32 3E 3E 0D 0A ; efStm 105972>>..
0001a43bh: 73 74 61 72 74 78 72 65 66 0D 0A 31 30 37 34 32 ; startxref..10742
0001a44bh: 31 0D 0A 25 25 45 4F 46                         ; 1..%%EOF
</code>```

This is a PDF file that does only contain some random characters:

```<code>000071cbh: 74 72 61 69 6C 65 72 0D 0A 3C 3C 2F 53 69 7A 65 ; trailer..<</Size
000071dbh: 20 32 33 2F 52 6F 6F 74 20 31 20 30 20 52 2F 49 ;  23/Root 1 0 R/I
000071ebh: 6E 66 6F 20 39 20 30 20 52 2F 49 44 5B 3C 39 46 ; nfo 9 0 R/ID[<9F
000071fbh: 46 31 32 45 31 43 30 41 35 36 44 42 34 38 41 33 ; F12E1C0A56DB48A3
0000720bh: 41 31 43 37 32 30 33 38 32 33 30 32 45 32 3E 3C ; A1C720382302E2><
0000721bh: 39 46 46 31 32 45 31 43 30 41 35 36 44 42 34 38 ; 9FF12E1C0A56DB48
0000722bh: 41 33 41 31 43 37 32 30 33 38 32 33 30 32 45 32 ; A3A1C720382302E2
0000723bh: 3E 5D 20 3E 3E 0D 0A 73 74 61 72 74 78 72 65 66 ; >] >>..startxref
0000724bh: 0D 0A 32 38 36 35 39 0D 0A 25 25 45 4F 46 0D 0A ; ..28659..%%EOF..
0000725bh: 78 72 65 66 0D 0A 30 20 30 0D 0A 74 72 61 69 6C ; xref..0 0..trail
0000726bh: 65 72 0D 0A 3C 3C 2F 53 69 7A 65 20 32 33 2F 52 ; er..<</Size 23/R
0000727bh: 6F 6F 74 20 31 20 30 20 52 2F 49 6E 66 6F 20 39 ; oot 1 0 R/Info 9
0000728bh: 20 30 20 52 2F 49 44 5B 3C 39 46 46 31 32 45 31 ;  0 R/ID[<9FF12E1
0000729bh: 43 30 41 35 36 44 42 34 38 41 33 41 31 43 37 32 ; C0A56DB48A3A1C72
000072abh: 30 33 38 32 33 30 32 45 32 3E 3C 39 46 46 31 32 ; 0382302E2><9FF12
000072bbh: 45 31 43 30 41 35 36 44 42 34 38 41 33 41 31 43 ; E1C0A56DB48A3A1C
000072cbh: 37 32 30 33 38 32 33 30 32 45 32 3E 5D 20 2F 50 ; 720382302E2>] /P
000072dbh: 72 65 76 20 32 38 36 35 39 2F 58 52 65 66 53 74 ; rev 28659/XRefSt
000072ebh: 6D 20 32 38 33 37 34 3E 3E 0D 0A 73 74 61 72 74 ; m 28374>>..start
000072fbh: 78 72 65 66 0D 0A 32 39 32 37 35 0D 0A 25 25 45 ; xref..29275..%%E
0000730bh: 4F 46                                           ; OF
</code>```


问:
Specifying struct offsets in Ghidra
I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view.

Here's one instruction I'm looking at.

```<code>        00010042 33 7c 00        move.w     #0x2,(0x1c,A1)
                 02 00 1c
</code>```

A1 points to a struct, and 2 is the value being written to a specific field of that struct.

Now I can use E to specify that a particular value is an equ, which is what I'll be doing with the #0x2 here.

But what about when a value is a struct offset, as is the case with the 0x1c?

I happen to know what sort of struct A1 points to, and I've set up this struct in the structure editor. And Ghidra clearly knows that 0x1c is a value that corresponds to the offset of a particular word-size member of at least one struct in its struct database.

So how do I tell it that the 0x1c offset in this particular instruction refers to some field in some struct? Ideally I'd expect it to be able work through its struct database, find all the fields in all the structs that have an offset of 0x1c, and let me select which particular field I think this offset is. Then render it appropriately, e.g., something like move.w #0x2,(IOStdReq.io_Message.io_Command,A1).

Title: Specifying struct offsets in Ghidra


问:
Tracing without breakpoints
I need:

To start tracing without breakpoints.

To do something in a program.

To stop tracing. This step may be replaced with a breakpoint but not the first step.

The thing is I need to do some actions in a program during tracing. I can't do this while it is paused.

How to do this in OllyDbg?

What debuggers support this if not this one?

Title: Tracing without breakpoints


问:
After jumping to a new segment, it warns "The memory could not be written"
I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that "The memory could not be written" and the procedure is aborted.

I'm sure I've enabled the patch. But I can see in runtime that Hex View shows that memory of the address in the new seg that I jump to remains "00 00 00 00 ..."(Not my codes added).

So, how can I figure it out? Or maybe there's no solution cuz I've googled this problem for nearly 6hrs. Only one question relates to it, and the solution is using another debugger, but I want to add a new seg into the binary file.


问:
How can I create a patch to insert a menu into an executable file which does not have a menu?
I need help writing a patch that inserts a menu into an application which does not have one. When I an executable file in a resource editor, I found the menu and I saved the file again and it doesn't show up. I then used OllyDbg to disassemble the executable and wrote the wrong code, saved it. When I clicked the application, it still does not show up. And I do not know how to write a proper patch for this. What else should I do if none of the options work?

I used HxD for hex editing for making the menu appear (I was hoping to see the manu) by adding the commands

CreateMenu
LoadMenu
AppendMenu
InsertMenuItem...

but nothing worked. Can anyone help me?


问:
I am trying to develop a second version of SkiFree using OllyDbg. How can I add a new enemy or obstacle without the source code?
I am a programmer and reverse engineer. I am interested in reverse engineering SkiFree since it is free to use.

However I have been wondering how to add a new enemy or obstacle since I do not have the original source code.

I tried contacting the Cheese (Chris Pirih) for the source code as he is the developer of the game. But no reply. Anyway, he gave me permission to toy around with the game rather than the source code.

Is there any way to add the code using OllyDbg? I been looking for a way.


问:
Anti Dumping Techniques (C++)
how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle?

I tried this already but it didnt work. Scylla could still dump it fine.

Title: Anti Dumping Techniques (C++)


问:
Extract disassembly from Ghidra for reassembling
How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc. to a point where I would like to check my work.

Further to the question and answer in Extracting Assembly line code from an executable in Ghidra I would like to extract line labels, plate comments and EOL comments.

Here is an example:

Here's what I'd like the extracted code to look like:

```<code>; Extracted data blocks
STATUS_STRING_BUFFER:
        dc.b 0
        dc.b 0
        dc.b 0
        dc.b 0
; etc
CURRENT_STATUS_MESSAGE_CODE:
        dc.b 0

; Extracted subroutine
**************************************************************
* Display a message in the status bar                        *
**************************************************************
DisplayStatusMessage:
        movem.l {a2, a1, d5},-(sp)
        lea STATUS_STRING_BUFFER, a1
        clr.w d0
        move.b (a0)+,d0
        move.b d0,CURRENT_STATUS_MESSAGE_CODE    ; Store Message byte
        andi.b #$7f                              ; Mask out msb
        ; ... etc
</code>```

As you can see there are a number of things to do including:

Extract data blocks

Convert db, dw, ddw to dc.b, dc.w, dc.l

Convert hex from 0xNN to $NN notation

Extract plate comments

Extract labels

Extract disassembled code lines

Extract EOL comments

Is there a readily available script for this or can someone show a working example?


问:
Multi Thread communication disassembly
is there any article or guide when it comes to reverse engineering Multi-Threaded processe?</p>

Title: Multi Thread communication disassembly


问:
rooting D-link DIR-x5460 - Weird Firmware
I have a D-link DIR-X5460 and I'm trying to get a shell on it.
I connected to the UART interface and tried some default passwords, but none work.

I downloaded the FW from D-link's website, decrypted it with the key and IV I found online.

Now I have the unencrypted image, but i cannot extract the squashfs from it. I tried binwalk, sasquatch, FMK, compiling the unsquashfs from the GPL code, nothing.
This is the binwalk of the unencrypted image:

```<code>266283        0x4102B         Flattened device tree, size: 5108 bytes, version: 17
271426        0x42442         Flattened device tree, size: 5470 bytes, version: 17
625871        0x98CCF         Copyright string: "Copyright (C) 2000-2015 Broadcom Corporation."
627179        0x991EB         HTML document header
627370        0x992AA         HTML document footer
674443        0xA4A8B         SHA256 hash constants, little endian
711103        0xAD9BF         HTML document header
713942        0xAE4D6         HTML document footer
713955        0xAE4E3         HTML document header
715939        0xAECA3         HTML document footer
715951        0xAECAF         CRC32 polynomial table, little endian
717058        0xAF102         LZMA compressed data, properties: 0x6D, dictionary size: 4194304 bytes, uncompressed size: 5762720 bytes
3016720       0x2E0810        UBI volume ID header, version: 1, type: 1, volume id: 1, size: 0
3147792       0x300810        UBI volume ID header, version: 1, type: 1, volume id: 2, size: 0
3278864       0x320810        UBI volume ID header, version: 1, type: 1, volume id: 0, size: 0
3280912       0x321010        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 29888442 bytes, 2151 inodes, blocksize: 131072 bytes, created: 2020-08-25 11:23:30
33195040      0x1FA8420       xz compressed data
33223212      0x1FAF22C       xz compressed data
33234176      0x1FB1D00       xz compressed data
33253000      0x1FB6688       xz compressed data
33344792      0x1FCCD18       xz compressed data
33411784      0x1FDD2C8       xz compressed data
33837338      0x204511A       xz compressed data
33849478      0x2048086       xz compressed data
33868214      0x204C9B6       xz compressed data
33897958      0x2053DE6       xz compressed data
33959366      0x2062DC6       xz compressed data
33989914      0x206A51A       xz compressed data
34037650      0x2075F92       xz compressed data
34061970      0x207BE92       xz compressed data
34085516      0x2081A8C       xz compressed data
34087934      0x20823FE       xz compressed data
34090156      0x2082CAC       xz compressed data
34091922      0x2083392       xz compressed data
34093628      0x2083A3C       xz compressed data
34095466      0x208416A       xz compressed data
34097948      0x2084B1C       xz compressed data
34100350      0x208547E       xz compressed data
34102444      0x2085CAC       xz compressed data
34104214      0x2086396       xz compressed data
34108740      0x2087544       xz compressed data
34111974      0x20881E6       xz compressed data
34115608      0x2089018       xz compressed data
34119526      0x2089F66       xz compressed data
34123396      0x208AE84       xz compressed data
34126462      0x208BA7E       xz compressed data
34127496      0x208BE88       xz compressed data
34129518      0x208C66E       xz compressed data
34131552      0x208CE60       xz compressed data
</code>```

I'm not sure that I'm dissecting the right areas in the FW. When I'm trying to unsquash, should I also include the UBI headers? or the xz data in the end?

I would highly appreciate any help or insight on this.


问:
IDA api: get function argument definition
So let's say we have the following code:

```<code>0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
</code>```

i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in this case.

I tried getting the addresses of the arguments with:

```<code>addrs = idaapi.get_arg_addrs(3)
</code>```

but that returns the address of mov rcx, rax. From that i would need something like the use-definition chain on rax, which i couldn't find if supported by ida.

my ultimate goal is to cast all the arguments to my_fun calls to a specific type.
so here, i want to change the type of the local var [ebp+8] to another type


问:
Reverse engineering and exactly re-creating a QR code
The Casio FX-991EX calculator has a QR code feature for accessing the current equation from another device. It supports version 3 QR codes for some menus and version 11 for most menus.

For example, using version 11 with this feature for 1+2 in Calculate mode produces a QR code linking here. I have taken a photo of the QR code, shown below, but my camera quality is quite poor. I have also made several edits of the image, also shown below.

Original photo:

Photo edited to be easier to scan and reference. The changes I made include making it monochrome, rotating it and increasing the contrast.

QR code re-created as a pixel image. Keep in mind that, while I spent a few hours producing and double-checking this, there are several errors. However, it scans correctly, so it should be close enough to compare with.

Re-creation color-coded to indicate primary features of the QR code:

I am wanting to reverse-engineer these QR codes so that I can calculate an equation to produce a QR code with a specific image in order to display this image on the calculator. I'm aware that I won't be able to control lots of the QR code's pixels, but theoretically I'd be able to at the very least brute-force the closest QR code to a given image.

I've found that the QR code uses 0 error correction and a mask pattern of 4. I've used a Python QR code library to produce a QR code using these same settings (code and result shown below).

```<code>from qrcode import QRCode
link = 'http://wes.casio.com/math/index.php?q=I-235F+U-000A00673394+M-C10000AD00+S-001410110000100E1010B00035DE+R-0300000000000000010000000000000000000000+E-31A632'
qr = QRCode(version=11,error_correction=0,mask_pattern=4)
qr.add_data(link)
qr.print_ascii(invert=True)
</code>```

However, it is clearly different to the original QR code. I produced a difference map between the generated and original QR code:

As you can see, all the format and version info is identical and they link to the same URL, but the actual data is completely different. Even the encoding type, ECI type and length are the same. So where do I go from here? What could be causing such a difference between the two codes?


问:
Corrupted IDA database .i64 file (Empty Header)
Im my 10 years using IDA Pro this never happend.

I saved using IDA Pro 7.7 when I go to open today
I find out that IDA PRO didnt put header on file

If I try to open says "File .... is not an IDA database" for obvious reasons.

If I edit the header and add first 15 bytes from other database
"49 44 41 32 00 00 FC 00 00 00 00 00 00 00 05" IDA opens the file and starts unpacking but  then I get error "bTree error: bad B-tree header"

Its possible to recover or rebuild the header?

2 Images to explain what is missing on the IDA database file


问:
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :

```<code>callq *0x1de15(%rip)
</code>```

I have understood from previous answers that those instructions might be a reference to an import. I'm interested into compositing a list of import that the program uses.

However, I do not understand how I could translate that address to the name of Import. I know that "jumping to that address (?) I can find a stub" but I do not know how to handle that. I have parsed the import table.

Is there a way to connect that address to import name?


问:
Access to CPU registers in GMM space
AMD's BIOS and Kernel Developer’s Guide (BKDG) documents GMM registers and access to them:

GMMxXXXXX: GPU memory mapped registers; XXXXX specifies the hexadecimal byte address offset (this may be 2 to 5 digits) from the base address register; The base address for this space is specified by D1F0x18 [Graphics Memory Mapped Registers Base Address].

D1F0x18 has the following structure (I also add a column with values that I get):

Bits
My value
Description

31:18
0x3c08
BaseAddr[31:18]: base address.

17:16
0
BaseAddr[17:16]: base address.

15:4
0
BaseAddr[15:4]: base address.

3
0
prefetchable. 0=Non-prefetchable memory region.

2:1
0
base address register type. 00b=32-bit BAR. 10b=64-bit BAR.

0
0
memory space type. 0=Memory mapped base address.

How to properly access registers in the GMM space?

There are three base address fields in the D1F0x18 register, and the guide doesn't explain any further how to compile the base address. I tried to read memory (in Linux with root privileges) at the following memory offsets, but all of them return me Segmentation fault error.

```<code>printf("%02x\n", (unsigned)*(unsigned char*)0x3c08); // Base address itself
printf("%02x\n", (unsigned)*(unsigned char*)0x4378); // 0x3c08+0x770 (GMMx770)
printf("%02x\n", (unsigned)*(unsigned char*)0x4381); // 0x3c08+0x770+3

printf("%02x\n", (unsigned)*(unsigned char*)0x3c080000); // Base address appended with zeroes
printf("%02x\n", (unsigned)*(unsigned char*)0x3c080770); // plus GMMx770 offset
printf("%02x\n", (unsigned)*(unsigned char*)0x3c080773); // plus size of the GMMx770

printf("%02x\n", (unsigned)*(unsigned char*)0xf0200000); // 0x3c08 shifted left by 2 bits (so that to align 31:18 field to 16 bits)
printf("%02x\n", (unsigned)*(unsigned char*)0xf0200770); // plus GMMx770 offset
printf("%02x\n", (unsigned)*(unsigned char*)0xf0200773); // plus size GMMx770 offset

</code>```

Edit

There is a source code of the Coreboot project available on the Internet. <s>There are clear footprints that they implement access to the GMM space, but I couldn't extract the method from their code either.</s> The code gives some clues:

<s>It looks, like they use the base address as is, i.e. it is 0x3c080000 in my case.</s>

They set bits 0 and 1 in D1F0x04 so that apparently to enable access to the device's memory area (I have both of these bits set by default).

They read memory with __readfsdword. Because I am on GCC, I redefined this function as follows, but still get the Segmentation fault:

```<code>unsigned long __readfsdword(const unsigned long Offset)
{
    unsigned long value;
    __asm__ __volatile__("movl %%fs:%a[Offset], %k[value]" : [value] "=r" (value) : [Offset] "ir" (Offset));
    return value;
}
</code>```

Title: Access to CPU registers in GMM space


问:
How to list all references to memory from selected memory region in ghidra?
I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are any references to that peripheral.

Is there any way to find all references for given memory region at once to find all peripherals that are used? Preferably to multiple memory regions, since svd-loader script for ghidra groups peripherals into multiple memory regions.


问:
Ghidra: Ignoring partial resolution of indirect
The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile:

```<code>uint FUN_0004f404(int param_1)

{
  int iVar1;
  undefined4 local_820;
  undefined4 uStack2076;
  undefined4 uStack2072;
  undefined4 uStack2068;
  undefined4 local_810;
  undefined4 uStack2060;
  undefined4 local_808;
  undefined4 local_20;
  uint local_1c;
  undefined4 local_18;
  undefined2 local_14;
  undefined2 local_12;
  undefined4 local_10;
  undefined local_b;
  undefined local_a;
  undefined local_9;

  local_9 = 4;
  local_a = 3;
  local_18 = 0;
  local_14 = 0;
  local_20 = 0;
  local_1c = 0;
  local_10 = 0x80000300;
  local_12 = 7;
                    /* WARNING: Ignoring partial resolution of indirect */
  local_18._0_1_ = 0x55;
                    /* WARNING: Ignoring partial resolution of indirect */
  local_14._0_1_ = 7;
  local_b = 6;
  if (param_1 == 0xff) {
    iVar1 = somefunc((byte *)&local_18,6,&local_20,8);
...
</code>```

The ARM assembly for this section of code looks like:

```<code>                         *******************************************************
                         *                      FUNCTION                       *
                         *******************************************************
                         undefined FUN_0004f404()
           undefined       r0:1         <RETURN>
           undefined1      Stack[-0x9]  local_9                            XREF[3]:   0004f41c(W),
                                                                                0004f45c(R),
                                                                                0004f4c0(R)
           undefined1      Stack[-0xa]  local_a                            XREF[3]:   0004f424(W),
                                                                                0004f464(R),
                                                                                0004f4dc(R)
           undefined1      Stack[-0xb]  local_b                            XREF[13]:  0004f42c(W),
                                                                                0004f474(R),
                                                                                0004f47c(W),
                                                                                0004f490(R),
                                                                                0004f498(W),
                                                                                0004f4ac(R),
                                                                                0004f4b4(W),
                                                                                0004f4c8(R),
                                                                                0004f4d0(W),
                                                                                0004f4e4(R),
                                                                                0004f4ec(W),
                                                                                0004f504(R),
                                                                                0004f50c(W)
           undefined4      Stack[-0x10  local_10                           XREF[3]:   0004f458(W),
                                                                                0004f644(W),
                                                                                0004f648(R)
           undefined2      Stack[-0x12  local_12                           XREF[3]:   0004f470(W),
                                                                                0004f4f0(R),
                                                                                0004f514(R)
           undefined2      Stack[-0x14  local_14                           XREF[1]:   0004f43c(W)
           undefined4      Stack[-0x18  local_18                           XREF[1]:   0004f434(W)
           undefined4      Stack[-0x1c  local_1c                           XREF[2,1]: 0004f44c(W),
                                                                                0004f63c(R),
                                                                                0004f634(R)
           undefined4      Stack[-0x20  local_20                           XREF[1]:   0004f444(W)
           undefined2      Stack[-0x80  local_808                          XREF[1]:   0004f588(W)
           undefined4      Stack[-0x81  local_810                          XREF[1]:   0004f584(*)
           undefined4      Stack[-0x82  local_820                          XREF[2]:   0004f57c(*),
                                                                                0004f600(*)
           undefined4      Stack[-0x82  local_824                          XREF[3]:   0004f414(W),
                                                                                0004f530(R),
                                                                                0004f5cc(R)
           undefined4      Stack[-0x83  local_830                          XREF[1]:   0004f5c0(W)
                         FUN_0004f404                              XREF[1]:   other_func:000508a4
      0004f404 00 48 2d      stmdb     sp!,{r11 lr}
               e9
      0004f408 04 b0 8d      add       r11,sp,#0x4
               e2
      0004f40c 82 de 4d      sub       sp,sp,#0x820
               e2
      0004f410 08 d0 4d      sub       sp,sp,#0x8
               e2
      0004f414 20 08 0b      str       r0,[r11,#local_824]
               e5
      0004f418 04 30 a0      mov       r3,#0x4
               e3
      0004f41c 05 30 4b      strb      r3,[r11,#local_9]
               e5
      0004f420 03 30 a0      mov       r3,#0x3
               e3
      0004f424 06 30 4b      strb      r3,[r11,#local_a]
               e5
      0004f428 00 30 a0      mov       r3,#0x0
               e3
      0004f42c 07 30 4b      strb      r3,[r11,#local_b]
               e5
      0004f430 00 30 a0      mov       r3,#0x0
               e3
      0004f434 14 30 0b      str       r3,[r11,#local_18]
               e5
      0004f438 00 30 a0      mov       r3,#0x0
               e3
      0004f43c b0 31 4b      strh      r3,[r11,#local_14]
               e1
      0004f440 00 30 a0      mov       r3,#0x0
               e3
      0004f444 1c 30 0b      str       r3,[r11,#local_20]
               e5
      0004f448 00 30 a0      mov       r3,#0x0
               e3
      0004f44c 18 30 0b      str       r3,[r11,#local_1c]
               e5
      0004f450 03 3c a0      mov       r3,#0x300
               e3
      0004f454 00 30 48      movt      r3,#0x8000
               e3
      0004f458 0c 30 0b      str       r3,[r11,#local_10]
               e5
      0004f45c 05 30 5b      ldrb      r3,[r11,#local_9]
               e5
      0004f460 73 20 ff      uxth      r2,r3
               e6
      0004f464 06 30 5b      ldrb      r3,[r11,#local_a]
               e5
      0004f468 73 30 ff      uxth      r3,r3
               e6
      0004f46c 03 30 82      add       r3,r2,r3
               e0
      0004f470 be 30 4b      strh      r3,[r11,#local_12]
               e1
      0004f474 07 30 5b      ldrb      r3,[r11,#local_b]
               e5
      0004f478 01 20 83      add       r2,r3,#0x1
               e2
      0004f47c 07 20 4b      strb      r2,[r11,#local_b]
               e5
      0004f480 04 20 4b      sub       r2,r11,#0x4
               e2
      0004f484 03 30 82      add       r3,r2,r3
               e0
      0004f488 55 20 a0      mov       r2,#0x55
               e3
      0004f48c 10 20 43      strb      r2,[r3,#-0x10]
               e5
      0004f490 07 30 5b      ldrb      r3,[r11,#local_b]
               e5
      0004f494 01 20 83      add       r2,r3,#0x1
               e2
      0004f498 07 20 4b      strb      r2,[r11,#local_b]
               e5
      0004f49c 04 20 4b      sub       r2,r11,#0x4
               e2
      0004f4a0 03 30 82      add       r3,r2,r3
               e0
      0004f4a4 55 20 e0      mvn       r2,#0x55
               e3
      0004f4a8 10 20 43      strb      r2,[r3,#-0x10]
               e5
      0004f4ac 07 30 5b      ldrb      r3,[r11,#local_b]
               e5
      0004f4b0 01 20 83      add       r2,r3,#0x1
               e2
      0004f4b4 07 20 4b      strb      r2,[r11,#local_b]
               e5
      0004f4b8 04 20 4b      sub       r2,r11,#0x4
               e2
      0004f4bc 03 30 82      add       r3,r2,r3
               e0
      0004f4c0 05 20 5b      ldrb      r2,[r11,#local_9]
               e5
      0004f4c4 10 20 43      strb      r2,[r3,#-0x10]
               e5
      0004f4c8 07 30 5b      ldrb      r3,[r11,#local_b]
               e5
      0004f4cc 01 20 83      add       r2,r3,#0x1
               e2
      0004f4d0 07 20 4b      strb      r2,[r11,#local_b]
               e5
      0004f4d4 04 20 4b      sub       r2,r11,#0x4
               e2
      0004f4d8 03 30 82      add       r3,r2,r3
               e0
      0004f4dc 06 20 5b      ldrb      r2,[r11,#local_a]
               e5
      0004f4e0 10 20 43      strb      r2,[r3,#-0x10]
               e5
      0004f4e4 07 30 5b      ldrb      r3,[r11,#local_b]
               e5
      0004f4e8 01 20 83      add       r2,r3,#0x1
               e2
      0004f4ec 07 20 4b      strb      r2,[r11,#local_b]
               e5
      0004f4f0 be 20 5b      ldrh      r2,[r11,#local_12]
               e1
      0004f4f4 72 20 ef      uxtb      r2,r2
               e6
      0004f4f8 04 10 4b      sub       r1,r11,#0x4
               e2
      0004f4fc 03 30 81      add       r3,r1,r3
               e0
      0004f500 10 20 43      strb      r2,[r3,#-0x10]
               e5
      0004f504 07 30 5b      ldrb      r3,[r11,#local_b]
               e5
      0004f508 01 20 83      add       r2,r3,#0x1
               e2
      0004f50c 07 20 4b      strb      r2,[r11,#local_b]
               e5
      0004f510 03 10 a0      cpy       r1,r3
               e1
      0004f514 be 30 5b      ldrh      r3,[r11,#local_12]
               e1
      0004f518 23 34 a0      mov       r3,r3, lsr #0x8
               e1
      0004f51c 73 30 ff      uxth      r3,r3
               e6
      0004f520 73 20 ef      uxtb      r2,r3
               e6
      0004f524 04 30 4b      sub       r3,r11,#0x4
               e2
      0004f528 01 30 83      add       r3,r3,r1
               e0
      0004f52c 10 20 43      strb      r2,[r3,#-0x10]
               e5
      0004f530 20 38 1b      ldr       r3,[r11,#local_824]
               e5
      0004f534 ff 00 53      cmp       r3,#0xff
               e3
      0004f538 1d 00 00      bne       LAB_0004f5b4
               1a
      0004f53c 1c 20 4b      sub       r2,r11,#0x1c
               e2
      0004f540 14 00 4b      sub       r0,r11,#0x14
               e2
      0004f544 08 30 a0      mov       r3,#0x8
               e3
      0004f548 06 10 a0      mov       r1,#0x6
               e3
      0004f54c 44 fe ff      bl        stuff::somefunc                   undefined somefunc(
               eb
...
</code>```

I have no experience with assembly, and I'm having a difficult time trying to understand what is going on here.  I know that local_18 is supposed to contain an array of 6 bytes when it is passed to somefunc, and I need to understand what those bytes are.  Can anyone help me to decipher what is going on here?


问:
Assistance with dumped firmware image
I need some assistance in reverse engineering this dumped nor flash image.
binwalk yields this after norflash has been dumped (removed the flash chip, dumped it with CH341a and flashrom)

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
154192        0x25A50         CRC32 polynomial table, big endian
245762        0x3C002         PEM certificate
249501        0x3CE9D         PEM certificate
250882        0x3D402         PEM RSA private key
251906        0x3D802         PEM certificate
256542        0x3EA1E         PEM certificate
258050        0x3F002         PEM RSA private key
262144        0x40000         JFFS2 filesystem, big endian
9849380       0x964A24        JFFS2 filesystem, big endian
9863608       0x9681B8        JFFS2 filesystem, big endian
9863852       0x9682AC        Zlib compressed data, compressed
9864052       0x968374        JFFS2 filesystem, big endian
9865340       0x96887C        Zlib compressed data, compressed
9870836       0x969DF4        JFFS2 filesystem, big endian
9876384       0x96B3A0        Zlib compressed data, compressed
9878400       0x96BB80        Zlib compressed data, compressed
9880236       0x96C2AC        Zlib compressed data, compressed
9881684       0x96C854        Zlib compressed data, compressed
9882988       0x96CD6C        Zlib compressed data, compressed
9883992       0x96D158        Zlib compressed data, compressed
9885124       0x96D5C4        Zlib compressed data, compressed
9886064       0x96D970        Zlib compressed data, compressed
9887200       0x96DDE0        Zlib compressed data, compressed
9887672       0x96DFB8        Zlib compressed data, compressed
9893276       0x96F59C        Zlib compressed data, compressed
9894424       0x96FA18        JFFS2 filesystem, big endian
9894896       0x96FBF0        JFFS2 filesystem, big endian
9895936       0x970000        JFFS2 filesystem, big endian
10028120      0x990458        JFFS2 filesystem, big endian
10041496      0x993898        Zlib compressed data, compressed
10044320      0x9943A0        JFFS2 filesystem, big endian
10048664      0x995498        JFFS2 filesystem, big endian
10049940      0x995994        JFFS2 filesystem, big endian
21233664      0x1440000       uImage header, header size: 64 bytes, header CRC: 0xD3221C35, created: 2018-04-09 21:38:35, image size: 1399199 bytes, Data Address: 0x80002000, Entry Point: 0x80224EB0, data CRC: 0x296FC3A7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: gzip, image name: "Linux Kernel Image"
21233728      0x1440040       gzip compressed data, maximum compression, has original file name: "vmlinux.bin", from Unix, last modified: 2018-04-09 21:38:35
</code>```

From the above, it appears that between the RSA key, and the uImage, there's a filesystem.
Why it is split into smaller parts, I don't know.

I logged in via the serial port using "admin" and got the following:

```<code>rooter # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 01400000 00010000 "rootfs"
mtd2: 00400000 00010000 "uImage"
mtd3: 007b0000 00010000 "reserved"
mtd4: 00010000 00010000 "caldata"

rooter # ls /dev/ | grep mtdblock
mtdblock0
mtdblock1
mtdblock2
mtdblock3
mtdblock4
mtdblock5
mtdblock6

rooter # mount
rootfs on / type rootfs (rw)
/dev/root on / type jffs2 (rw,relatime)
/proc on /proc type proc (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=622)
none on /tmp type ramfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
</code>```

From the mtdblock info, I can probably safely assume that the "rootfs" filesystem is on the second block.

I also dumped the "mtdblocks" one by one using tftp, and binwalk yields this on the "rootfs" mtdblock:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JFFS2 filesystem, big endian
9587236       0x924A24        JFFS2 filesystem, big endian
9601464       0x9281B8        JFFS2 filesystem, big endian
9601708       0x9282AC        Zlib compressed data, compressed
9601908       0x928374        JFFS2 filesystem, big endian
9603196       0x92887C        Zlib compressed data, compressed
9608692       0x929DF4        JFFS2 filesystem, big endian
9614240       0x92B3A0        Zlib compressed data, compressed
9616256       0x92BB80        Zlib compressed data, compressed
9618092       0x92C2AC        Zlib compressed data, compressed
9619540       0x92C854        Zlib compressed data, compressed
9620844       0x92CD6C        Zlib compressed data, compressed
9621848       0x92D158        Zlib compressed data, compressed
9622980       0x92D5C4        Zlib compressed data, compressed
9623920       0x92D970        Zlib compressed data, compressed
9625056       0x92DDE0        Zlib compressed data, compressed
9625528       0x92DFB8        Zlib compressed data, compressed
9631132       0x92F59C        Zlib compressed data, compressed
9632280       0x92FA18        JFFS2 filesystem, big endian
9632752       0x92FBF0        JFFS2 filesystem, big endian
9633792       0x930000        JFFS2 filesystem, big endian
9765976       0x950458        JFFS2 filesystem, big endian
9779352       0x953898        Zlib compressed data, compressed
9781400       0x954098        JFFS2 filesystem, big endian
9782176       0x9543A0        JFFS2 filesystem, big endian
</code>```

I tried to get the rootfs mtdblock converted to a jffs2 image, but does show "empty" on the terminal, after using this script to mount it:
https://reverseengineering.stackexchange.com/a/22433

Any assistance to get it to show some contents?

I am trying to use this dumped nor flash image, for use to create a OpenWRT image for a router.

Title: Assistance with dumped firmware image


问:
Next steps for android native library RE (JNI_OnLoad, root check)
I'm trying to RE an Android app that detects root on a system.
Using frida to backtrace 'access' calls I found out that the root check happens natively:

```<code>access(/system/xbin/su, 0x0)

Interceptor Backtrace: 0x7a9d8b12dc libnoncnliheopp.so!0x2a72dc
    0x7a9d8b12dc libnoncnliheopp.so!0x2a72dc
    0x7a9d8bd608 libnoncnliheopp.so!0x2b3608
    0x7a9d8bf29c libnoncnliheopp.so!0x2b529c
    0x7a9d7a66bc libnoncnliheopp.so!0x19c6bc
    0x7a9d9a7aa4 libnoncnliheopp.so!0x39daa4
    0x7a9d9aa1d0 libnoncnliheopp.so!JNI_OnLoad+0x24
    0x7ab198a17c libart.so!_ZN3art9JavaVMExt17LoadNativeLibraryEP7_JNIEnvRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEP8_jobjectP7_jclassPS9_+0xd18
    0x7aa7231170 libopenjdkjvm.so!JVM_NativeLoad+0x1a4
    0x70c16a28 boot.oat!0x81a28
    0x70c16a28 boot.oat!0x81a28

retval: 0xffffffffffffffff
</code>```

I've looked into to the libnoncnliheopp.so and it looks scrambled, the address from the backtrace (0x2a72dc + ghidra base 0x100000) doesn't point to a function but something like a data block (see below). Since the app runs the root checks at startup it's difficult to hook it.

Frida code

What's the best way to continue?


问:
How to decompile an APK written in Golang?
I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to do it with as little effort as possible, but I have not found a single explanation of what one could do to decompile APKs written in Golang.

I know that one generally shouldn't try to make one software temper-proof through security by obscurity, but this seems to me like a good measure to take in order to create a bigger burden to overcome for people trying to reverse engineer the inner workings of a program.

I took an app that I know was written in Golang and shoved it into jadx, however it just seemed to result in gibberish.

OwnerDisplayName: CJK


问:
Find caller function by DLL loading in x64dbg
First of all I'm noob at debugging task and I'm try to self-study to learn how to debug exe using x64dbg.

I have EXE file packed by themida. i bypassed themida packing using themida plugin in x64dbg.after start EXE it has login function. i trying to bypass that login using x64dbg.when i clicked login button it's created a socket connection with server.

to create that connection it's loading dnsapi.dll after clicking login button (that dll not loading in startup), i can break process on loading dnsapi.dll using dll breakpoints.

my problem is how can i find what function load that dll for create that socket connection.

PS: i know that thing is actually illigle and not ethicle but i have motivation to lean that thing.so can anyone help me to figure it out how to find that login function called after click login button it whold be very helpfull.

** sorry for my bad english


问:
Reverse engineering engine room simulator license management (x32dbg)
folks, I'm marine engineer and recently got in touch with simulator software with my professor at the Simulator Department of my university. Today I thought we could dump the original installation and copy to the class computer so we can teach it without the needs of going to the department which is a bit far from here.

Said that, we have made a copy to my computer and we are currently trying to skip license checks using x32dbg.

My first attempt was disable the network license check and so far it has worked, this is the piece of Assembly code from x32dbg:

By changing the jump condition to jump if equal I managed to bypass it and now it goes directly to the Hardware License Check.

Then the next idea I had was to set the code: 83F8 01 75 23 >>>> 83F8 00 74 23 to skip the illegal license error but it unfortunately didn't work, I tried on the old version and this seems to be enough so I don't know where to look after.


问:
How would I decode this XOR Cipher
I have been given a XOR Cipher which is a bunch of hexidecimal looking charcters. This cipher is:

```<code>fa ce fd d3 fa df ed d3 fa ce d3 d3 fa de df d3
fa de df d3 fa de f9 d3 fa ce f9 d3 fa de f1 d3
fa e1 ed d3 f9 ce fd d3 f9 ce fd d3 f9 ce f5 d3
f9 ce fd d3 fa de f9 d3 fa de d3 d3 fa e1 ed d3
f9 ce ed d3 fa de f1 d3 f9 ce f1 d3 fa de ed 89
</code>```

I'm not quite sure how to decode this and if I need to flip this cipher in any way.

Title: How would I decode this XOR Cipher


问:
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to func.

```<code>                     aOpensslCertVer:
00000000047fef1d         db         "openssl cert verify error: ", 0            ; DATA XREF=sub_342df4+412
</code>```

So I'd like to obtain the XREF pointer with a Frida script, how can I do that ? Is it even possible to do ?

I found out here that it seems you can do it with IDA in python, but I use something else than IDA, and I'd like to do it dynamically from Frida JS.

How can I do it ? Is it even possible to do ? Thanks !

Title: Access a XREFs with frida


问:
Working with IA64 in IDA Pro
When disassembling IA64 code in IDA Pro when I try to open the Local Types window

i get an error:

Sorry, the current processor doesn't support the type system

Title: Working with IA64 in IDA Pro


问:
Huawei HG8245W5 Router PPPoE Password Decryption
My ISP is not providing pppoe accounts but I need to bridge to my server.
I only have encrypted password. Password is " $2'4e0YX=y6Q]$\9$c#-+F-h2&Tva4"GYn+qY)x>W$ "

Can anyone help me decrypt, please? Thanks


问:
Greenpacket OH-735 onboard header
I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ISP logo (yes, it is used second-hand unit). I tried to contact manufacturer few times but got no response. So I opened it. Found a 8 pin header marked as [NC NC TXD RXD 3V3 1V8 GND GND]. I suppose it is some sort of JTAG or serial interface.

The question is: can anyone help me connect to the interface so I could try to set communication through it (like serial console or something).

Title: Greenpacket OH-735 onboard header


问:
Which encryption method has been used?
Anyone please can you tell me which method used to encrypt this kind of codes?

im really confused, that would really helps me.

This encrypted data created by a PHP.

Ibª„bÏ}◊Kì-yNî˜>Eﬁ¶ØÁÇ_^§    Ùa¥ròÒ1å°RÑØÑ∆«œ
ÿ¡t“≤=Fz#"Ô]7V´aY+ªæ'Ë]Yÿ!®¢cj˝ﬂ√¿>ÒŸﬁ!A3¨§†–k © ÷Bävè1Ù
‚L2lra%F ı˚≈‰ÅºóΩ0ª⁄W›>kü≈D#ìÀ
w-¢eLìí+-„eï‘r∫ê:…ôæù¬SèW¸§W»z¢ΩVΩ/√/hüt|KQÓËﬁ—7}ßJ#âù˚ÿãá"ÙÎ†Öi§@c’QSµÍA˙ùı9“„øgX ıs´M®w!Â;<›´Ú›í:f[‰)p5L@⁄
«],ÀYÅÀæø¿ÃﬁüZG~√á.≈ÛÚ±¶„N˘äô.2-òÂmΩEm‡4o/Â2tOCl≤mäÕM˘2ì¸ef{´¸:…)v!E"~ævìå    Ôrc∂Ã4!ï6¥≈∏®pZ3-¥„æ·cCÀ¬cYÜà›Lmù∞ùπNa˘´tÿPΩ”∫yï«÷3OQ3ÊÓÌã∂Á∞paÔÓ‹Hœ…˚ÂÈbr?•>°’À¥vK&µH'p,oÔÛ(ªßAOg>5áÜÅ∑ì˘Ò¸›˘%    ‰¸πÆÀùŒ¯ôüß¨üÛƒ¥.X.wèÁU„≠|æƒÃÄ<ë∫õ ôÛjjM)™mı”“WoRZáôÚÛXi2   ÿ
|pÏq`ùm≥‡º€[˜¯„c-ÙUD¸º˛ç“3≤Hó÷ŸnÈ
”˝¯c¸˛ÃÍ#ﬂKéjÛXﬂ*%v‰jB>±\V«õœøOo≤/Z®PèL∂K¬´øP€Q∑‹ﬁ¨#yÔàJ/˝ñã3∞ÆùÅ©2Ü>¸    ê≈”4ﬁß„˚6ÿúúµ‡lÑ;¥'G"˜Sæ_ƒ|\ÚN
Fí2~%tI°ëíX¶ÄHnwß,[åöp'j«…e|)ÂG_H=75´P¶≈ıìè∫k¡€6Ó

When i run the file it's automatically add the file /usr/local/haxor

Here is the code of PHP that sending Post request.

```<code>        $interface = exec('route | grep \'^default\' | grep -o \'[^ ]*$\'');
                $interface = str_replace("\n", '', $interface);
                $mac = file_get_contents('/sys/class/net/' . $interface . '/address');
                $mac = str_replace("\n", '', $mac);
                $hostname = exec('hostname');
                $hostname = str_replace("\n", '', $hostname);
                $k = exec('uname -r');
                $k = str_replace("\n", '', $k);
                $inode = fileinode('/usr/bin/haxor');
                $currentversion = file_get_contents('/usr/local/haxor/version');
                $currentversion = str_replace("\n", '', $currentversion);
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_URL, 'https://www.othoy.com/key.php');
                curl_setopt($ch, CURLOPT_POST, 1);
                curl_setopt($ch, CURLOPT_POSTFIELDS, 'interface=' . $interface . '&mac=' . $mac . '&inode=' . $inode . '&hostname=' . $hostname . '&k=' . $k . '&version=' . $currentversion . '');
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                $server_output = curl_exec($ch);
                $http_status = curl_getinfo($ch, CURLINFO_HTTP_CODE);

                if (file_exists('/usr/local/haxor')) {
                    file_put_contents('/usr/local/haxor', $server_output);
                }
</code>```

Title: Which encryption method has been used?


Title: Find out what is this binary database entry and what format it is

Body:
the following varbinary "BUFFER" of a database entry is for an article.

FIELD_0 is in plain text and the item name is "1", which I created with the item management software.

```<code>[FIELD_0]    NVARCHAR(50)    NOT NULL
[BUFFER]     VARBINARY(8000) NOT NULL
</code>```
```<code>[
  {
    "FIELD_0": "1",
    "BUFFER": "0x02789C535050D0F636500102024320D60E8904311D8158372A1CC4740D0D02891714803846206684215CB51342639431886901021635833303DCE1CC2813B80951060851238436538428D80A0301022C611A07"
  }
]
</code>```

Article price 1,00 EUR:

```<code>0x02789C535050D0F636500102024320D60E8904311D8158372A1CC4740D0D02891714803846206684215CB51342639431886901021635833303DCE1CC2813845A0384A811429B2942146C85010301022C341A06
</code>```

Article price 2,00 EUR:

```<code>0x02789C535050D0F636500102024320D60E8904311D8158372A1CC4740D0D02891714803846206684215CB51342639431886901021635833303DCE1CC2813B80951060851238436538428D80A0301022C611A07
</code>```

Article price removed:

```<code>0x02789C535050D0F636500102024320D60E8904311D8158372A1CC4740D0D02891714803846206684215CB51342639431886901021635833303DCE1CC280304D308A1D614216A88609A809901022AA71A05
</code>```

after creating the item without changing any values (price, etc.)

```<code>0x02789C535050D0F636500102024320D60E8904311D8158372A1CC4740D0D02891714803846206684215CB51342631458D40102CC3440308D104C6304D304CC040102268114CE
</code>```

I can't find out at this time what format is behind BUFFER. The database is an MS-SQL database and I suspect that the entry may have been compressed before storing as varbinary or something like that.

Maybe someone has an idea how the entry was created.

Thanks
Chris


问:
How to search for a graphical string?
I am trying to search for a string but in my case, that string is not like a normal string but it's a graphical string.

As you have seen, that is not a normal string that can search for but it's a string merged with a picture, I don't know what type of that control I can search for.

I am using the x64dbg debugger to find that string but there is no string like that.

What way do I use to find something like that?

Title: How to search for a graphical string?


问:
Why rarun2 is not behave like it is described?
colleagues.

Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "r2_profile" file as follows:

```<code>#!/usr/local/bin/rarun2
stdin=./debruijn
program=./vuln
</code>```

debruijn is a 100 chars long debruijn sequence.
vuln is a ret2win file from here The most basic binexp challenge

Next i run

```<code>r2 -d ./vuln -r r2_profile
</code>```

r2 shell appears whith ./vuln  code stopped. I issue "dc" to continue and gets() waiting for my input instead of automatically eat contents of the files i have configured in profile. What i am doing wrong?


问:
Decrypt Keybindings for EVE Online
I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless.

I've plenty experience with C#, C++ and .NET so that's all fine, my struggle is trying to understand the format this stuff is stored in.

I have done some very, very basic reverse engineering in the past but my brain is far too smooth for something more complex like this.

I've generated 2 files, Old.dat and New.dat, they should be identical - the only difference being I changed one keybinding. Which should be charSheetSelectedPanel.

Old.dat should have that feature bound to ALT-A.

New.dat should have that feature bound to CTRL-ALT-A.

I have set up a DiffChecker here. The change in question should be on line 59.

I've looked at this with HxD, but am not able to make any sense out of it. I'm aware that the shortcuts are most likely not gonna be strings, but rather integers that refer to keycodes. I'm hoping that they use known keycode formats.

But so far no dice and have no idea how to approach this or if it's even feasible. Any pointers/help would be greatly appreciated!

Title: Decrypt Keybindings for EVE Online


问:
Find out used encryption in an SQLite database
Is it possible to see from a string which encryption an SQLite database uses? Let's say, I can open the database and see this: O45dTrA6NKG6SYeCENMwV7nxp66HR9lbhK12NGHgVnzEhebMjMJUhTmConk= - how do I know which encryption is used? And how to decrypt it (should be alphanumeric in original)?


问:
How to debug a file that can't treat with it directly?
I have a game that has ("ex: GameGate.exe") file to open.

I found out later that file is not responsible for opening the game directly but it's just a gate to open another file ("ex: GameMain.exe") internally using the kernel32.CreateProcessInternalA function.

Also, I found that file "GameMain.exe" among the rest of the game files but when attaching that file to the debugger calls the ExitProcess function after a few steps, so I can't debug that file directly.

By the way, I am using x64dbg.

How can I debug that file, is there a way to make me debug that file?


问:
debug stripped file
I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-multiarch I can't debug the file, I get (gdb) target remote 192.168.1.13:1235 Remote debugging using 192.168.1.13:1235 warning: No executable has been specified and target does not support determining executable automatically.  Try using the "file" command. 0xd452ae2a in ?? ()

if I try to use file command I can set only stripped file and then I get (gdb) file XXX A program is being debugged already. Are you sure you want to change the file? (y or n) y "XXX": not in executable format: file truncated (gdb) info file Remote serial target in gdb-specific protocol: Debugging a target over a serial line. (gdb)

maybe I am wronging something in the environment, my situation is this, I've embedded system mips and I want to reverse stripped file launched in the device.

Title: debug stripped file


问:
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that gets executed when the button signal is met. On trying to reverse an app I managed to successfully figure out where the button was created in IDA:

```<code>v15 = (QAbstractButton *)a1[12];
v16 = (const struct QString *)QCoreApplication::translate(
                                  v21,
                                  "SCRRegistrationDialog",
                                  "Button Text 1...",
                                  0i64,
                                  -1);
QAbstractButton::setText(v15, v16);
QString::~QString(v21);
v17 = (QAbstractButton *)a1[14];
v18 = (const struct QString *)QCoreApplication::translate(v21, "SCRRegistrationDialog", "Button Text 2", 0i64, -1);
QAbstractButton::setText(v17, v18);
QString::~QString(v21);
v19 = (QAbstractButton *)a1[15];
v20 = (const struct QString *)QCoreApplication::translate(v21, "SCRRegistrationDialog", "Button text 3", 0i64, -1);
QAbstractButton::setText(v19, v20);
QString::~QString(v21);
</code>```

As can be seen the button text is passed but I simply cant find the function that gets executed when its pressed. I have tried tracing in IDA and tried this answer : Find code executed on button press in Qt5 Linux application but I am unable to follow the method.


问:
Finding a check in Chrome
Chrome doesn't allow switching on extensions which are not from the Chrome store.

There is no this limitation in Chromium. So it is only in Chrome.

It checks verified_contents.json (in which content hashes) and existence of the update_url parameter in the manifest.

How to find this check and fix this? I am interested in solving this with debugging. Please help.

Title: Finding a check in Chrome


问:
Mouse click breakpoint
Im just start to learn and stuck with problem: trying to set breakpoint on mouse click, but ollydbg log shows me only new thread created or terminated.
I did as it is written in these threads:
Thread 1
Thread 2

There is my steps:
Press ctrl+G -> search for USER32.GetMessageW -> press shift+F4 and set decode expressions as message code (WM_xxx), assume func as winprocw, pause program - never, log value of expressions - always, log func args - always -> OK and going to log window.
Maybe i did something wrong?

Title: Mouse click breakpoint


Title: What is the following code will do after modifying it?

Body:
The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal.
But what are more information can be extracted from it?

```<code>$bytes  = [System.IO.File]::ReadAllBytes("C:\Files\gatherosstate.exe")
$bytes[320] = 0xf8
$bytes[321] = 0xfb
$bytes[322] = 0x05
$bytes[324] = 0x03
$bytes[13672] = 0x25
$bytes[13674] = 0x73
$bytes[13676] = 0x3b
$bytes[13678] = 0x00
$bytes[13680] = 0x00
$bytes[13682] = 0x00
$bytes[13684] = 0x00
$bytes[32748] = 0xe9
$bytes[32749] = 0x9e
$bytes[32750] = 0x00
$bytes[32751] = 0x00
$bytes[32752] = 0x00
$bytes[32894] = 0x8b
$bytes[32895] = 0x44
$bytes[32897] = 0x64
$bytes[32898] = 0x85
$bytes[32899] = 0xc0
$bytes[32900] = 0x0f
$bytes[32901] = 0x85
$bytes[32902] = 0x1c
$bytes[32903] = 0x02
$bytes[32904] = 0x00
$bytes[32906] = 0xe9
$bytes[32907] = 0x3c
$bytes[32908] = 0x01
$bytes[32909] = 0x00
$bytes[32910] = 0x00
$bytes[32911] = 0x85
$bytes[32912] = 0xdb
$bytes[32913] = 0x75
$bytes[32914] = 0xeb
$bytes[32915] = 0xe9
$bytes[32916] = 0x69
$bytes[32917] = 0xff
$bytes[32918] = 0xff
$bytes[32919] = 0xff
$bytes[33094] = 0xe9
$bytes[33095] = 0x80
$bytes[33096] = 0x00
$bytes[33097] = 0x00
$bytes[33098] = 0x00
$bytes[33449] = 0x64
$bytes[33576] = 0x8d
$bytes[33577] = 0x54
$bytes[33579] = 0x24
$bytes[33580] = 0xe9
$bytes[33581] = 0x55
$bytes[33582] = 0x01
$bytes[33583] = 0x00
$bytes[33584] = 0x00
$bytes[33978] = 0xc3
$bytes[34189] = 0x59
$bytes[34190] = 0xeb
$bytes[34191] = 0x28
$bytes[34238] = 0xe9
$bytes[34239] = 0x4f
$bytes[34240] = 0x00
$bytes[34241] = 0x00
$bytes[34242] = 0x00
$bytes[34346] = 0x24
$bytes[34376] = 0xeb
$bytes[34377] = 0x63
[System.IO.File]::WriteAllBytes("C:\Files\gatherosstatemodified.exe", $bytes)
</code>```


问:
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's windbg.

I can already debug winload.efi using windbg and there is no problem with that, so how can I force IDA pro to list windbg in the list of debuggers in case of EFI files?

I can run IDA pro and attach the kernel during boot, thus technically debug the winload.efi, but when I open the IDB file of the winload.efi, there is no windbg option in the debuggers.

Note that I have used bcdedit /bootdebug {current}, therefore debugger will break In winload.efi during boot.


问:
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully iterate all the thunk data and retrieve FTs/Names etc.

So where's the issue?
Well...

As you can see in this scheme, the PE Loader replaces the IMAGE_THUNK_DATA with the actual dynamic address at runtime, so, statically, you would have an offset, say 0x28010, and at runtime the PE Loader overwrites it with module_base + 0x28010, where module_base would be the dynamically obtained base address of (always as an example) USER32.dll.

If you still don't understand where I want to get; to statically hook the function I would have to do the following steps, taking as an example MessageBoxA function in USER32.dll

copy the original function in the main module memory (say .text section) and save the address, we're going to use this as an "original" for the detour (the original function which gets called/returned at the end of the detour, to not break anything)

write/patch the actual detour function in the main module memory (again, say .text section) and use the address as the detour function (the offset to replace instead of the FTs)

but then here's the problem, replacing the FTs with the detour, the PE Loader would calculate the FTs like USER32.dll + detourOffset, where it should instead calculate mainModuleBase + detourOffset.

one way to "fix" this would be replacing the FTs with the ""ready"" address, so base + detour, but we're talking about STATICALLY hooking IATs, so we dont have a base address.

Other than having to patch something that hooks the IAT at runtime, any idea how I could achieve this?


问:
Cant view some classes while inspecting APK's code
I'm trying to understand how the application works.
I used dex2jar utility to receive .jar file (d2j-dex2jar --force file.apk). And jd-gui to view it's classes.

I'm able to view the most of them. But the most IMPORTANT folder is shown to be empty. For some reason there is no .class file in that folder, though other classes do imports from it.

Did developers hide it. Or maybe there can be another reason?

What to try to get that file?


问:
Password from .bin file
I am trying to find a password for a bin file for an plc.

a real pain. anyone here that have a idea ?

https://filebin.net/r673zgmbl5ecxtdw/LOGO_U_P.bin

Title: Password from .bin file


问:
Is there a way to run arbitrary code on a vtech Nitro Vision?
Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm trying to do.

Recently, I found a vtech Nitro Vision in a thrift store for $5, in good working condition. It's a children's educational computer that uses your television as a computer monitor and speakers (plug it in with AV white and yellow), and includes a few custom-designed-for-this-thing software cartridges that you insert in the slot like with older consoles like the N64 or the Sega Genesis.

This was released in 2006 though. I imagine they did it this way (with the cartridges) because there's very little internal storage on the motherboard and it doesn't have a hard drive unlike a real desktop computer. This means that if I can find a way to either edit the code on the cartridges themselves, or connect the cartridge reader to my computer and trick it into running code from there, I could write my own programs for this neat little toy to run.

Of course, the first option is unlikely to work, since I would most likely have to get my hands on whatever card reader they used to program this thing. Second option I think is possible, but either way, I need to figure out what programming language they wrote all of this in otherwise I won't be able to use the rest of the hardware (the proprietary mouse and keyboard that came with the computer tower itself).

Speaking of which, if it helps, the keyboard is wireless and works by infrared (powered by AA batteries) and the mouse is wired to the keyboard for both function and power, with a cable that is awfully similar to the ones used with old phone lines or ethernet.

If someone feels like taking a crack at this, answer here.


问:
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the file and encrypt it back to hide the data.

So instead of someone downloading my file and reverse engineering it and bypassing it or creating a clone, I could send through a protector. Now its all encrypted and only the parts running are decrypted.

I am curious how that would work since you wouldn't know which assembly would be executed before so that you could decrypt.


问:
Themida devirtualization?
I'm trying to analyze virtualized? code in IDA which looks like this.

which protection method is applyed on this code and how can i analyze this code?

Title: Themida devirtualization?


问:
List of unsolved problems of reverse engineering
Decided to write out a list of still unsolved fundamental problems in the field of reverse engineering.

This means that today - there is no easy solution to these problems, or problems that can only be solved manually with a lot of effort and time.

Restoration of information about relocations (relocation at the
level of COFF-objects, i.e. more detailed than regular
fixups-relocations)

Extracting a linked static library from an PE-executables

Relocation of functions and sections within PE executables (if
symbols and relocation information are removed from PE executables)

All these problems are mainly related to the lack of debugging information in pe-executables, therefore, I did not separate them into separate topics-questions.

Let me know if there is already a solution for at least one of these problems.


问:
How to decode this rbf file?
I am trying to decode this file but so far I have no luck. I tried with binwalk and other decoders but still did not see a way of decoding. Any help, more than welcome. The file supposed to have GPS data.</p>

Title: How to decode this rbf file?


问:
Steghide Linux Steganography how to get "Passphrase"
I am currently on Parrot Linux and have an image has a hidden steganographic inside.

I know I need to decode it with Steghide in the Parrot Terminal.

I also know that I will find out what the hidden steganographic data (that with be extracted to a .txt file) with this command:

steghide extract -sf IMAGE.jpg -p PASSPHRASE

The question is, using a command that steghide provides... how would I get the PASSPHRASE to find the hidden message within the image jpg?

Oh also, I know the seed is Found (possible) seed: "b40d0b29" - now I am not sure what that means and if that can assist me in anyway, but I thought I'd drop that here just in case.

Thanks all!


问:
How to Decompile HP LaserJet Pro M12w firmware in Ghidra
I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra,
after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and hpm12w.pkg (w means wifi).
When I analysis hpm12w.pkg with binwalk, got following information:

ELF, 32-bit MSB executable, version 1 (SYSV)

Copyright string: "Copyright (c) 1996-2001 Express Logic Inc. * ThreadX ARM9/ARM Version G4.0.4.0 *"

Copyright string: "Copyright (c) 2008   Marvell Semiconductor, Inc. All Rights Reserved."
...

This is my question: after add hpm12w.pkg to Ghidra, I could not find right "Language" for this binary file


问:
How to decrypt a PIE file for a game's assets?
I want to see the assets for Garbage Pail Kids: Mad Mike and the Quest for Stale Gum

I noticed the file was in PIE format. I tried opening them with every program I have, but nothing works; And add insult to injury, the file's encrypted.

What do I do?


问:
Reassembling Silverlight runtime
I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll.

I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, even when i do not do any changes between disassembling and assembling.

I've managed to change the runtime using simple hex-editor, and it was successful. but it's so annoying.

What do i do wrong? Why it's impossible to reassemble Silverlight5 runtime  with ildasm/ilasm?

```<code>ildasm.exe /out=System.Windows.Browser.il System.Windows.Browser.dll
ilasm.exe /dll System.Windows.Browser.il
</code>```

It works perfectly with .NET runtime and with Silverlight applications but not with Silverlight runtime.

Title: Reassembling Silverlight runtime


问:
Solved: Unable to hook Apple binary on iOS 14.x with Frida
I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to attach to it. Frida is running as root. I've attempted to hook some other binaries from the device and it seems like native Apple ones give me the same error message, whereas ones I've installed myself like Bash are able to be hooked. I get the impression that there is some kind of security mechanism preventing the hook from taking, but I'm not sure exactly what. I've tried playing with entitlements of the Frida server to see if that would help but I haven't had any luck with that either.

Does anyone have any suggestions as to how to successfully analyze this binary dynamically? Is there indeed a security control in-place preventing this that I'm unfamiliar with? I can't seem to find anything online describing my exact issue, so I'm not sure if there is a control and if so what it is.

EDIT: For whatever reason it seems that hooking some binaries via the USB option for Frida wasn't working, however using the network host option (-H) and listening with the server on 0.0.0.0 allowed me to connect and properly hook the binary in question.


问:
How to find executable code in PE-file
Please help me to find out how to locate the start and the end of executable code in Windows PE-file.

Which adresses in header of PE can tell me to locate what I find? Thanks!

Title: How to find executable code in PE-file


问:
How can I set a breakpoint in x64dbg to be triggered when a certain message is logged?
I am debugging a certain program and I need to stop execution when a certain debug message is logged using OutputDebugStringA(). How can I set a breakpoint for this?