问:
Implementing syscalls under Miasm
I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two.

So I tried to write them myself, using the above link as reference, like this:

```<code>def EXIT_syscall(jitter, linux_env):
    status, = jitter.syscall_args_systemv(1)
    print(f"Exit syscall, status {status}.")

    jitter.running = False

is_ptrace_first_call = True
def PTRACE_syscall(jitter, linux_env):
    request, pid, addr, data = jitter.syscall_args_systemv(4)
    print(request, pid, addr, data)

    global is_ptrace_first_call
    ptrace_return_value = -1

    if is_ptrace_first_call:
        ptrace_return_value = 0
        is_ptrace_first_call = False

    jitter.syscall_ret_systemv(ptrace_return_value)

syscall_callbacks_x86_64[0x3c] = EXIT_syscall
syscall_callbacks_x86_64[0x65] = PTRACE_syscall
# Syscalls are disabled by default
enable_syscall_handling(sb.jitter, LinuxEnvironment_x86_64(), syscall_callbacks_x86_64)
</code>```

This exit syscall seems to work fine, but it is not the case for the ptrace one, and I don't know why since it pretty much looks like the other syscalls implemented in the link above.

The code above gives me a miasm.analysis.dse.DriftException: Drift of exception_flags: 16 instead of 0, which seems to correspond to a difference in the states of the concrete and symbolic execution.

How should I proceed ?

EDIT: I can also try something like:

```<code>def syscall_handler(jitter):
    print(f">>> Received Syscall {jitter.cpu.EAX}")

    if jitter.cpu.RAX == 0x3c:
        EXIT_syscall(jitter, None)
        return False
    elif jitter.cpu.RAX == 0x65:
        PTRACE_syscall(jitter, None)
        return True
    else:
        print(f"Unimplemented syscall ({jitter.cpu.RAX}), exiting. (RIP = {hex(jitter.cpu.RIP)})")
        exit()

sb.jitter.add_exception_handler(EXCEPT_SYSCALL, syscall_handler)
</code>```

It seems to execute properly the ptrace syscall, however the execution doesn't seem to resume properly and the syscall 0 is called (because the ptrace one returned 0).

Title: Implementing syscalls under Miasm


问:
How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?
I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the recording.

Now I'm trying to find this string or byte pattern x41 x41 x41 x41 x42 ... in the memory trace.

Does anyone know if this it is possible to search the whole trace (instead current memory image)? I looked at the commands using dx @$curprocess.TTD  but there wasn't something useful, so maybe I can modify a query like this:

```<code>dx @$curprocess.TTD.Events.Where(t => t.Type == "ModuleLoaded").Where(t => t.Module.Name.Contains("bcrypt"))
</code>```

But there aren't any helpful commands at first sight. So in the end I would like to search for pattern which appears at any time in the memory.

I would be grateful for any suggestions.

Thanks

ContentLicense: CC BY-SA 4.0


问:
Reverse engineer CRC Canbus
I am trying to figure out what I believe is a CRC8 value on some 8 byte canbus messages.
I have tried "RevEng" without luck.
But maybe some of you are able to figure it out.

Some messages in hex;

```<code>27717DFDFFFF4EE7

27717DFDFFFF4F2C

27717DFDFFFF5049

27717DFDFFFF5182

27297CFCFFFF8528

27DA7BFDFFFF86DB
</code>```

The first 6 bytes are data, the 7th byte I believe is just an incrementer and the 8th byte is what i believe is an CRC calculation.

Anyone that can find the pattern?

Title: Reverse engineer CRC Canbus


问:
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.

But suppose I have already worked on an IDB for a while and realize that there are code references back to the PE headers, so I'd like to revise my initial decision (it's what I've always done so far ... sort of cargo-culting).

Any way of doing this, short of exporting my work up until now into an .idc and starting over?


问:
Can't get Visual C++ to generate the same code give by Ghidra
I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following:

```<code>                         **************************************************************
                         *                          FUNCTION                          *
                         **************************************************************
                         undefined __register FUN_00417344(undefined param_1, undefined
         undefined         AL:1           <RETURN>
         undefined         AL:1           param_1
         undefined         DL:1           param_2
         undefined         CL:1           param_3
         undefined4        Stack[0x4]:4   param_4
</code>```

I can't get visual c++ to compile the same thing, everything I try gives me:

```<code>                     **************************************************************
                     *                          FUNCTION                          *
                     **************************************************************
                     char __cdecl FUN_00417344(int * param_1, int * param_2, int * p
     char              AL:1           <RETURN>
     int *             Stack[0x4]:4   param_1
     int *             Stack[0x8]:4   param_2
     int *             Stack[0xc]:4   param_3
     int *             Stack[0x10]:4  param_4
</code>```

the function above is the result of:

```<code>__declspec(dllexport) char FUN_00417344(int* a, int* b, int* c, int* d)
{
    ...
}
</code>```

How can I get VS to generate the parameters as AL, DL, CL etc...?


问:
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like this

```<code>v7 = dword_10038534
v10 = v7
v4 = (*(int (__thiscall **)(int, int))(*(_DWORD *)v10 + 44))(v10, a2);
</code>```

Am I right to assume this is a pointer?

I would also assume that address is valid within the address space of the DLL module and will change when the DLL is loaded? So how do I calculate the actual run-time address if I load the DLL into my (c++) application?

As you might've noticed, the code I've shown looks like a function call and the function resides at given address. Is there any way to find the actual function body? I am not sure about this, but the functions might be dynamically loaded from another DLL (not through import but rather loadModule & getProcAddress). I managed to find some places where this object (situated at dword_10038534) is constructed, like there are values put at addresses relative to it, however I cannot figure out how the functions are loaded.

For context this DLL was created in late 90s using Visual c++ (most likely VC++4). There is no anti-debug or packing in place. I have heard that patterns like the one I've shown may be connected with C++ classes and virtual method table, however I have strong reasons to believe the DLL was written in C not C++, although this is unconfirmed


问:
How do I reverse engineer an Electron compiled file?- a JSC Bytenode file
I have a bytenode JSC file - which is described as:

This tool truly compiles your JavaScript code into V8 bytecode, so
that you can protect your source code. It can be used with Node.js, as
well as Electron and NW.js (check examples/ directory).

It obfuscates your Electron app. How do I go about decompiling it? x64dbg/Ollydbg won't recognize the file. Is it possible?

There used to be a Ghidra plugin for this called ghidra_nodejs but it has been removed from Github (Wayback machine link).


问:
How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?
I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a Linux VM if the tooling I'm looking for is better there. I've written a simple program that creates an int and a pointer to an int, and then outputs the addresses of the int and the pointer to the terminal.

```<code>#include <stdio.h>

int main()
{
    int test;
    int *pointerTest;

    test = 987;
    pointerTest = &test;

    printf("The address of `test` is %p\n", &test);
    printf("The address of `pointerTest` is %p\n", &pointerTest);

    printf("The value of `test` is %d\n", test);
    printf("The value of `*pointerTest` is %p\n", pointerTest);

    return(0);
}
</code>```

The output looks something like this:

```<code>The address of `test` is 000000000061FE1C
The address of `pointerTest` is 000000000061FE10
The value of `test` is 987
The value of `*pointerTest` is 000000000061FE1C
</code>```

I've been setting a breakpoint at return(0); and making a memory dump using ProcDump, and I've been able to find the variables I'm looking for. But what I'd like is to be able to have the hex file show the addresses accurately. The int is located at 61FE1C, but the memory dump is only 172kB and my pointer is at C3DB in the file.

How would I go about aligning my memory dump with the actual addresses used by the process? If I just pad a bunch of zeroes to the start of the dump file, would the amount of zeroes I have to add be the same for any program, or would I need to figure out the offset every time I rebuild a program and dump the memory (I'm assuming this would be diffferent for Windows vs. Linux, x86 vs. x64 vs ARM, etc., but hope it will be consistent for a given platform)? Or should I be using something else to dump the memory that will keep the addresses correct? Or is there a hex editor out there that lets me add an offset to the addresses of the file I'm viewing?


问:
not called functions
trying to reverse a Cortex-M0 bin file using Ghidra.
There are functions that are Never Called any where in the code! (but actually  should be called somewhere !)
What could be the reasons?
Tnx</p>

Title: not called functions


问:
What hints can x86 disassembly give as to GCC/G++ compiler version and options?
I've taken an interest to disassembling binaries and attempting to recreate 1:1 source code (logic) in C and C++ compiled with GCC. I say "logic" because this question does not pertain to recovering variable names or chronological lines of C code. My aim is to compile C code that generates the same disassembly as a function in a proprietary library. I am not trying to match offsets unless they are a relative to structures. I am not concerned with timestamps or build directories either.

One might be able to look at the .comment section in a linux elf binary to determine the compiler version. Let's assume this section was never included or stripped out. Let's also assume we have a large binary (or several binaries compiled with the same compiler version and options -- lots to analyze). Are there tells to determine specific GCC versions? Tells to determine above or below a specific GCC version? Indicators of GCC options used?

Example:

I'm looking at a proprietary linux elf binary compiled by a 3rd party. The prologue looks like this:

```<code>        00018c04 55              PUSH       EBP
        00018c05 e8 e1 67        CALL       __i686.get_pc_thunk.ax
                 00 00
        00018c0a 05 f6 93        ADD        EAX,0x93f6
                 00 00
        00018c0f 89 e5           MOV        EBP,ESP

</code>```

The prologue in my attempt to recreate looks like this:

```<code>        00011212 55              PUSH       EBP
        00011213 89 e5           MOV        EBP,ESP
        00011215 e8 6b ff        CALL       __x86.get_pc_thunk.dx
                 ff ff
        0001121a 81 c2 e6        ADD        EDX,0x2de6
                 2d 00 00
</code>```

I know that __i686.get_pc_thunk.ax and __x86.get_pc_thunk.dx are the same apart from the register used.

I know that ADD        EAX,0x93f6 and ADD        EDX,0x2de6 only vary in offset length and register used.

Is there a discernible version (range) or option that can be determined by the differences in registers used?

Is there a discernible version (range) or option that can be determined by the ordering of instructions?


问:
How can i inject xamarin smali code into another apk?
I tried to make a simple foreground service android application using xamarin... then decompile and inject it into another apk...but it always crashes.

here is adb logcat :

```<code>05-31 23:57:34.158  7680  7680 W Activity: Slow Operation: Activity com.injected.app/org.injected.cpp.AppActivity onCreate took 1440ms
05-31 23:57:34.169  7680  7680 D injectedActivity: onResume()
05-31 23:57:34.172  7680  7680 W AudioManager: Use of stream types is deprecated for operations other than volume control
05-31 23:57:34.172 7680  7680 W AudioManager: See the documentation of requestAudioFocus() for what to use instead with android.media.AudioAttributes to qualify your playback use case
05-31 23:57:34.180  7680  7680 D AudioFocusManager: requestAudioFocus succeed
05-31 23:57:34.190  7436  7465 I ui.cloudservic: ProcessProfilingInfo new_methods=0 is saved saved_to_disk=0 resolve_classes_delay=8000
05-31 23:57:34.196  7680  8021 I DpmTcmClient: RegisterTcmMonitor from: $Proxy0
05-31 23:57:34.202  1617  4424 E WindowManager: App trying to use insecure INPUT_FEATURE_NO_INPUT_CHANNEL flag. Ignoring
05-31 23:57:34.208  7680 7680 W Looper  : PerfMonitor longMsg : seq=3 plan=23:57:32.356 late=338ms wall=1514ms running=916ms runnable=174ms io=223ms h=android.app.ActivityThread$H w=159 procState=2
05-31 23:57:34.208  7680  7680 W Looper  : PerfMonitor looperActivity : package=com.injected.app/org.injected.cpp.AppActivity time=1514ms latency=338ms running=916ms  procState=2 ClientTransaction{ callbacks=[android.app.servertransaction.LaunchActivityItem] lifecycleRequest=android.app.servertransaction.ResumeActivityItem } historyMsgCount=2 (msgIndex=2 wall=327ms seq=2 running=05ms runnable=83ms io=8ms late=20ms h=android.app.ActivityThread$H w=110)
05-31 23:57:34.227 28 05 28517 W ocessService0:: Reducing the number of considered missed Gc histogram windows from 162 to 100
05-31 23:57:34.232  7680  7680 W Looper  : PerfMonitor looperActivity : package=com.injected.app/org.injected.cpp.AppActivity time=0ms latency=1875ms running=0ms  procState=2 ClientTransaction{ callbacks=[android.app.servertransaction.TopResumedActivityChangeItem] } historyMsgCount=3 (msgIndex=2 wall=327ms seq=2 running=05ms runnable=83ms io=8ms late=20ms h=android.app.ActivityThread$H w=110) (msgIndex=3 wall=1514ms seq=3 running=916ms runnable=174ms io=223ms late=338ms h=android.app.ActivityThread$H w=159)
05-31 23:57:34.233  7711  8033 I SecurityDevice: getService: sService == null.
05-31 23:57:34.233  7711  8033 W SecurityDevice: getService: binder not alive.
05-31 23:57:34.234  7680  7680 E m.injected.app: No implementation found for void mono.android.Runtime.register(java.lang.String, java.lang.Class, java.lang.String) (tried Java_mono_android_Runtime_register and Java_mono_android_Runtime_register__Ljava_lang_String_2Ljava_lang_Class_2Ljava_lang_String_2)
05-31 23:57:34.241  7680  7680 D AndroidRuntime: Shutting down VM
05-31 23:57:34.242  7680  7680 E AndroidRuntime: FATAL EXCEPTION: main
05-31 23:57:34.242  7680  7680 E AndroidRuntime: Process: com.injected.app, PID: 7680
05-31 23:57:34.242  7680  7680 E AndroidRuntime: java.lang.UnsatisfiedLinkError: No implementation found for void mono.android.Runtime.register(java.lang.String, java.lang.Class, java.lang.String) (tried Java_mono_android_Runtime_register and Java_mono_android_Runtime_register__Ljava_lang_String_2Ljava_lang_Class_2Ljava_lang_String_2)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at mono.android.Runtime.register(Native Method)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at crc6464567c73758a9f18.MainService.<clinit>(MainService.java:18)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at java.lang.Class.newInstance(Native Method)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.app.AppComponentFactory.instantiateService(AppComponentFactory.java:129)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at androidx.core.app.CoreComponentFactory.instantiateService(CoreComponentFactory.java:75)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.app.ActivityThread.handleCreateService(ActivityThread.java:4013)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.app.ActivityThread.access$1600(ActivityThread.java:229)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1917)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.os.Handler.dispatchMessage(Handler.java:107)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.os.Looper.loop(Looper.java:226)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at android.app.ActivityThread.main(ActivityThread.java:7592)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at java.lang.reflect.Method.invoke(Native Method)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:539)
05-31 23:57:34.242  7680  7680 E AndroidRuntime:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:950)
05-31 23:57:34.249  3690 14633 I CryptauthV2: [EnrollCryptauthFramework] SyncKeysRequest successfully completed
05-31 23:57:34.251   634  8029 E ResolverController: No valid NAT64 prefix (109, <unspecified>/0)
05-31 23:57:34.263  7974  7974 I FeatureParser: can't find citrus.xml in assets/device_features/,it may be in /vendor/etc/device_features
05-31 23:57:34.266  7680  7680 D OOMEventManagerFK: checkEventAndDumpForJE: 0
05-31 23:57:34.266  7974  7974 I SpaceUtils: owner space
05-31 23:57:34.267  7680  7680 E m.injected.app: No implementation found for void mono.android.Runtime.propagateUncaughtException(java.lang.Thread, java.lang.Throwable) (tried Java_mono_android_Runtime_propagateUncaughtException and Java_mono_android_Runtime_propagateUncaughtException__Ljava_lang_Thread_2Ljava_lang_Throwable_2)
05-31 23:57:34.284  7680  7680 I m.injected.app: Waiting for a blocking GC ProfileSaver
05-31 23:57:34.314  7680  7680 I m.injected.app: WaitForGcToComplete blocked ProfileSaver on ClassLinker for 30.622ms
</code>```


问:
Disassemble Executable Automatically in C++
I have 2 types of files, namely benign and malware. I would like to build a malware detection system based on the assembly language used by these files, by using machine learning. The language that I would like to choose for extracting the assembly language is C++. I used objdump from Linux, but sometimes as a mnemonic, it is returned the word bad because it could not have been found.

Could you please suggest me packages in C++ that could help me to extract the assembly language of multiple files at the same time?


问:
Reversing Daly BMS BLE protocol by mocking the peripheral
I am working on an app that helps users to monitor their batteries. The app must support Daly BMS and I am reversing the protocol over BLE.

So far, I have the services/characteristics UUID. Some of them are GATT and two are customs. The laters I think are used to exchange information about the battery:

```<code>#define SERVICE_DALY_NATIVE_UUID                                    "f000ffc0-0451-4000-b000-000000000000"
#define SERVICE_DALY_NATIVE_CHARACTERISTIC_NATIVE1_UUID             "f000ffc1-0451-4000-b000-000000000000"
#define SERVICE_DALY_NATIVE_CHARACTERISTIC_NATIVE2_UUID             "f000ffc2-0451-4000-b000-000000000000"
</code>```

I have written an ESP32 firmware to mock the actual BLE device that comes with the BMS (attached to the UART).
I reversed most UART packets so far (as well as for RS-485 and CANbus).
My peripheral advertise itself as "DL-01020304056".

The Daly BMS app sees my device and successfully connects to it.
But then the app sounds to be negotiating the MTU as it displays "Request MTU failed" error message, and then disconnects.

Therefore I then tried to setup several MTU on the peripheral side (500, 512 and 517) but this did not overcome the issue.

What should I do?


问:
What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?
I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-concept for a project of mine that I am hoping will get the ball rolling for PS2 decompilation.

The function is very simple; it takes two floats, g and absLimit, and limits the absolute value of g to absLimit.  Here is the C++ source code I have written so far (not matching):

```<code>// Limits the absolute value of g to absLimit
float GLimitAbs(float g, float absLimit)
{
    float result = g;
    if (g > absLimit)
        result = absLimit;
    else if (g < -absLimit)
        result = -absLimit;
    return result;
}
</code>```

Here you can see the target assembly on the left, and the current compiled source on the right. The compiler is ee-gcc 2.96 with standard optimization (-O2).

As you can see, the target assembly has this confounding pattern of c.lt.s instructions followed by nops, whereas my code produces c.olt.s instructions sans nops.

My research has not turned up much as there are very few resources for PS2 reversing. One thing I've learned is that the OLT compare "does not signal an exception for unordered values" while the LT compare does. However, I don't fully understand what that means or what kind of code pattern would result in one over the other.

Is there some change to the source that I'm missing that would produce a matching decomp of the function? Or could perhaps the only explanation be that I'm using the wrong compiler/assembler/etc? Any help would be appreciated.


问:
Firmware-mod-kit failed with CRC update failed
hello I'm trying to modify firmware to enable telnet support

when i tried to build firmware without any modification it give me these errors

```<code>    Firmware Mod Kit (build) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Building new squashfs file system... (this may take several minutes!)
Blocksize override (-min). Original used 1024KB blocks. New firmware uses 1MB blocks.
Squashfs block size is 1024 Kb
Parallel mksquashfs: Using 4 processors
Creating 4.0 filesystem on /media/isso/Storage/firmware-mod-kit/fmk/new-filesystem.squashfs, block size 1048576.
[=====================================================================================================================================================-] 1060/1060 100%
Exportable Squashfs 4.0 filesystem, xz compressed, data block size 1048576
    compressed data, compressed metadata, compressed fragments, compressed xattrs
    duplicates are removed
Filesystem size 5944.79 Kbytes (5.81 Mbytes)
    37.22% of uncompressed filesystem size (15971.71 Kbytes)
Inode table size 8598 bytes (8.40 Kbytes)
    21.21% of uncompressed inode table size (40546 bytes)
Directory table size 11036 bytes (10.78 Kbytes)
    43.50% of uncompressed directory table size (25373 bytes)
Number of duplicate files found 91
Number of inodes 1254
Number of files 1059
Number of fragments 14
Number of symbolic links  83
Number of device nodes 2
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 110
Number of ids (unique uids + gids) 1
Number of uids 1
    root (0)
Number of gids 1
    root (0)
Remaining free bytes in firmware image: 1428295
Processing 1 header(s) from /media/isso/Storage/firmware-mod-kit/fmk/new-firmware.bin...
Processing header at offset 6288841...sorry, this file type is not supported.
checksum update(s) failed!
CRC update failed.

Firmware header not supported; firmware checksums may be incorrect.
New firmware image has been saved to: /media/isso/Storage/firmware-mod-kit/fmk/new-firmware.bin
</code>```


问:
Getting helpful information on classes in Ghidra?
I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) really has any experience with decompiling. The source code was written in C++ but we're having trouble getting good information related to the classes used in the executables (like class relationships, structures of objects, figuring out functions called from vtables). I've seen OOPAnalyzer, but it doesn't work for ELF files (or at least that's what it said when I tried it out). I've also used Cpp-Class-Analyzer on Github, but I ran into a dead end installing it. Are there any tools out there (or ones built into Ghidra) that you would recommend to get this sort of information?</p>


问:
Reverse engineering what seems to be a checksum used for RS232 packets
I will try to be as concise as possible: the issue is, I'm trying to develop a custom application for a dielectric tester. I have access to the original program, which was made some 20 years ago or more; the communication happens via a serial port (RS232).

I had already developed a simpler program for this very same device 4 years ago, so I already had some experience: my approach was to just sniff packets while using the original application and then try to reverse engineer the communication protocol. I have unfortunately stumbled upon what seems to be some kind of checksum. This machine can receive a test program (that is, a series of steps with some parameters like voltage, duration, etc.), which is sent as a string, something like this:

```<code>.úQ P1_2 P2_0 P3_1 P4_0 P5_0 P7_0 P8_0 P9_0 P10_0 P12_0 P13_0 P17_0 P18_0 P19_0 P20_0 P21_12 P22_0 P26_0 P27_0 P28_0 P30_0 P34_0 P35_0 P37_1 P38_500 P39_1 T_Example*english H9-1_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D1_AAAAAAAA Um1__ H9-2_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D2_BBBBBBBB Um2__ Z6470516010223 b n 4B.
</code>```

And these are the corresponding bytes (hex numbers):

```<code>02 81 fa 51 20 50 31 5f 32 20 50 32 5f 30 20 50 33 5f 31 20 50 34 5f 30 20 50 35 5f 30 20 50 37 5f 30 20 50 38 5f 30 20 50 39 5f 30 20 50 31 30 5f 30 20 50 31 32 5f 30 20 50 31 33 5f 30 20 50 31 37 5f 30 20 50 31 38 5f 30 20 50 31 39 5f 30 20 50 32 30 5f 30 20 50 32 31 5f 31 32 20 50 32 32 5f 30 20 50 32 36 5f 30 20 50 32 37 5f 30 20 50 32 38 5f 30 20 50 33 30 5f 30 20 50 33 34 5f 30 20 50 33 35 5f 30 20 50 33 37 5f 31 20 50 33 38 5f 35 30 30 20 50 33 39 5f 31 20 54 5f 45 78 61 6d 70 6c 65 2a 65 6e 67 6c 69 73 68 20 48 39 2d 31 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 31 5f 41 41 41 41 41 41 41 41 20 20 55 6d 31 5f 5f 20 48 39 2d 32 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 32 5f 42 42 42 42 42 42 42 42 20 20 55 6d 32 5f 5f 20 5a 36 34 37 30 35 31 36 30 31 30 32 32 33 20 62 20 6e 20 34 42 03
</code>```

The first 3 bytes seem to be fixed at 02 81 fa while the last byte is always 03, the actual content starts at P1_2 [...] and ends at [...]Um2__ . My problem is with the ending portion of the string (before the 03 byte): Z6470516010223 b n 4B.
From various captures I was able to deduce that the end portion is always ZXXXXXXXXXXXXX b n XX where the first 13 Xs after the Z are decimal digits and the last 2 Xs are hexadecimal digits.

I will now list some facts I discovered during my research:

The machine will not accept the program unless these two numbers are correct.

Sending the exact same string multiple times will always work.

If the content of the message changes, using the same two numbers will not work.

Sending a program with the original companion application multiple times will result in messages with different numbers at the end.

Generating random numbers and going brute force will sometimes result in the program being accepted (a bit more often than I had initially believed, but still this is not a feasible solution)

This leads me to believe that these two numbers are connected in some way to the content of message but there is also some other factor, like time, involved.
I have tried with multiple tools to see if it was some common checksum algorithm like CRC-32, CRC-64, etc. but to no avail (then again, the numbers are not fixed so I kinda expected that).
I do have access to the original software (which was made with VB6 and unfortunately only decompiles to sweet x86 assembly), as I said, and I am trying to disassemble and reverse engineer the algorithm directly from the source, but it is proving to be a tad harder than I expected so I thought I might try and ask here if anyone might have any clue on this while I bang my head against IDA Pro.

Here are a couple more data captures that might help:

```<code>.úQ P1_2 P2_0 P3_1 P4_0 P5_0 P7_0 P8_0 P9_0 P10_0 P12_0 P13_0 P17_0 P18_0 P19_0 P20_0 P21_12 P22_0 P26_0 P27_0 P28_0 P30_0 P34_0 P35_0 P37_1 P38_500 P39_1 T_Example*english H9-1_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D1_AAAAAAAAC Um1__ H9-2_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D2_BBBBBBBB Um2__ Z2511316010223 b n 0C.

02 81 fa 51 20 50 31 5f 32 20 50 32 5f 30 20 50 33 5f 31 20 50 34 5f 30 20 50 35 5f 30 20 50 37 5f 30 20 50 38 5f 30 20 50 39 5f 30 20 50 31 30 5f 30 20 50 31 32 5f 30 20 50 31 33 5f 30 20 50 31 37 5f 30 20 50 31 38 5f 30 20 50 31 39 5f 30 20 50 32 30 5f 30 20 50 32 31 5f 31 32 20 50 32 32 5f 30 20 50 32 36 5f 30 20 50 32 37 5f 30 20 50 32 38 5f 30 20 50 33 30 5f 30 20 50 33 34 5f 30 20 50 33 35 5f 30 20 50 33 37 5f 31 20 50 33 38 5f 35 30 30 20 50 33 39 5f 31 20 54 5f 45 78 61 6d 70 6c 65 2a 65 6e 67 6c 69 73 68 20 48 39 2d 31 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 31 5f 41 41 41 41 41 41 41 41 43 20 20 55 6d 31 5f 5f 20 48 39 2d 32 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 32 5f 42 42 42 42 42 42 42 42 20 20 55 6d 32 5f 5f 20 5a 32 35 31 31 33 31 36 30 31 30 32 32 33 20 62 20 6e 20 30 43 03

.úQ P1_2 P2_0 P3_1 P4_0 P5_0 P7_0 P8_0 P9_0 P10_0 P12_0 P13_0 P17_0 P18_0 P19_0 P20_0 P21_12 P22_0 P26_0 P27_0 P28_0 P30_0 P34_0 P35_0 P37_1 P38_500 P39_1 T_Example*english H9-1_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D1_AAAAAAAA Um1__ H9-2_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D2_BBBBBBBB Um2__ Z8212316010223 b n 41.

02 81 fa 51 20 50 31 5f 32 20 50 32 5f 30 20 50 33 5f 31 20 50 34 5f 30 20 50 35 5f 30 20 50 37 5f 30 20 50 38 5f 30 20 50 39 5f 30 20 50 31 30 5f 30 20 50 31 32 5f 30 20 50 31 33 5f 30 20 50 31 37 5f 30 20 50 31 38 5f 30 20 50 31 39 5f 30 20 50 32 30 5f 30 20 50 32 31 5f 31 32 20 50 32 32 5f 30 20 50 32 36 5f 30 20 50 32 37 5f 30 20 50 32 38 5f 30 20 50 33 30 5f 30 20 50 33 34 5f 30 20 50 33 35 5f 30 20 50 33 37 5f 31 20 50 33 38 5f 35 30 30 20 50 33 39 5f 31 20 54 5f 45 78 61 6d 70 6c 65 2a 65 6e 67 6c 69 73 68 20 48 39 2d 31 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 31 5f 41 41 41 41 41 41 41 41 20 20 55 6d 31 5f 5f 20 48 39 2d 32 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 32 5f 42 42 42 42 42 42 42 42 20 20 55 6d 32 5f 5f 20 5a 38 32 31 32 33 31 36 30 31 30 32 32 33 20 62 20 6e 20 34 31 03

.Å˙Q P1_2 P2_0 P3_1 P4_0 P5_0 P7_0 P8_0 P9_0 P10_0 P12_0 P13_0 P17_0 P18_0 P19_0 P20_0 P21_12 P22_0 P26_0 P27_0 P28_0 P30_0 P34_0 P35_0 P37_1 P38_500 P39_1 T_Example*english H9-1_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D1_AAAAAAAA Um1__ H9-2_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D2_BBBBBBBB Um2__ Z8372415091224 b n 4C.

02 81 fa 51 20 50 31 5f 32 20 50 32 5f 30 20 50 33 5f 31 20 50 34 5f 30 20 50 35 5f 30 20 50 37 5f 30 20 50 38 5f 30 20 50 39 5f 30 20 50 31 30 5f 30 20 50 31 32 5f 30 20 50 31 33 5f 30 20 50 31 37 5f 30 20 50 31 38 5f 30 20 50 31 39 5f 30 20 50 32 30 5f 30 20 50 32 31 5f 31 32 20 50 32 32 5f 30 20 50 32 36 5f 30 20 50 32 37 5f 30 20 50 32 38 5f 30 20 50 33 30 5f 30 20 50 33 34 5f 30 20 50 33 35 5f 30 20 50 33 37 5f 31 20 50 33 38 5f 35 30 30 20 50 33 39 5f 31 20 54 5f 45 78 61 6d 70 6c 65 2a 65 6e 67 6c 69 73 68 20 48 39 2d 31 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 31 5f 41 41 41 41 41 41 41 41 20 20 55 6d 31 5f 5f 20 48 39 2d 32 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 32 5f 42 42 42 42 42 42 42 42 20 20 55 6d 32 5f 5f 20 5a 38 33 37 32 34 31 35 30 39 31 32 32 34 20 62 20 6e 20 34 43 03

.úQ P1_2 P2_0 P3_1 P4_0 P5_0 P7_0 P8_0 P9_0 P10_0 P12_0 P13_0 P17_0 P18_0 P19_0 P20_0 P21_12 P22_0 P26_0 P27_0 P28_0 P30_0 P34_0 P35_0 P37_1 P38_500 P39_1 T_Example*english H9-1_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D1_AAAAAAAA Um1__ H9-2_0_10_10_0_20000_10_1_0_0_1000_0_0_0_0_0_0_1_0_0_0_0_0_1_1_0 D2_BBBBBBBB Um2__ Z7534415052223 b n 4F.

02 81 fa 51 20 50 31 5f 32 20 50 32 5f 30 20 50 33 5f 31 20 50 34 5f 30 20 50 35 5f 30 20 50 37 5f 30 20 50 38 5f 30 20 50 39 5f 30 20 50 31 30 5f 30 20 50 31 32 5f 30 20 50 31 33 5f 30 20 50 31 37 5f 30 20 50 31 38 5f 30 20 50 31 39 5f 30 20 50 32 30 5f 30 20 50 32 31 5f 31 32 20 50 32 32 5f 30 20 50 32 36 5f 30 20 50 32 37 5f 30 20 50 32 38 5f 30 20 50 33 30 5f 30 20 50 33 34 5f 30 20 50 33 35 5f 30 20 50 33 37 5f 31 20 50 33 38 5f 35 30 30 20 50 33 39 5f 31 20 54 5f 45 78 61 6d 70 6c 65 2a 65 6e 67 6c 69 73 68 20 48 39 2d 31 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 31 5f 41 41 41 41 41 41 41 41 20 20 55 6d 31 5f 5f 20 48 39 2d 32 5f 30 5f 31 30 5f 31 30 5f 30 5f 32 30 30 30 30 5f 31 30 5f 31 5f 30 5f 30 5f 31 30 30 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 30 5f 30 5f 30 5f 30 5f 30 5f 31 5f 31 5f 30 20 44 32 5f 42 42 42 42 42 42 42 42 20 20 55 6d 32 5f 5f 20 5a 37 35 33 34 34 31 35 30 35 32 32 32 33 20 62 20 6e 20 34 46 03
</code>```


问:
Trying to extract images from .imb archives used by Railroad Tycoon 2
I am trying to extract the sprites from Railroad Tycoon 2. Having successfully extracted the files contained in the data .paks it uses, I am now stuck at trying to extract files from the .imb files it seems to use to store the sprites. There are also .pal files, I presume these are connected somehow.

I have uploaded a few of the .imb files here as an example: https://mega.nz/file/l3hxwADD#rcOwsQEUliZ3ypX95ZwW4BElLk5rPzrfr63QKXQ0dOA

Hopefully someone can help.


问:
Lifting x86 machine code to LLVM IR
I would like to translate a simple x86_64 machine code into LLVM IR, which can be later analyzed. For my particular use case, I need to be able to work with just instructions and opcodes directly, and I don't have access to the binary itself.

To my current understanding, I should be able to convert x86 instructions using tools such as rellume and remill. With their help, I am able to create LLVM IR code, however, I am not entirely sure whether the results I am getting are correct.

First I need to create machine code for a very simple application (this is just for testing purposes):

Compile the source code [1]

gcc simple.c -o simple.o

Dissemble using objdump [2]

objdump -d simple.o

At this point, I get separate functions add and main

Then, I provide a function that I want to translate into LLVM IR to remill as bytes:

Translate add function into LLVM using remill

bytes = add function as bytes

the result should be a LLVM IR of the add function

```<code>docker run --rm \
 -it remill \
 --arch amd64 \
 --ir_out /dev/stdout \
 --bytes f30f1efa554889e54883ec10be03000000bf01000000e8cdffffff8945fc8b45fcc9c3
</code>```

My questions:

Is my current workflow to translate x86 instructions into LLVM IR correct? Am I missing something? (I am aware of tools such as McSema, however, for my use case I need to be able to transform opcodes).

How can I verify the produced LLVM IR?

After producing LLVM IR of an even simpler example [3], I tried to run it with lli unsuccessfully.

Source code

```<code>
int add(int a, int b){
    return a + b;
}

int main()
{
    int c = add(1, 3);
    return c;
}
</code>```

Dump of objdump

```<code>...

0000000000001129 <add>:
    1129:   f3 0f 1e fa             endbr64
    112d:   55                      push   %rbp
    112e:   48 89 e5                mov    %rsp,%rbp
    1131:   89 7d fc                mov    %edi,-0x4(%rbp)
    1134:   89 75 f8                mov    %esi,-0x8(%rbp)
    1137:   8b 55 fc                mov    -0x4(%rbp),%edx
    113a:   8b 45 f8                mov    -0x8(%rbp),%eax
    113d:   01 d0                   add    %edx,%eax
    113f:   5d                      pop    %rbp
    1140:   c3                      ret

0000000000001141 <main>:
    1141:   f3 0f 1e fa             endbr64
    1145:   55                      push   %rbp
    1146:   48 89 e5                mov    %rsp,%rbp
    1149:   48 83 ec 10             sub    $0x10,%rsp
    114d:   be 03 00 00 00          mov    $0x3,%esi
    1152:   bf 01 00 00 00          mov    $0x1,%edi
    1157:   e8 cd ff ff ff          call   1129 <add>
    115c:   89 45 fc                mov    %eax,-0x4(%rbp)
    115f:   8b 45 fc                mov    -0x4(%rbp),%eax
    1162:   c9                      leave
    1163:   c3                      ret

...

</code>```

```<code>int main
{
  int val = 2
  return val;
}
</code>```

Title: Lifting x86 machine code to LLVM IR


问:
Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++
The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to distinguish between malware and benign files is by feeding it the mnemonics that will be extracted from the executables.

I came across two disassemblers, namely, capstone and LLVM-MC. I tried to search about how to extract the opcode but I did not manage to extract them. If it is possible, I would like to even use IDA, but still I do not know how to write such a script to use it in C++.

Could you please help me with a script in which it will take as input a path to an executable and outputs a text file in which all the data about that certain executable is extracted, and then I will just tidy up that file for removing everything but the mnemonics and their arguments?


问:
How to reverse engineer this router firmware using binwalk?
I want to modify router firmware so I can enable telnet. What steps should I take? The router is hg630v2; the firmware can be found at this link. It's Linux based.

When I do

```<code>binwalk --signature --term HG630V2-12V100R001C36B023_multicast_restore_default_pack.bin
</code>```

it gives this output:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
307           0x133           LZMA compressed data, properties: 0xB7, dictionary size: 262144 bytes, uncompressed size: 808333686 bytes
12909         0x326D          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 121464 bytes
198089        0x305C9         Squashfs filesystem, little endian, version 4.0, compression:xz, size: 6088994 bytes, 1254 inodes, blocksize: 1048576 bytes, created:
                              2017-03-14 13:21:06
6288841       0x5FF5C9        uImage header, header size: 64 bytes, header CRC: 0xCE31434, created: 2017-03-14 13:20:27, image size: 1426862 bytes, Data Address:
                              0x81208000, Entry Point: 0x81208000, data CRC: 0xE377A30F, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: lzma,
                              image name: "Linux-2.6.30"
6288905       0x5FF609        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3823840 bytes
</code>```

I want to able to repack the router after extraction and fix CRC issue to be uploaded and installed.


问:
SetPixel seem not work on some external window
I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window.

To do a test I have created this code:

Here my hooked function:

```<code>My_hooked_function(int a3)
{

    HWND hWnd = GetForegroundWindow();

    if (hWnd == NULL)
         hWnd = GetDesktopWindow();

    if (a3==49)
    {

        string buf;
        LF::Log_Update("Button Pressed");

        SetWindowLongA(hWnd, GWL_WNDPROC, (LONG_PTR)&WndProc);
        // SetWindowSubclass(hWnd, &WndProc, 1, 0);
        //DefSubclassProc
        // DrawPixels(hWnd);
    }
}
</code>```

here my test function to draw something in the game (that is a old 32 bit that required directx 11):

```<code>void DrawPixels(HWND hwnd) {

    PAINTSTRUCT ps;
    RECT r;

    LF::Log_Update("DrawPixels Entrato");

    GetClientRect(hwnd, &r);

    if (r.bottom == 0) {

        return;
    }

    HDC hdc = BeginPaint(hwnd, &ps);

    for (int i = 0; i < 1000; i++) {

        int x = rand() % r.right;
        int y = rand() % r.bottom;
        SetPixel(hdc, x, y, RGB(0, 0, 0));

        for (int i = 1; i <= 4; i++)
        {
            SetPixel(hdc, x - i, y, RGB(0, 0, 0));
            SetPixel(hdc, x + -i, y, RGB(0, 0, 0));

            SetPixel(hdc, x, y + i, RGB(0, 0, 0));
            SetPixel(hdc, x, y - i, RGB(0, 0, 0));
        }

    }

    EndPaint(hwnd, &ps);

}
</code>```

and here the window procedure callback:

```<code>LRESULT CALLBACK WndProc(HWND hwnd, UINT msg,
    WPARAM wParam, LPARAM lParam) {

    LF::Log_Update("Enter here");

    DrawPixels(hwnd);

    switch (msg) {

    case WM_PAINT:

        LF::Log_Update("For some reason not enter here");

        DrawPixels(hwnd);

        break;

    case WM_DESTROY:

        PostQuitMessage(0);
        return 0;
    }

return DefWindowProcW(hwnd, msg, wParam, lParam);
</code>```

}

In my code I have 2 problems:

I need to attach and not replace the window procedure (SetWindowLongA is not right in this case) because the game must continue to work. I need only to paint some line to the game existing window.

I have tested the function "DrawPixels" to an empty c++ windows project and If I put it in the "WM_PAINT" message of the WndProc work perfectly but not in the game.

I searching for a way to draw some pixel on a external DirectX 11 game.

Can you help me please ?

Thanks !


问:
Source code for an mp3 player?
I know this title sounds a little dumb but if you would please bear with me for an explanation. I have a Valoin-made mp3 player I bought close to 3 years ago now. Via a series of interesting discoveries, I have become infatuated with this thing. It plays video (to a degree), the file manager has some oddly specific quirks, the 'home screen' looks eerily like every mp3 player 'home screen' I see on the market, and most importantly, whenever I use an SD card with the device, it offloads some weird files with a format I don't recognize. In another post I read a user mentions a similar situation. They seem to have a bunch of .LIB and .PL files added to the root of the SD card file system (FAT32?). Among these files were noticeably: M3U.LIB and EBOOK.LIB. USERPL1.PL, USERPL2.PL, and USERPL3.PL are files native only to my device, it would seem.

I would like to believe that somewhere out there exists a way to interact with the data in these files and maybe understand the weird file-manager quirks. I mentioned that the 'home screen' looks awfully generic and I believe that's for a reason. I think that a company serving as a really niche software vendor might be the common denominator here. If there exists source code that powers these little gizmos, I want to find it. No short of possibly making some phone calls, or digital snooping. If I can't find the source code, I would settle for understanding these .LIB files. If you are curious and/or have the expertise please check out my github repo that contains the unmodified .LIB files from my mp3 player alongside some pertinent information.

Title: Source code for an mp3 player?


问:
Wrong access .data segment

Preface

I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the help of the most powerful community to clarify my mistake.

Problem

Trying to increase the amount of text, I came across an error when the game just crashes.
The section code is below:

Offset (0046A1EC):

```<code>.text:0046A1EC push offset aEnaPokupkiSPix
</code>```

Trying to increase the offset index beyond zone 2 results in a game crash, but if the index is in zone 1 or higher, everything works fine.

I really don't know where to search anymore :(

Given

Game: “Recettear: An Item Shop's Tale” Steam

Translation language: Russian (UNICODE)

Original language: English (SHIFT-JIS)

Data storage format: fileDataIdx + fileDataBuffer

Translation group: Recettear: An Item Shop's Tale

Was done

Using PE Explorer, I changed the partition type from .extra to .data.

With the help of PE Explorer increased the virtual volume of the partition to (F4240).

With the help of IDA PRO added support for UNICODE

Made a program for editing fonts

Translated some internal texts that were in the exe file.

Help who can, at least in which direction to search:(

Title: Wrong access .data segment


问:
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"

The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn't use this yet.  There's a bug in bugzilla you can track, "Bug 15250 - use PTRACE_SEIZE and PTRACE_INTERRUPT"

I was able to find PTRACE_SEIZE documented in man ptrace,

PTRACE_SEIZE (since Linux 3.4): Attach  to  the process specified in pid, making it a tracee of the calling process.  Unlike PTRACE_ATTACH, PTRACE_SEIZE does not stop the process.  Group- stops are reported as PTRACE_EVENT_STOP and WSTOPSIG(status) returns the stop signal.  Automatically attached  children  stop  with  PTRACE_EVENT_STOP  and WSTOPSIG(status)  returns  SIGTRAP  instead of having SIGSTOP signal delivered to them.  execve(2) does not deliver an extra SIGTRAP.  Only a PTRACE_SEIZEd process can accept PTRACE_INTERRUPT and PTRACE_LISTEN commands.  The "seized" behavior just described is inherited by children that are  automatically  at‐ tached  using PTRACE_O_TRACEFORK, PTRACE_O_TRACEVFORK, and PTRACE_O_TRACECLONE.  addr must be zero.  data contains a bit mask of ptrace options to activate immediately. Permission to perform a PTRACE_SEIZE is governed by a ptrace access mode PTRACE_MODE_ATTACH_REALCREDS check; see below.

That raises the question if PTRACE_SEIZE isn't supported by gdb, what tooling (if any) does support this functionality on Linux?


问:
How to byte patch a longer hex/byte from the original?
I am fairly new to IDA PRO I hope this is not some kind of stupid question but please bare with me. How do you change patch a hex/byte that is longer than the original?

Example:

When I try to byte patch it, it will only save up to the last 00 on the original value and the rest are not saved or ignored.

How do you change the original value hex to a longer one?


问:
How to find prolog with idapython in non-disassambled function raw bytes?
I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?</p>


问:
Rebasing program
When I start debug in IDA, it's appears small window "Please wait... Rebasing program", and it's take about 3 minutes. Is it possible eliminate this process named Rebasing program? It take long time to wait.</p>

Title: Rebasing program


问:
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become paperweights.

The key to unlock their driver takes information and exports it, then you send it to the company which they send back a different .xuk file which you import and it unlocks the driver.

I have both the before and after .xuk files and can open them in a hex editor, but I don't know how to read it.


问:
Is there a debugger that will trace into ring-0 code?
Is there a debugger these days that will trace beyond a syscall or sysenter into ring-0 code? Or is there a technique using a debugger like Windbg? I have read that if you get close enough to the syscall/sysenter function, then set a BP in ring-0 code windbg will break in ring-0.</p>


问:
LG C1 Firmware Flashing/Modifying
I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what it wants when it wants, especially wheneve Dolby or HDR setting kick in from an external source or app such as Netflix and it hurts my eyes, I have the brightness set low for a reason.

How would I go about diagnosing or determining what firmware, architecture, OS or such it runs to work it from the inside out, id like to take control of my property.

Title: LG C1 Firmware Flashing/Modifying


问:
Reversing Executable Package
I have an .exe file that loads some other files when executed, I need to redirect these files and export them. When debugging I know that there is a subfolder /images/%s.png where the files in question are referenced.

Is there any way to export these files?

Thanks.

Title: Reversing Executable Package


问:
Reverse-engineering the S-Note (.spd) file format?

Context

Samsung phones have an application called 'S Note' that let you use the stylus/keyboard to take notes in a free-form format, similar to Microsoft OneNote. These notes are stored in files ending in .spd.

See here for more information: https://fileinfo.com/extension/spd

Further information

As the link above mentions, the SPD file is itself a zip file containing other files. I unzipped one of my .spd files and saw the following:

```<code>│   17_thumbnail_simplenote_06.png
│   51703992-741e-11e3-b172-0790741041a6.page
│   5bac0f76-741e-11e3-8113-a785f13b0c03.page
│   end_tag.bin
│   note.note
│   pageIdInfo.dat
└─── media
image0.png
mediaInfo.dat

</code>```

The .page file is vaguely explained here: https://fileinfo.com/extension/page (See File Type 2), but it doesn't contain any additional information about how to extract data from it.

Questions

Q1: Does anyone know if the S-Note format is documented or described anywhere in further detail than what is linked above?

Q2: Does anyone know if work has been done on reverse-engineering the S-Note format, specifically to support conversion to PDF? (The Samsung Note app itself includes the ability to export notes as PDF, but for those without access to the application it's useless.)

Follow-up

I can provide several SPD files for use, if anyone is actively working on a reverse-engineering effort.


问:
Disable IDA Downloading Symbols Automatically
How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.


问:
Decompile C#, xaml and wpf application
I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the app itself.

Link to installer file(not decompiled):
Comet Space Designer

Link to source code:
Comet Source code

Link to the app (not installer and not decompiled): Comet Copy2

I know the installer but I don't know how to decompile the app itself.
I used :
just decompile,
.Net Reflector,
dnspy,
dotpeek,
ilspy.

Title: Decompile C#, xaml and wpf application


问:
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.

Is there anyway I can compress them again into assemblies.blob file or at least modify the APK to allow loading the the extracted DLL like older Xamarin APKs?

I seem to have found that the application checks for application_config.have_assembly_store value, if it's true, it only continues if there's an assembly blob. Any idea how to change this value inside the APK?


问:
IDA how to remove all uses of a type?
I'm editing an exe which has a function that is used in multiple places with completely different meanings for the return type (a getter that wasn't inlined). I had assigned it a return type to make it easier to reverse a function, but I'm now having a problem where this type was propagated to ALL calls to the function (so a lot of places have now inferred the wrong type) it's quite tedious fixing it manually as the function has thousands of xrefs.

Is there any way to remove a type and all references to it in the database?

Title: IDA how to remove all uses of a type?


问:
How to solve bad pseudocode format of Hex-Rays Decompiler?
Look at the following pseudocode:

```<code>void *__cdecl func(const char *a1, int a2, void *a3)
{
  _DWORD *v3; // esi
  int v5; // ebp
  int v6; // eax
  void *v7; // esi
  _DWORD *v8; // eax
  int v9; // edx
  int v10; // edi
  Elf32_Dyn *v11; // edx
  union Elf32_Dyn::$A263394DDF3EC2D4B1B8448EDD30E249 *v12; // edi
  Elf32_Dyn *v13; // esi
  Elf32_Dyn *v14; // edx
  _DWORD *v15; // [esp+20h] [ebp-1Ch]

  if ( !*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)(&dword_466640 - 694731)) )
  {
    v3 = *(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)&loc_2A647D - 2778921);
    if ( *v3 == 3 )
      return 0;
    ......
</code>```

!*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)(&dword_466640 - 694731))and*(Elf32_Dyn **)((char *)&off_53EFF4 + (_DWORD)&loc_2A647D - 2778921) is a mess! And this kind of mess is all over the whole binary. The disassembly code for the pseudocode is:

```<code>.text:002A6720 56                                                              push    esi
.text:002A6721 57                                                              push    edi
.text:002A6722 53                                                              push    ebx
.text:002A6723 55                                                              push    ebp
.text:002A6724 83 EC 2C                                                        sub     esp, 2Ch
.text:002A6727 E8 00 00 00 00                                                  call    $+5
.text:002A672C
.text:002A672C                                                 loc_2A672C:                             ; DATA XREF: loadLibraryExt1+FD↓r
.text:002A672C 5B                                                              pop     ebx
.text:002A672D 8D 9B C8 88 29 00                                               lea     ebx, (off_53EFF4 - 2A672Ch)[ebx]
.text:002A6733 83 BB 14 FF 1B 00 00                                            cmp     ds:(dword_466640 - 2A672Ch)[ebx], 0
.text:002A673A 75 43                                                           jnz     short loc_2A677F
.text:002A673C 8B B3 54 FD FF FF                                               mov     esi, dword ptr ds:(loc_2A647D+3 - 2A672Ch)[ebx]
.text:002A6742 83 3E 03                                                        cmp     dword ptr [esi], 3
.text:002A6745 75 0A                                                           jnz     short loc_2A6751
.text:002A6747
.text:002A6747                                                 loc_2A6747:                             ; CODE XREF: loadLibraryExt1+5D↓j
.text:002A6747 33 C0                                                           xor     eax, eax
.text:002A6749 83 C4 2C                                                        add     esp, 2Ch
.text:002A674C 5D                                                              pop     ebp
.text:002A674D 5B                                                              pop     ebx
.text:002A674E 5F                                                              pop     edi
.text:002A674F 5E                                                              pop     esi
.text:002A6750 C3                                                              retn
</code>```

off_53EFF4 locates at the start of .got.plt section, this pseudocode is hard to read, and it only exists in x86 but x86_64. Why does this happen? How to solve this?


问:
Convert IDA imagebase to detours
I have succefully hooked a game with imagebase 400000 (Ex:

```<code>//  LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4)

Game.SecondaryFunctHookAddress = "0x2D5040"
</code>```

and the game work.

Now I have another game with imagebase: 140000000

```<code>// __int64 __fastcall sub_1405B4B60(__int64 *a1)
</code>```

I have tried:

```<code>Game.SecondaryFunctHookAddress = "0x0005B4B60"
</code>```

but not work becouse detour don't attach the address.

until now I have converted the address with this function:

```<code>    DWORD GetGameFunctionAddress(std::string GameFileExe, std::string Address)
    {
        ///////////////////////////////////////////////////////////////
        /// Get integer value address of the original function hook  //
        ///////////////////////////////////////////////////////////////

        return (DWORD)GetModuleHandleA(GameFileExe.c_str()) + std::strtoul(Address.c_str(), NULL, 16);
}
</code>```

and always work, but now there is a imagebase of 140000000 and seem more complicated.

Can you please tell me what is the right address for sub_1405B4B60 converted to string ?

Best Regards

Title: Convert IDA imagebase to detours


问:
IDA throws "Module <lib> has no names" error after attaching a remote process
I am using IDA for debugging a remote process. After set IDA_LIBC_PATH to a correct libc.so in my android device to resolve IDA multi thread problems, I cannot get a list of export functions of modules; IDA always throws an error "Module  has no names" for system libs.


问:
Why can't I view certain USER32.dll API calls in the disassembly?
I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality is completely missing. I look at the SYMBOLS and IMPORTS tabs to try and find them, but they're not there. Searching the disassembly for certain function names does not turn up any results.

I know that these API calls are being made because they come up in an API monitor (I'm using the rohitab API monitor).

So, to recap, API calls are being made (I can see them ), but the calls themselves do not appear in the disassembly (in 2 different debuggers!).

I'm not very experienced with reverse engineering but I know from common sense that if you can't,

Know what libraries the program uses, and

Know where in the instruction sequence it's using them.

Then you can't understand what's going on. Am I missing something here? Is it that certain USER32.dll functions just don't show up in debuggers? I'm looking for SetBkColor, SetTextColor, and SelectObject to name a few.

I just want to be able to set breakpoints at certain API calls.

How can I do that?


问:
Understand a function within Hermes byte code
The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.

I was able to disassemble the binary file using hbctool and came across a function that I would like to learn more about e.g. getSecretData

```<code>CreateClosure           Reg8:1, Reg8:1, UInt16:9784
PutById                 Reg8:2, Reg8:1, UInt8:3, UInt16:25656
; Oper[3]: String(25656) 'getSecretData'
</code>```

This function doesn't appear in any of the *.so files placed in the APK lib folder as I checked with a simple nm command:

```<code>for FILE in *.so; do nm -D $FILE | grep secret; done
</code>```

Using frida to list all the Java classes just lists the ones I already have access to via the classes.dex file:

```<code>Java.enumerateLoadedClasses({
    onMatch: function(className) {
        console.log(className);
    },
    onComplete: function() {}
});
</code>```

There is talk of a "show source" directive that has been added to Hermes compiler so I am not sure if this is something that can be injected in.

Any help on how I can explore further will be greatly appreciated.


问:
Where can I find these compilers given in the Rich Header of a system BIOS file?
I am working on a project which deals with the BIOS file of a well known manufacturer.

I recovered the file from the disk partition which stores and uses the file in case BIOS is corrupted or its integrity check fails, therefore the file is named as BIOS_PRE.rcv by the system.

Though the file has extension .rcv but it is actually a 32-bits portable executable, while exploring file headers in DIE(Detect it Easy), I found the Rich Signature contains a list of compilers.

Except MASM which is in the list, I hardly have any hint about Compiler: Universal Tuple Compiler(19.00.26213)[C++] and many more in the list. Or if I am getting it wrong - Microsoft has started renaming its compiler toolkit?

Any official site or details about these compiler are greatly acknowledged.

I have attached  BIOS_PRE.rcv file: GitHub link

Screenshots:


问:
Assign function type to a pointer in ghidra
In the project I'm currently working on, I have found the following obfuscated access to functions in various libraries. In the following example, libdl is referenced.

```<code>  if (libdl_string_literal[8] != '\0') {
    magicDecodingFunction(0x86817231,0x86817231,0x11300316,libdl_string_literal,8,0xecd);
    libdl_string_literal[8] = '\0';
  }
  libdl = (void *)dlopen(libdl_string_literal,1);
  if (fun_libdl_dlopen_string_literal[6] != '\0') {
    magicDecodingFunction(0x86817231,0x86817231,0x11300316,fun_libdl_dlopen_string_literal,6,0xed6);
    fun_libdl_dlopen_string_literal[6] = '\0';
  }
  fun_libdl_dlopen = (void *)dlsym(libdl,fun_libdl_dlopen_string_literal);
</code>```

libdl, libdl_string_literal, fun_libdl_dlopen are globals here.

After this bit runs, I am certain that fun_libdl_dlopen is always a reference to a function void* dlopen(char* filename, int flags). How do I tell ghidra that the variable has that function signature?

For reference, I'm using ghidra 10.2 without any additional extensions.


问:
Where can I find the encryption algorithm for this POST request in an Android APP?
I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but now I face another obstacle.

The information on the POST request is encrypted or hashed with something in the client, I just don’t know what is it.

This is the view (it's in Spanish so I leaved the text as it is in order to search through its labels):

This is how the POST request looks when its sent from the app when I enter an amount to send (think of it as app currency) to another peer registered in this same app. So I suppose it's encrypting the contact data and the amount:

```<code>{
  “content”: “a1b80843068b4ba6e99eb13e165e907695884416c2365a713d3805c1a1b62f45ad13b623b04a93aac19daf5d9280f6b0d0ab96fcce312fefc7f1e53ec3705917b2f5dbb867030006de295053bfc1c8efad9d255aa05a21be4f3da1b4eb3d0448d215e4f47cad89a1d91a3e255fcb5d9f6d3418d33c91e7d3e91404b9a4d8596fe80bffb31509a22958070893eef18a088764155d3a”,

      “tag”: “1beede6ca014d893e234a1ff6d1dc317”,

      “iv”: “e5391ed0df5cd71b3472d93b”
}
</code>```

I managed to found the smali code where this is done by searching the JSON labels, I used jadx-gui for this, here is the apk used (is an app bundle so I only included the base.apk), it can be opened with jadx-gui:

https://www.mediafire.com/file/myzjnoim974x107/base.apk/file

Here it is the decompiler jadx version of it:

https://www.mediafire.com/file/3gupjge3l2h0hpb/decompiled-with-jadx.zip/file

And this is the Google Play Store link:

https://play.google.com/store/apps/datasafety?id=cl.bci.sismo.mach&hl=en&gl=UK

As I’m reading through this code (at sources\p427p7\MessageEncryptedModel.java) I can see that is converting the strings into this encrypted format, but I don’t understand how when looking at the package imported, which is being used for this:

```<code>package p427p7;

import com.google.gson.annotations.Expose;
import com.google.gson.annotations.SerializedName;
import ia0.C8465k;

/* renamed from: p7.a */
/* loaded from: classes.dex */
public final class MessageEncryptedModel {
    @SerializedName("content")
    @Expose

    /* renamed from: a */
    private String f36230a;
    @SerializedName("tag")
    @Expose

    /* renamed from: b */
    private String f36231b;
    @SerializedName("iv")
    @Expose

    /* renamed from: c */
    private String f36232c;

    public MessageEncryptedModel(String str, String str2, String str3) {
        C8465k.m23334f(str, "content");
        C8465k.m23334f(str2, "tag");
        C8465k.m23334f(str3, "iv");
        this.f36230a = str;
        this.f36231b = str2;
        this.f36232c = str3;
    }

    /* renamed from: a */
    public final String m11426a() {
        return this.f36230a;
    }

    /* renamed from: b */
    public final String m11425b() {
        return this.f36232c;
    }

    /* renamed from: c */
    public final String m11424c() {
        return this.f36231b;
    }
}
</code>```

Does anyone have an idea of how this JSON data is being encrypted before being sent? I have tried to understand through the package code by replicating it but I can't find a hardcoded key


问:
Differences between hex-editor and Ghidra and how to find strings
I just started playing around with reverse engineering and Ghidra, so please bear with me.

I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ISO, the other one does. As a learning exercise, I wanted to try patching the latter anyway: https://archive.org/download/Loewe2/Loewe2.iso/Setup%2FWinRoot%2FTerzio%2FLoewenzahn%202%2FLoewenzahn%202.exe

When I run the exe without the ISO mounted I get the error message Bitte die CD-ROM "Löwenzahn 2" einlegen!, which means Please insert CD-ROM "Löwenzahn 2"!.

So I ran strings -t x Loewenzahn\ 2.exe | grep einlegen and got the output 17020  einlegen!. I found the same address using the hex-editor Okteta.

file Loewenzahn\ 2.exe gives the following output:

```<code>Loewenzahn 2.exe: PE32 executable (GUI) Intel 80386, for MS Windows
</code>```

Now when I import Loewenzahn 2.exe into Ghidra and run all analyzers, there's a discrepancy between the addresses and I can't find the string "einlegen" via Search > For Strings....

Ghidra:

Okteta:

Why is there an offset and can I configure Ghidra to start at 0? Can I configure Ghidra to show the raw strings, like "Th is program canno t be run in DOS mode"? And how can I find it using the String search?


问:
analyze track program protected
What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?</p>

Title: analyze track program protected


问:
Encoding scheme identification of the following communication message
I'm trying to RE an app for educational purposes.
So here is the behavior of the app.

When the app starts, it communicate with a server in plain tcp and based on those tcp messages, it either work as intended or it stops. I need to understand this communication in order to know the behavior.

I'm able to intercept the messages in wireshark, here is the snap of a single message from client to server.

These are printable ASCII characters so its probably not encrypted. I need to understand this communication.

I'm pasting here a chunk of the above message in case someone needs a copy-past:

```<code>Uxr'6upap,r#G#$G{s@$'xpvUe{wBo4gZ]/y%+pqp r*~   8]i'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpu@WW[Avt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upttq/ZyMxpvpt$ruvt%rwt'qq&U}29\hZ`P|%u,]qSk]4StebleYyb6Yoa+}R\~.hJR~a#3JHdo/
Z_yRT
[UYvlm(BT%Gk!AS]VPvx    dZ
]fqBc"uDUr]JzX0j3wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#tua0-xgu07z(/dv!c\'X\^Wruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"C|t|Q~S/taR|dQw[~xvf`]ubd'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'qq#wqr'"upqp r#q##qy'sv 'xpvpt$ruvt%rwt'q
</code>```

Any help would be appreciated. thanks


问:
Inject script into Dex-Protected app
I've seen scripts like :

https://github.com/hluwa/frida-dexdump
https://github.com/apkunpacker/DexDumper

that can extract the Dex files but what I want is to inject into running app and identified the related class to modify is that possible?

Title: Inject script into Dex-Protected app


问:
Trying to understand a simple compiled PSI binary file
I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (A players save data, world settings and config, world data (terrain))

At first I thought it was some strange microsoft database thing, but apparently they are PSI binary files after doing some more digging. I could be wrong.

I am trying to understand how these formats work and if there is a particular known way to decompile them into something readable? Or are these a type of cryptographically sealed binary file, where they are compiled with a hash / password / key?

I honestly have no clue where to start.

Here is a sample from "world_db" which I assume represents the save data of the entire worlds terrain and items: https://github.com/MisterSirCode/world_db

If anyone could give me some clues or potentially has any information about these MDB files or PSI v1 binary files I would appreciate it.

All I can assume is that lock.db is the binary passcode / hash if it is a sealed binary file, since its so much smaller than the data.db file

The lock.db file just looks like a 4 letter term repeated randomly

Something else that might be related? https://github.com/LMDB


问:
Help MMO Tcp Packet
I'm trying re-send the packets that an MMO sends to the server just to learn more about packets. The game uses TCP.

I sent the same message in the game chat "oi"
to analyze the packages sent to the server and these are some examples:

```<code>\x80\x00=\x12\x00\x03\x00\x01c\x02\x01\x00\x01a\x03\x00\r\x00\x01p\x12\x00\x03\x00\x01c\x08\x00\x03msg\x00\x01r\x04\xff\xff\xff\xff\x00\x01p\x12\x00\x02\x00\x03msg\x08\x00\x02oi\x00\x01.\x04\xe4\x08a>

\x80\x00=\x12\x00\x03\x00\x01c\x02\x01\x00\x01a\x03\x00\r\x00\x01p\x12\x00\x03\x00\x01c\x08\x00\x03msg\x00\x01r\x04\xff\xff\xff\xff\x00\x01p\x12\x00\x02\x00\x03msg\x08\x00\x02oi\x00\x01.\x04\x96-\xad\xf5

\x80\x00=\x12\x00\x03\x00\x01c\x02\x01\x00\x01a\x03\x00\r\x00\x01p\x12\x00\x03\x00\x01c\x08\x00\x03msg\x00\x01r\x04\xff\xff\xff\xff\x00\x01p\x12\x00\x02\x00\x03msg\x08\x00\x02oi\x00\x01.\x04\x98\x01U\x80

\x80\x00=\x12\x00\x03\x00\x01c\x02\x01\x00\x01a\x03\x00\r\x00\x01p\x12\x00\x03\x00\x01c\x08\x00\x03msg\x00\x01r\x04\xff\xff\xff\xff\x00\x01p\x12\x00\x02\x00\x03msg\x08\x00\x02oi\x00\x01.\x04\r\xc9D\x1f
</code>```

As you can see, the end of each packet is changed with each packet sent to the server. Does anyone have any idea what these values at the end of each packet might mean? I want to be able to send my own packets

Title: Help MMO Tcp Packet


问:
How to debug C++ module/function call used in .net application?
I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this

```<code><Module>.X.Y.Z.Initialize(ptr, ptr2, flag);
</code>```

The function belongs to a DLL and appearently is a C(++) function call as I could find this by going to the module:

```<code>[MethodImpl(MethodImplOptions.Unmanaged | MethodImplOptions.PreserveSig)]
internal unsafe static extern void Initialize(byte*, byte*, [MarshalAs(UnmanagedType.U1)] bool);
</code>```

So my question is how can I analyze this function (Initialize)? Logically dnSpy is skipping it and IDAPro doesn't help me further since the DLL itself is a .net so I can't start a debugging session within IDA.

I've tried to create a Debug Time Travel Trace with WinDBG but it throws me an error when I'm ending the session and can't open the trace anymore.

Are there any suggestions how I can figure out or debug this function Initialize is doing?


问:
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW

In the second example, I set 2 breakpoints at the same time on  user32!CreateWindowExW and notepad!WinMain

In the 3rd example I place a breakpoint on notepad!WinMain, wait for it to break, and then I place the breakpoint on user32!CreateWindowExW, and this time it shows the jump instruction.

I confirmed that it does indeed jump to that address by stepping through, and I confirmed that the jump isn't there in the first 2 examples by unassembling as well as stepping to the next instruction. The callstack is identical in all 3 scenarios.

It reproduces every time. This is Windows 7 btw Windbg x64 10.0

What is going on ?


问:
Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?
I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. For the majority of the code so far, this works out fairly well, but there is one place that's really puzzling. I just can't figure out what kind of source code would get the compiler to produce this particular asm sequence.

So the relevant part of the original assembly is:

```<code>; function's stack layout:
vram_ptr        = dword ptr -4
target_offset   = word ptr  6
size            = word ptr  8
src_data        = dword ptr  0Ah

; the funtion also uses registers SI and DI to hold two loop variables.

; ----------------------------------------------------
; The code in question. It's basically just
; vram_ptr[i] = *src_data, but done in a very
; convoluted manner
; ----------------------------------------------------
les     bx, [bp+vram_ptr] ; load vram_ptr into ES:BX
push    es

mov     es, word ptr [bp+src_data+2] ; set ES to FP_SEG(src_data)
push    bx
mov     bx, word ptr [bp+src_data] ; set BX to FP_OFF(src_data)
mov     al, es:[bx]     ; basically _AL = *src_data
pop     bx

pop     es
mov     es:[bx+si], al  ; Store it
; ----------------------------------------------------
; ----------------------------------------------------

; src_data++
inc     word ptr [bp+src_data]
</code>```

When I do the most obvious thing and write dest[i] = *data; in C, the compiler generates something much more reasonable, but sadly different from the original:

```<code>les  bx,[vram_ptr]   ; same as original
push es              ; same as original

les  si,[src_data]   ; different, original avoids
mov  al,[es:si]      ; use of SI

pop  es              ; same as original
mov  [es:bx+di],al   ; same as original
inc  word [src_data] ; same as original
</code>```

And it also spills a loop variable to the stack that is held in SI in the original code, and uses DI instead of SI for the loop variable used in the expression. But no matter what I try, I can't get it to generate the original assembly.

It seems as though the compiler was somehow prevented from using SI in the data move expression, and was thus forced to generate the more complicated sequence.

What kind of source code and/or compiler flags might cause this?

For reference, here's the full C code I have so far (which is close to the original asm aside from the mismatches I mentioned):

```<code>void pascal CopyToVram(byte far* data, word size, word destOffset)
{
  register word i;
  register word mask;

  byte far* dest = MK_FP(0xa000, destOffset);

  // These macros just generate a bunch of port IO instructions
  EGA_SET_DEFAULT_MODE();
  EGA_SET_DEFAULT_BITMASK();

  for (i = 0; i < size; i++)
  {
    for (mask = 0x0100; mask < 0x1000; mask <<= 1)
    {
      disable();

      outport(0x03c4, mask | 0x02);

      // TODO: Codegen mismatch
      dest[i] = *data;
      data++;

      enable();
    }
  }
}
</code>```


Title: Image decompression: Reconstructed LZW dictionary somewhat, not exactly matches original dictionary

Body:
I am attempting to reverse an animation format that uses (I think) some form of LZW for each of the frames.

I have determined that a 12-bit code is used throughout the image. Here is a short target image with the code words separated out:

```<code>[0x0ff, 0x100, 0x101, 0x102, 0x103, 0x104, 0x104, 0x02f, 0x106, 0x02f, 0x105, 0x108, 0x109, 0x10a, 0x10b, 0x107, 0x10c, 0x106, 0x10b, 0x10e, 0x10f, 0x103, 0x10d, 0x111, 0x02f, 0x110, 0x113, 0x109, 0x112, 0x01c, 0x116, 0x01c, 0x10c, 0x114, 0x119, 0x100, 0x111, 0x117, 0x11c, 0x118, 0x107, 0x11a, 0x110, 0x11b, 0x11c, 0x01d, 0x122, 0x116, 0x10c, 0x11f, 0x10b, 0x120, 0x117, 0x122, 0x128, 0x117, 0x107, 0x125, 0x108, 0x126, 0x116, 0x128, 0x123, 0x11c, 0x107, 0x12b, 0x103, 0x12c, 0x01c, 0x12e, 0x01d, 0x11d, 0x124, 0x106, 0x131, 0x100, 0x132, 0x134, 0x136, 0x137, 0x106, 0x131, 0x139, 0x12e, 0x13b, 0x12a, 0x107, 0x125, 0x13d, 0x129, 0x13f, 0x13c, 0x02f, 0x11f, 0x141, 0x12f, 0x143, 0x13c, 0x105, 0x112, 0x103, 0x10d, 0x11d, 0x13a, 0x147, 0x130, 0x107, 0x102, 0x112, 0x107, 0x102, 0x10c, 0x01b, 0x121, 0x142, 0x14b, 0x14c, 0x14d, 0x154, 0x100, 0x14e, 0x14f, 0x152, 0x157, 0x154, 0x106, 0x153, 0x02f, 0x0ff, 0x107, 0x01b, 0x15d, 0x156, 0x157, 0x14b, 0x14d, 0x13b, 0x107, 0x0ff, 0x107, 0x01c, 0x15e, 0x160, 0x167, 0x13b, 0x13e, 0x11e, 0x10c, 0x116, 0x166, 0x168, 0x168, 0x134, 0x123, 0x115, 0x15e, 0x15f, 0x16f, 0x170, 0x172, 0x106, 0x0ff, 0x164, 0x165, 0x16e, 0x176, 0x17c, 0x107, 0x0ff, 0x16c, 0x17a, 0x15d, 0x17c, 0x17d, 0x106, 0x100, 0x17e, 0x174, 0x181, 0x16f, 0x107, 0x101, 0x183, 0x17b, 0x157, 0x180, 0x186, 0x106, 0x102, 0x187, 0x18a, 0x152, 0x174, 0x175, 0x152, 0x107, 0x103, 0x18c, 0x190, 0x13b, 0x18f, 0x188, 0x147, 0x107, 0x104, 0x192, 0x147, 0x17b, 0x18f, 0x14b, 0x01b, 0x107, 0x105, 0x198, 0x194, 0x180, 0x179, 0x195, 0x19f, 0x106, 0x109, 0x192, 0x175, 0x184, 0x126, 0x1a2, 0x16d, 0x15d, 0x106, 0x10a, 0x1a4, 0x1a2, 0x107, 0x0ff, 0x120, 0x195, 0x15e, 0x107, 0x10b, 0x1ab, 0x1a6, 0x106, 0x101, 0x1ad, 0x195, 0x107, 0x10e, 0x1b0, 0x14f, 0x107, 0x104, 0x1b2, 0x1a0, 0x106, 0x10f, 0x1b0, 0x16b, 0x108, 0x12c, 0x107, 0x113, 0x1a4, 0x16b, 0x02f, 0x10a, 0x159, 0x02f, 0x114, 0x18c, 0x13c, 0x10f, 0x14d, 0x11a, 0x148, 0x140, 0x106, 0x113, 0x10c, 0x12b, 0x1bc, 0x138, 0x11f, 0x154, 0x1c0, 0x12b, 0x10d, 0x1c1, 0x101, 0x1c4]
</code>```

Based on the understanding I gained from this example and this one, I wrote the following decoder for just the compressed image stream:

```<code>#!/bin/python3

import bitstring

def decompress_frame(data):
    compressed_stream = bitstring.ConstBitStream(data)
    bitmap_stream = []

    # INITIALIZE THE CODEBOOK.
    # The codebook should be initailized to the literal values 0x00 to 0xff in index order.
    code_book = []
    for initial_code in range(0x000, 0x100):
        code_book.append([initial_code])

    # DECODE THE FIRST PIXEL.
    # A 12-bit code is used throughout the image - no larger, no smaller.
    CODE_LENGTH: int = 12
    # The first pixel is always interpreted as a literal pixel.
    code_word = compressed_stream.read(CODE_LENGTH).uint
    bitmap_stream.append(code_word)
    previous_code_word = code_word
    while True:
        # READ THE NEXT CODE WORD.
        try:
            code_word = compressed_stream.read(CODE_LENGTH).uint
        except bitstring.ReadError:
            print("Out of bits")
            break

        # CHECK IF THE CODE WORD IS IN THE CODEBOOK.
        code_word_in_code_book = code_word < len(code_book)
        if code_word_in_code_book:
            # WRITE THE LITERAL PIXELS FOR THIS CODE WORD.
            literal_pixels = code_book[code_word]
            bitmap_stream.extend(literal_pixels)

            # ADD THE NEXT CODE TO THE CODEBOOK.
            # When the code word is already in the codebook, the next code is formed by
            # the previous code word and the first pixel of this code word.
            previous_code_word_pixels = code_book[previous_code_word]
            code_word_first_pixel = [code_book[code_word][0]]
            code_string = previous_code_word_pixels + code_word_first_pixel
            code_book.extend([code_string])
        else:
            # ADD THE NEXT CODE TO THE CODEBOOK.
            # When the code word is not in the codebook, add a code word formed by
            # the literal pixel string for the previous code word followed by the first
            # literal pixel for the previous code word.
            previous_code_word_pixels = []
            previous_code_word_pixels = code_book[previous_code_word]
            previous_code_word_first_pixel = [code_book[previous_code_word][0]]
            code_string = previous_code_word_pixels + previous_code_word_first_pixel
            code_book.extend([code_string])

            # WRITE THE LITERAL PIXELS FOR THE ADDED CODE WORD.
            bitmap_stream.extend(code_string)

        previous_code_word = code_word

    return code_book, bytes(bitmap_stream)

with open('Frame0', 'rb') as sample_file:
    code_book, uncompressed_image = decompress_frame(sample_file.read())
    for index, entry in enumerate(code_book):
        print(f'{index:03x}: {entry}')
</code>```

From the first added entry (entry 0x100), here's the beginning of the emitted codebook:

```<code>0x100: [255, 255],
0x101: [255, 255, 255],
0x102: [255, 255, 255, 255],
0x103: [255, 255, 255, 255, 255],
0x104: [255, 255, 255, 255, 255, 255],
0x105: [255, 255, 255, 255, 255, 255, 255],
0x106: [255, 255, 255, 255, 255, 255, 47],
0x107: [47, 255],
0x108: [255, 255, 255, 255, 255, 255, 47, 47],
0x109: [47, 255],
0x10A: [255, 255, 255, 255, 255, 255, 255, 255],
0x10B: [255, 255, 255, 255, 255, 255, 47, 47, 47],
0x10C: [47, 255, 255]
</code>```

(Full attempted codebook at https://pastebin.com/hWBsxdTE .)

However, starting at 0x106, the rebuilt codebook gets off track and never gets back on again. When I do a pixdump of the emitted pixels, I see nothing recognizable. However, by some breakpointing in OllyDbg, I extracted the correct codebook from memory for this same frame. Here is the start of the correct codebook, as extracted from memory and verified to decompress the image correctly:

```<code>0x100: [255, 255],
0x101: [255, 255, 255],
0x102: [255, 255, 255, 255],
0x103: [255, 255, 255, 255, 255],
0x104: [255, 255, 255, 255, 255, 255],
0x105: [255, 255, 255, 255, 255, 255, 255],
0x106: [47, 47],
0x107: [47, 47, 47],
0x108: [255, 255, 255, 255, 255, 255, 255],
0x109: [255, 255, 255, 255, 255, 255, 255, 255],
0x10A: [255, 255, 255, 255, 255, 255, 255, 255, 255],
0x10B: [255, 255, 255, 255, 255, 255, 255, 255, 255, 255],
0x10C: [47, 47, 47, 47]
</code>```

(Full dumped codebook at https://pastebin.com/x7V0VmkY .)

The structure of the dumped (correct) codebook suggested to me that maybe some sort of hashing was going on, but I do not see hashing logic in the disassembly. (My disassembly skills aren't super strong so I could have missed it.) There are no debugging symbols or helpful strings that I can find.

Any thoughts on what my decoder script could be missing here that would cause a malformed codebook and thus incorrectly decoded image?

For the example frame discussed above, this is the correct image (taken as a screenshot from the animation):


问:
Does anyone recognize this jQuery website plugin?
I am working on a site that was made years ago (not be me) and I need to identify a jQuery file manager plugin. This plugin shows a file manager view in a browser and allows the user to visually navigate a directory tree and view, upload, or download files.

In its code it refers to itself as documentLibrary or Document Library. Based on file dates, it looks like this may have been implemented circa 2017.

I have tried a variety of Google searches, as you can imagine the terms "jQuery file manager" and "jQuery document library" yield a lot of results that have nothing to do with what I am looking for. I have tried searching for pieces of the code, but I do not have any luck.

I have found similarly named products related to a WordPress plugin and Sharepoint services, but they do not seem to be related to the plugin I am looking at.

Here are some snippets that seem like they could be identifiable by someone familiar with this plugin.

```<code>    $.documentLibrary = function(element, options) {

        var defaults = {
            ajax_url        : false,
            csrf            : false,
            file_container  : false,
            folder_table    : false,
            tool_bar        : false,
            drop_zone       : false,
            is_media_modal  : false,
            example_callback: function() {},
            restrict_files : []
        };
</code>```
```<code>        plugin.init = function() {
            plugin.settings = $.extend({}, defaults, options);
            plugin.open_folders = [];
            if(plugin.settings.csrf===false){throw "Configuation Error: The document library requires a csrf token for ajax calls.";}
            if(plugin.settings.ajax_url===false){throw "Document Library requires an ajax url.";}
            if(plugin.settings.folder_table === false ){
                throw "Document Library requires a file holder.";
</code>```

Thanks for any help. Let me know if I can provide more information.


问:
De-Obfuscating/unminifying a JS code [not duplicate]
I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results.

I have a piece of code which, initially I am trying to understand if it is obfuscated or not in the first place. I am also wondering if this is minified.

I reverse-engineered a .wxapkg file and found several files within it - HTML, CSS, JS, JSON. I am trying to perform static analysis on these JS files but I am not able to read them properly.

Previous questions had various tools to de obfuscate but none of them worked for me. There are around 20 JS files which are way too big for each app and all of them are more or less like this. I have provided just a small piece of code from the whole JS file which is as follows (forget the bracket counts):

```<code>onShareAppMessage: function () {
              var t = "yb_cy/shop/goods?storeId="
                .concat(this.storeId, "&userId=")
                .concat(this.uId);
              return this.util.mpShare({
                t: this.sjxx.storeInfo.name,
                p: t,
              });
            },
          };
        e.default = p;
      }.call(this, o("543d").default));
    },
    ab88: function (t, e, o) {
      (function (t) {
        function e(t) {
          return t && t.__esModule ? t : { default: t };
        }
        o("f00a"), e(o("66fd")), t(e(o("493a")).default);
      }.call(this, o("543d").createPage));
    },
  },
  [["ab88", "common/runtime", "common/vendor"]],
]);
</code>```

Now is this obfuscated? Is this type of code valid for static analysis?
If this is obfuscated, how can I further proceed with the same code?

Are there any easier ways to make it more readable/understandable?

Would be very glad if this is not being downvoted/disregarded and someone genuinely help me with my query :)

Thanks

Note: It was very clumsy before. So I used VS Code's Prettier Code Formatter Extension to make it look like this.


问:
Spy on LCD screen with Raspberry Pi
I have this digital crane scale. It has a 5 digit 7 segment LCD display. My objective is to be able to read what is displayed on the LCD display with a Raspberry Pi. This is what the PCB looks like:
It looks like there are 15 input pins to the LCD module at the top of the PCB. Could I read some of these with the GPIO pins on the Raspberry Pi to determine what is being displayed on the screen?

Title: Spy on LCD screen with Raspberry Pi


问:
Reverse Engineering SCARA Style Robot - USB Protocol
I am new to the topic of reverse engineering software (not new to hardware reverse engineering), so this question is more of a "lets ask people's opinion" type of thing.

I have a robot arm that my biology research lab wants to use for more than the companies software will let it. So I was tasked with writing our own code for controlling the robot so it can do more things.

Using Wireshark I can see it is made up of 1 USB hub that controls two cameras and two usb-serial converters. I would imagine that the USB-Serial converters are controlling the motors, but when I look at the data passing through those devices, I see a lot more than just data being sent when the robot arm moves.

The struggle is that the original software doesn't have a way to move individual arms so I can't simply move and arm and see what data is sent. It only completes compound movements and I am struggling to parse it all out.

Any advice for how to filter out some of the background noise and focus in on the actual control protocol?

Thank you!

Edit:

This is a screenshot of what Wireshark says the robot contains inside of it. I would think that the communication to the joints would go through the USB-Serial converter


问:
How to get instructions at her address?
With the help of gidra, I found the function of interest.

```<code>void __fastcall FUN_gameWhile(int buf?)
</code>```

function address in gidra - 00aad920

I'm trying to get instructions at this address using frida

```<code>var moduleData = Process.getModuleByName("main.exe");
var Iprp = moduleData.base.add("0xd920");
console.log(Iprp);
console.log(Instruction.parse(Iprp));
</code>```

looking forward to seeing the instructions : push ebp

But I see instructions : dec ebx and adress 0x53d920

If you go to this address in the debugger, there really is this instruction (dec ebx).

I guess it has to do with __fastcall in front of the function name. Why is this happening and how can I get instructions at this address using Frida?

Title: How to get instructions at her address?


问:
Is there any reason to define a struct instead of a local type in IDA pro?
It seems to me that there is no reason whatsoever to define an asm-style struct rather than a C-style type. A C-style struct type can contain references to floats and doubles, user defined types, and pointers rather than just word, dword etc. Why does the struct subview even exist?</p>


问:
Brute Force USB Fuzzing
I am working to reverse engineer a USB based robot arm,  but the operating system for the robot won't allow me to create simple enough moves that I can isolate the commands with a USB Sniffer like Wireshark. So I am looking for two new options.

Is there a program like Wireshark that allows you to record usb traffic and selectively playback commands in the program? With Wireshark I would have to write the USB command in a python script and then send it to the device but the simplest I can get is ~10,000 commands and that would be difficult. I would like to be able to in the program, just click the command and like a resend button so I can see if that command is the one I need to control a joint or motor.

Can I just brute force the system? Could I write a python program that simply steps through all 255 bytes for each spot on the usb command in a reasonable amount of time? I know the math doesn't make that a good option since it would mean A LOT of possible combinations but maybe someone has a method of brute forcing that doesn't require each part of the USB command to be tried?

Thank you all!!

Title: Brute Force USB Fuzzing