问:
submitting input into AFL fuzzer
I have some questions about the AFL Fuzzer:

How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?

As I understood, if I put all test cases in the input directory it knows to build randomly injections based on that input, yes?

I saw a video shows that if for instance there are two inputs in the code, so in the test case each line is for each input. Is that correct? Since I want put a full message (for example HTTP request) into one variable, so how do I do it ?

I have compiled everything correctly but for some reason it does not find any new paths. In addition, if I do not put the -m none I get the following error : "Fork server crashed with signal 6".

I don't understand when to put @@.

Title: submitting input into AFL fuzzer


问:
Uniden FW Hacking
I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly.

FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a Renesas Electronics 32-bit Microcontrollers - MCU RX631 1MB/128KB.

The latest FW bin for this model is here:

https://www.mediafire.com/file/vp2drmh7dvgjpfi/BCD325P2_V1_08_01.bin/file

The FW bin looks packed or obfuscated, there are no strings and binwalk shows nothing.

Could someone point me in the right direction?

I would really like to get this loaded into a disassembler.

ContentLicense: CC BY-SA 4.0

Title: Uniden FW Hacking


问:
Obtaining a relation between reads and writes with Pin
I'll be honest, Pin is confounding my intuition. Let's say, for the sake of argument, I have a line

```<code> a = b + c
</code>```

and I wish to then store the addresses of b and c as a's dependencies, say, in a map,

```<code>m[address of a].append(address of b, address of c)
</code>```

My current understanding of this involves

```<code>if (INS_IsMemoryRead(ins)||INS_IsMemoryWrite(ins))
for(memOp=0;memOp<INS_MemoryOperandCount(ins);memOp++)
INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR) AnalysisFunction, IARG_MEMORYOP_EA, memOp, IARG_THREAD_ID, IARG_END);
</code>```

where AnalysisFunction would essentially take the memory address from the operation and somehow return it, or put it into a map. But I'm not entirely certain how to do that, or how to correlate the reads to writes properly.

Any help would be appreciated


问:
Extract .NET code from React Native for Windows
I'm interested in reversing a UWP program made using React Native for Windows. Once such applications are compiled, the logic is contained in one dll. After opening this dll into IDA, it appears pretty clear that the file contains a .NET part (located in the section .rdata) and generic stub as native code in the .text section.

Did anyone already succeed to extract the .NET code in the .rdata section and open it in a standard decompiler?

Cheers!


问:
Is there a way to identify a specific microprocessor model?
I'm working on reversing a USB flash drive controller chip. I know there's a microprocessor that runs some 8051 variant, and I have the ability to run arbitrary code on it. There's lots of different 8051-like manufacturers though, and I'd like to find out the specific processor model on this specific chip.

I don't think the reason is relevant, but it's because I'm interested in breaking a model-specific code protection mechanism, and I need to know the model for it.

My question is, is there some standard way to find out the model/manufacturer of the processor? Maybe a special function register that holds a vendor specific signature, or something akin to x86's CPUID. I could break the chip and look for the processor within but I'd really prefer not to do that.


问:
Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate
I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to a Kali Linux VM on my host. I'm using the command, sudo ./flashrom -p buspirate_spi:dev=/dev/ttyUSB0 to identify the chip, but flashrom isn't able to.

```<code>root@malnet:/opt/flashrom# sudo ./flashrom -p buspirate_spi:dev=/dev/ttyUSB0
flashrom v1.1-rc1-121-g8962267 on Linux 4.19.0-kali5-amd64 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Bus Pirate firmware 6.1 and older does not support SPI speeds above 2 MHz. Limiting speed to 2 MHz.
It is recommended to upgrade to firmware 6.2 or newer.
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.
</code>```

How do I get the firmware dumped from the chip? Any ideas as to why flashrom may not be working or alternate methods to dump?


问:
Trying to identify Renesas custom SoC through CPU die inspection
Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by reviewing the other documents. PDF of die analysis. (It's the part # R8A02021ABG) The device is mounted to a Roland GR-55 synthesizer, and what I'm trying to do is properly setup the unit's debugger so I can try to create simple patches for the firmware, like changing string names.

So far I've been able to identify that its a custom SoC by noticing that the unique part number which is written on the device is present in the die marking which is part of the metal layers. I was wondering if by looking someone could tell what functional blocks are on the die or the size of the memory/cache. I've identified it's in the super-H family by reviewing the GR-55 schematics
 (PG.34) and seeing the port for the E10A-usb debugger/emulator. Also when reviewing the schematics for other Roland devices that use the same custom SoC like the Roland aerophone ae10, and Jupiter 80, I could see the debug port was labled E10A-usb. E10a-usb supported devices.

So with this info gathered i'm still unsure which series it belongs to. Super-H series. I believe its most likely based off the SH-3-DSP or SH-4-DSP devices. I only say this because I know Roland is using DSP technology on the GR-55, and only devices in those series are using DSP. So from here I've been trying to see if there is a device in these series with a superset of features that are included in the GR-55 like DSP. I've also looked for A/D and D/A converters which the GR-55 states it has at 24 bit. (pg.3 GR-55 schematics) and none of the devices in this family have converters that go as high as 24 bit. when reviewing the schematics for the Roland Jupiter-80 I came across a note that looks like it states the clock speed of the custom SoC at 192MHz/64MHz but I don't know if it's stating the maximum clock speed or somthing els. I don't know how to interpret this note, and was wondering if someone could explain what it's saying. A similar note can be seen in the GR-55 schematics.

Also I was wondering if it's common for debuggers to provide any info on the devices they're connected to. Maybe the E10A-usb emulator can provide some info on my device.

super-H devices specifications


问:
80188 relocation register mystery
I'm reverse engineering an embedded system using the 80C188 and the way the relocation register (RELREG) is used mystifies me.

One of the first steps at initialization is to move the processor control registers by writing a new value to the RELREG.

By default, the RELREG has the value 20FFH which places the register block at the top of I/O space at address 0FFxxH. The example given in the Intel app note describes writing the value of 1100H to the RELREG which then places the register block in memory space at 100xxH. Clear enough.

However, in the system I am examining, the value written is 1804H which I would expect to place the register block in memory space at the address 804xxH, yet the following writes to initialize the registers to operating values are all to 0F4xxH in memory space. The processor is operating fine in the system so this is not a programming bug.

I am absolutely sure about these addresses as not only do I see them in the code itself on the EPROM but also in logic analyzer traces of code execution at startup.

Does anyone have an explanation for this?

Title: 80188 relocation register mystery


问:
How to use API Monitor to filter function parameters?
I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to what I am interested in but I am still getting a lot function calls with parameters that I am not interested in.

Is there way to filter out/in function calls with certain parameters?


问:
Voltage Glitching to Read Internal EEPROM
I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it.

I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it's key in internal EEPROM that cannot be read during normal operation.

However, the datasheet says that "At the end of the programming cycle, the device can be verified by reading back the EEPROM". The mentioned programming cycle is just writing the EEPROM.

I was thinking that maybe it is possible to perform a voltage glitching attack on the chip to make it think that it has just been programmed so that EEPROM can be read.

The feasibility of this clearly depends on how the read protection is implemented on the chip. I would think that it would be basically a check if a certain bit is set in a register but I'm not sure. If this is the case, it should theoretically be possible to bypass that instruction via glitching.

Based on the following diagram for how to perform the verification,

I wrote a small Arduino sketch that does the following:

```<code>1. Set S1 and S3 to high
2. Perform the glitch
3. Clock S3 and read from DATA
</code>```

and retries with different glitch times.

Most of the time, I get the expected PWM data on the DATA line that is transmitted on a button press. However, as the glitches get longer, I get more and more 0's.

Is this method even remotely feasible or should I just program the chip and relearn it to my car?


问:
Do you know the equivalent of the Intel Pin utility for AMD processors
Do you know an instrument equivalent to Intel Pin (https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool) for AMD processors, which helps me especially for reverse of whitebox (https://insinuator.net/2016/03/how-to-crack-a-white-box-without-much-effort/).</p>


问:
Bin patching Arm7tdmi CRC32?
Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin from it or another cluster it works but if I change anything in the bin it won't work.. Don't worry I am not messing with the Odo value thats stored on an EEprom and easy to change lol.

Learned a little about bin patching via youtube/google and ran the bin through binwalk. doing  that binwalk says

Decimal: 211720  HEX:0x33b08 Description: crc32.

I'm guessing this CRC not matching is making it fail to boot. If I look at the bin with HxD I don't see anything that matches what Binwalk is saying but I am probably looking at it wrong. Where do I find the CRC in this bin from what address is this crc checking because if I use HxD or online CRC generators It doesnt match anything in the bin also...

I am sure I am not describing this all correctly I am still learning and climbing mt. stupid.

All I want to do is change some of the error messages to say something funny. I am just doing this for the novelty and to learn something new.

Linked Github with the bin, Github link

BTW all edits I make are one for one changes so I am not shifting anything around in the bin. The attached is unedited and works.

Title: Bin patching Arm7tdmi CRC32?


问:
Learning Intel Disassembler, What to learn for Intel XED
In order to learn about disassembly and code something like Capstone disassembler, HDE etc. for a function , calculate opcodes etc , Please advise on what I should know. I have some knowledge of Assembly language (NASM) and C, But what do I have to study to learn disassembly and design something like that?</p>


问:
IDA's debuggers disappeared
Using IDA 7

I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this database, though. Any ideas?

Title: IDA's debuggers disappeared


问:
IDA pro 7... how do you tell which module each string is in?
In IDA pro 7, when you generate the list of stirngs in the strings window, it gives you an "address" which starts with something like "debug12x"... is there any way to tell which module that is in? Or what binary file's were involved in creating that? The debug12xxxxx address isn't something I understand, but I'm trying to find which module or binary file had the code that created that string... but when I double click the string it takes me to the "IDA-View RIP" which says the exact same debug12xxxxx and doesn't seem to say anywhere more about where the string came from or which module made it...? This is happening when attaching a debugger to a running process in windows 10.</p>


问:
Extracting specific files from a unknown archive file format
I'm trying to extract some binary blobs from a unknown archive format. (*.pakz).
I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those files from the archive.

By doing some research I've came across binwalk. So I've tried to extract some signature info from it. It returned me several blobs of LZMA compressed data.

f.ex, this is the first entries in the output of binwalk

```<code>    DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
12            0xC             LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 1130064 bytes
1079006       0x1076DE        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 669520 bytes
1718248       0x1A37E8        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 807872 bytes
</code>```

I assume these are parts of a single compressed file I should combine? So I tried extracting each individual files/blob with carve option. This outputs me several .7z files however many are missing. I don't know why, by using verbose and log command line options, it doens't output any errors but outputs LZMA blob addresses that are not extracted.

If I extract files I get several .xml files that give me useful information, f.ex, the path of the files I'm looking for but I still don't know from the path the start/end bytes of that file.

Does anyone has any clue?
Thanks in advance.


问:
Debug only one thread with ida-gdb server
If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida.

The problem is if this process has 1 thread that can't stop over than x seconds (for example this thread feed the watchdog).

How can I attach to debug all threads in the process instead the thread that feed the watchdog(I know the thread id) . Or maybe debug only 1 thread in the process that interesting me.

When I attach to process and debug all thread are stopped.


问:
Blank binwalk and binvis.io
I've been trying to extract a Bluetooth door lock's firmware. When I tried extracting it, I got an empty output.

I then found a post which I thought would help me but when I tried using binvis.io, this is what I got:

I'm a newbie so that means it's empty right?

So my question is, what could've cause this to happened? Because when I extract it from a nRf51 chip using OpenOCD and ST-Link V2, it does show that what I extracted is 256kB.

My guess right now is that it is encrypted? Or could it be because im using Windows to execute this? If so, I can try using Kali Linux since I run dual boot. Or maybe I did something wrong when extracting the bin file with OpenOCD? Below is the command used.

```<code>dump_image stock_nrf51.bin 0x0 0x40000
</code>```

Sorry if I sound silly. Newbie here. Please let me know if I'm not being specific enough or not providing enough information. Would gladly provide them if you need them such as bin file etc.

Title: Blank binwalk and binvis.io


问:
Extract files of a SquashFS Filesystem
I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one.

I extracted a squashfs filesystem from a NAND Flash with binwalk. The problem was that I couldn't see the files that it contains, even sasquatch wasn't able to extract the files.
That's why I assumed that I was dealing with a vendor hacked version of squashfs that sasquatch couldn't handle.

However after a deeper analysis I found out that the extracted squashfs filesystem was looking very suspicious to me due to two things.

First of all it starts with a generic squashfs header but right after the header there is a large sequence of 0xFF Bytes that is interrupted by a 0x01 Byte every 17. Byte.

Besides of that the whole sequence is interrupted periodically by some kind of UBI signature.

You can see this in the picture.

The second thing that looked suspicious to me was that after the large sequence mentioned above the UBI signature kept appearing periodically (until the end ) through the whole part that is supposed to be what the suqashfs contains. (the signature is sometimes different from each other but still very similar).

I also know from the boot process analysis that the rootfs of the device is mounted on top of a UBI volume:

root=/dev/ubiblock0_1 noinitrd ro ubi.mtd=6 mtdparts=spi0.0:256k(u-boot),64k(u-boot-env),128k(reserved),64k(art);spi0.1:5m(kernel0),5m(kernel1),118m(ubi) rootfstype=squashfs ubi.block=0,1 mem=64M

Has the UBI signature that is appearing through the entire squashfs file something to do with the fact that it is mounted on top of a UBI volume and how do I deal with that?

Or how can I mount it/is it possible to mount it like this?

Title: Extract files of a SquashFS Filesystem


问:
Possibly infected image
Long story short I'v downloaded a template for my website and instead of images it has the .html files included, and at the beginning  those html files do include PNG IHDR , and they are being loaded perfectly by chrome, but something is telling me that there is some sort of script included.
Spent all night trying to figure this out, ran binwalk on it, without any clear hints, just producing a couple of zlib files
Any help would be appreciated

File in question -
https://s3.eu-north-1.amazonaws.com/www.giftsmenu.com/infected/Gomez.html

Title: Possibly infected image


问:
Samsung A520F usb type-c uart debug mode
I'm trying to create UART cable for A520F phone with USB type-c. Seems, there is no UART debug modes S8+ either.  On Samsung phones with micro USB one may access UART JIG mode with  619K resistor, connected to micro USB ID pin.

How I test:

I can dump MUIC registers. I have raw usb type c plug(mounted on board with solder pads), with cable soldered, which maps usb type c pins on breadboard. So I assemble test scheme and analyze MUIC registers and MUIC linux kernel module log output upon attachment.

What I currently find:

The receptacle is managed by s2mu004 kernel module. Module is capable to manage non type-c receptacles (see CONFIG_MUIC_S2MU004_NON_USB_C_TYPE option)

Receptacle has non standard pinout: B12 (considering, A row facing top, B row facing bottom side of the phone) pin is not connected to the ground.

Device can detect water in usb receptacle, by measuring resistance between B12 pin.

Device can detect plug attach, with ALL pins unconnected, including GND and VBUS pins. How?

Attaching 619K resistor to B12 pin results in ADC_JIG_UART_ON value in ADC register, during water detection sequence.

Attaching 619K resistor to one of CC pins result in no device connected.

Enter UART mode by attaching resistors should be possible in NON type-c mode. (file s2mu004-muic.c ,lines 2835,2797)

Device has no USB type-c debug accessory mode(tried both with rd/rd and rp/rp resistors on CC pins) - rd/rd results in OTG mode.

What else can I try?
If you were this device developer, how would you hide UART debug mode from users?


问:
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused

```<code>...
0x77491dbe  64 ff 15 c0 00 00 00  call fs:[0xc0]          ; syswow64\ntdll.dll
0x74632320  ea 1e 27 63 74 33 00  jmp far 0x33:0x7463271e ; system32\wow64cpu.dll
0x7463271e  67 44 8b 04 24        mov r8d, [esp]          ; system32\wow64cpu.dll
...
</code>```

The first instruction is something similar with X86SwitchTo64BitMode, the second one is a switch back to 64-bit mode. So wow64cpu.dll has been actually mapped into two different code segments: cs = 23 for compat mode (second instruction) and cs = 33 for 64-bit mode (third instruction).

However I cannot find the second instruction (jmp far...) in the corresponding dll. There are ea 1e 27 b6 78... at 0x74632320, not ea 1e 27 64... as being observed in the trace.

Was wow64cpu.dll modified when being mapped into the memory?

Title: Memory modified at jump far


问:
Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly
Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is set this causes the add-in to randomly crash. While I have used CFF explorer to remove the DLL characteristic for now to fix the application I am wondering if there is any static analysis techniques could be used on a disassembly to find ASLR incompatibility using tool like IDA Pro, or what such code may look like if come across analysing the application crash dumps.

With WinDbg I can see access violation here due to rbp set to invalid value:

```<code>uccoext64!GetOutlookViewID+0x46eee:
0000016b`01f75bae 488b4500        mov     rax,qword ptr [rbp] ss:00000000`05cccc50=????????????????
</code>```

Stepping backwards I find this invalid value is set in a different DLL:

```<code>UcLogging64+0x1ec8:
0000016b`05201ec8 488b6c2438      mov     rbp,qword ptr [rsp+38h] ss:00000029`834f8978=0000000005cccc50
</code>```

This section of code:

```<code>0:000> uf 0000016b`05201ec8 488b6c2438
UcLogging64+0x1e40:
0000016b`05201e40 48895c2408      mov     qword ptr [rsp+8],rbx
0000016b`05201e45 48896c2410      mov     qword ptr [rsp+10h],rbp
0000016b`05201e4a 48897c2418      mov     qword ptr [rsp+18h],rdi
0000016b`05201e4f 4154            push    r12
0000016b`05201e51 4883ec20        sub     rsp,20h
0000016b`05201e55 33ff            xor     edi,edi
0000016b`05201e57 418bd9          mov     ebx,r9d
0000016b`05201e5a 4d8be0          mov     r12,r8
0000016b`05201e5d 488bea          mov     rbp,rdx
0000016b`05201e60 40387928        cmp     byte ptr [rcx+28h],dil
0000016b`05201e64 7423            je      UcLogging64+0x1e89 (0000016b`05201e89)  Branch

UcLogging64+0x1e66:
0000016b`05201e66 8b542450        mov     edx,dword ptr [rsp+50h]
0000016b`05201e6a 488d0d0fd60000  lea     rcx,[UcLogging64!UnifiedClientTrace+0xa480 (0000016b`0520f480)]
0000016b`05201e71 e82afaffff      call    UcLogging64+0x18a0 (0000016b`052018a0)
0000016b`05201e76 4885c0          test    rax,rax
0000016b`05201e79 7403            je      UcLogging64+0x1e7e (0000016b`05201e7e)  Branch

UcLogging64+0x1e7b:
0000016b`05201e7b 8b780c          mov     edi,dword ptr [rax+0Ch]

UcLogging64+0x1e7e:
0000016b`05201e7e f6c304          test    bl,4
0000016b`05201e81 7406            je      UcLogging64+0x1e89 (0000016b`05201e89)  Branch

UcLogging64+0x1e83:
0000016b`05201e83 85ff            test    edi,edi
0000016b`05201e85 7e02            jle     UcLogging64+0x1e89 (0000016b`05201e89)  Branch

UcLogging64+0x1e87:
0000016b`05201e87 ffcf            dec     edi

UcLogging64+0x1e89:
0000016b`05201e89 448b442450      mov     r8d,dword ptr [rsp+50h]
0000016b`05201e8e 448bcf          mov     r9d,edi
0000016b`05201e91 498bd4          mov     rdx,r12
0000016b`05201e94 488bcd          mov     rcx,rbp
0000016b`05201e97 e834fcffff      call    UcLogging64+0x1ad0 (0000016b`05201ad0)
0000016b`05201e9c f6c301          test    bl,1
0000016b`05201e9f 7422            je      UcLogging64+0x1ec3 (0000016b`05201ec3)  Branch

UcLogging64+0x1ea1:
0000016b`05201ea1 33c0            xor     eax,eax
0000016b`05201ea3 488bfd          mov     rdi,rbp
0000016b`05201ea6 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh
0000016b`05201eaa 66f2af          repne scas word ptr [rdi]
0000016b`05201ead 488b053c890000  mov     rax,qword ptr [UcLogging64!UnifiedClientTrace+0x57f0 (0000016b`0520a7f0)]
0000016b`05201eb4 488947fe        mov     qword ptr [rdi-2],rax
0000016b`05201eb8 488b0539890000  mov     rax,qword ptr [UcLogging64!UnifiedClientTrace+0x57f8 (0000016b`0520a7f8)]
0000016b`05201ebf 48894706        mov     qword ptr [rdi+6],rax

UcLogging64+0x1ec3:
0000016b`05201ec3 488b5c2430      mov     rbx,qword ptr [rsp+30h]
0000016b`05201ec8 488b6c2438      mov     rbp,qword ptr [rsp+38h]
0000016b`05201ecd 488b7c2440      mov     rdi,qword ptr [rsp+40h]
0000016b`05201ed2 4883c420        add     rsp,20h
0000016b`05201ed6 415c            pop     r12
0000016b`05201ed8 c3              ret
</code>```

Using Time Travel debugging and a memory write breakpoint on this location I see it seems to change here, stepping backwards:

```<code>UcLogging64+0x1e45:
0000016b`05201e45 48896c2410      mov     qword ptr [rsp+10h],rbp ss:00000029`834f8978=0000016b0520add8
0:000> r rbp
rbp=0000000005cccc50
</code>```

Looking again for when rbp is set to this:

```<code>UcLogging64+0x1193:
0000016b`05201193 488b6c2448      mov     rbp,qword ptr [rsp+48h] ss:00000029`834f8958=0000000005cccc50
</code>```

Stepping back:

```<code>UcLogging64+0x108a:
0000016b`0520108a 56              push    rsi
0:000> dd 00000029`834f8958
00000029`834f8958  05cccc50 00000000 834f8a09 00000029
00000029`834f8968  052051a4 0000016b 0520a728 0000016b
00000029`834f8978  0520add8 0000016b 834f89e0 00000029
00000029`834f8988  6d5e0000 00000000 000004e0 53282064
00000029`834f8998  01f92a80 0000016b 0520a728 0000016b
00000029`834f89a8  0520f0a0 0000016b ffffff01 ffffffff
00000029`834f89b8  01f92a70 0000016b 00000027 00000000
00000029`834f89c8  834fa670 00000029 fffffffe ffffffff
0:000> t-
Time Travel Position: 6516CD:1B [Unindexed] Index
UcLogging64+0x1085:
0000016b`05201085 48896c2420      mov     qword ptr [rsp+20h],rbp ss:00000029`834f8958=0000016b01fad918
0:000> dd 00000029`834f8958
00000029`834f8958  01fad918 0000016b 834f8a09 00000029
</code>```

Going backwards again see this change to invalid instuction on pop rbp:

```<code>rbp=00000029834f8930
0:000> t-
Time Travel Position: 6516CB:134 [Unindexed] Index
MSVCR100!vswprintf_l+0xd7:
00000000`6d61400f 4883c450        add     rsp,50h
0:000> r rbp
rbp=00000029834f8930
0:000> t
Time Travel Position: 6516CB:135 [Unindexed] Index
MSVCR100!vswprintf_l+0xdb:
00000000`6d614013 5d              pop     rbp
0:000> t
Time Travel Position: 6516CB:136 [Unindexed] Index
MSVCR100!vswprintf_l+0xdc:
00000000`6d614014 c3              ret
0:000> r rbp
rbp=0000000005cccc50
</code>```

As the value was corrupt before function started:

```<code>Time Travel Position: 6516CA:B51 [Unindexed] Index
MSVCR100!vswprintf_l+0x13:
00000000`6d613f4b 55              push    rbp
0:000> t-
Time Travel Position: 6516CA:B50 [Unindexed] Index
MSVCR100!vswprintf_l+0xf:
00000000`6d613f47 4c896020        mov     qword ptr [rax+20h],r12 ds:00000029`834f8958=0000000000000004
0:000> r rbp
rbp=0000000005cccc50
</code>```

This gets setup in a previous msvcr100!vswprintf_l call:

```<code>MSVCR100!vsnprintf_l+0xbb:
00000000`6d613a0b 488b6c2468      mov     rbp,qword ptr [rsp+68h] ss:00000029`834f8938=0000000005cccc50
0:000> r rbp
rbp=0000000000000000
0:000> t
Time Travel Position: 6516CA:ACB [Unindexed] Index
MSVCR100!vsnprintf_l+0xc0:
00000000`6d613a10 488b742470      mov     rsi,qword ptr [rsp+70h] ss:00000029`834f8940=0000016b01fad918
0:000> r rbp
rbp=0000000005cccc50
</code>```

This is setup earlier:

```<code>0:000> r rbp
rbp=0000000005cccc50
0:000> t
Time Travel Position: 6516CA:11C [Unindexed] Index
MSVCR100!vsnprintf_l+0x3:
00000000`6d613953 48895808        mov     qword ptr [rax+8],rbx ds:00000029`834f8930=0000016b0520f0a0
0:000> t
Time Travel Position: 6516CA:11D [Unindexed] Index
MSVCR100!vsnprintf_l+0x7:
00000000`6d613957 48896810        mov     qword ptr [rax+10h],rbp ds:00000029`834f8938=0000016b0520f000
0:000> t
</code>```

This continues, I haven't traced all the way back to origin yet, I am wondering if there is some other way I could find likely code to create this problem.


问:
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.

I figured out how most of the binary works, except the very last part in WinMain located at 401FE7. I have the problem with reversing where if-block starts at 004020FE, there's a lot of gibberish code following. Wannacry calls the function at 4020F5 which loads ADVAPI32.dll and KERNEL32.dll and gets function handles. Instruction at 402112 calls the function which prepares the decryption key to be used further. Before it wannacry unpacks an archive with several files. 40212D calls function which decrypts t.wnry and stores contents somewhere in process space. This is all I know for sure except unnecessary details. So I have a few questions:

When program calls 4012FD function at 402104, what does this function do? The main body doesn't have meaningful code. There are several functions nested in it which call InitializeCriticalSection().

There are 2 functions located at 4021BD and 402924. The first one calls another functions with arguments referring to functions like VirtualAlloc, VirtualFree, LoadLibrary, etc. 402924 just contains some magic code. I realize this is where wannacry launcher transmits execution to another process, I just want to know the mechanism how it does in general.

Btw wannacry loads several functions from KERNEL32.dll which it already had, why does it load them again?

Title: How does this wannacry sample work?


问:
Strange function in Disassembly (IDA)
I was reversing one executable in IDA and found out the function with this structure:

```<code>.text:0058A6E0 sub_58A6E0      proc near
.text:0058A6E0
.text:0058A6E0 var_4           = dword ptr -4
.text:0058A6E0
.text:0058A6E0                 push    ecx
.text:0058A6E1                 mov     ecx, ds:SHAppBarMessage
.text:0058A6E7                 mov     eax, offset loc_612BC0
.text:0058A6EC                 or      eax, offset loc_612BBA
.text:0058A6F1                 or      eax, offset loc_612BB4
.text:0058A6F6                 or      eax, offset loc_612BAE
.text:0058A6FB                 or      eax, ecx
.text:0058A6FD                 mov     ecx, ds:ShellExecuteW
.text:0058A703                 or      eax, ecx
.text:0058A705                 mov     ecx, ds:SHGetFileInfoW
.text:0058A70B                 or      eax, ecx
.text:0058A70D                 mov     ecx, ds:VariantInit
.text:0058A713                 or      eax, ecx
.text:0058A715                 mov     ecx, ds:VariantClear
.text:0058A71B                 or      eax, ecx
.text:0058A71D                 mov     ecx, ds:VariantCopy
.text:0058A723                 or      eax, ecx
.text:0058A725                 mov     ecx, ds:VariantCopyInd
.text:0058A72B                 or      eax, ecx
.text:0058A72D                 mov     ecx, ds:VariantChangeType
...

Lots of different functions.

...
.text:0058B8B8                 or      eax, ecx
.text:0058B8BA                 mov     ecx, ds:RegCloseKey
.text:0058B8C0                 or      eax, ecx
.text:0058B8C2                 mov     ecx, ds:RegOpenKeyExW
.text:0058B8C8                 or      eax, ecx
.text:0058B8CA                 mov     ecx, ds:RegQueryValueExW
.text:0058B8D0                 or      eax, ecx
.text:0058B8D2                 mov     ecx, dword_617AC4
.text:0058B8D8                 or      eax, offset loc_6129F8
...
Repeating simillar stuff
...
.text:0058B8F6                 or      eax, offset loc_6129D4
.text:0058B8FB                 or      eax, ecx
.text:0058B8FD                 mov     ecx, [esp+4+var_4]
.text:0058B901                 or      eax, offset loc_6129CE
.text:0058B906                 or      eax, offset loc_6129C8
...
Repeating simillar stuff
...
.text:0058B938                 or      eax, offset loc_61298C
.text:0058B93D                 or      eax, offset loc_612986
.text:0058B942                 or      eax, ecx
.text:0058B944                 pop     ecx
.text:0058B945                 retn
.text:0058B945 sub_58A6E0      endp
</code>```

I have tried to find what it is and why it was used, but I found literally nothing about it. It's not the first time I see similar function, so I really want to know what is it. It doesn't make any sense for me and simply abusing the imports. Thank you.

UPD: There is a hex values for some part of this function.

```<code>C1 8B 0D 20 65 61 00 0B  C1 8B 0D 1C 65 61 00 0B
C1 8B 0D 18 65 61 00 0B  C1 8B 0D 14 65 61 00 0B
C1 8B 0D 10 65 61 00 0B  C1 8B 0D 0C 65 61 00 0B
C1 8B 0D 08 65 61 00 0B  C1 8B 0D 04 65 61 00 0B
C1 8B 0D 00 65 61 00 0B  C1 8B 0D FC 64 61 00 0B
C1 8B 0D F8 64 61 00 0B  C1 8B 0D F4 64 61 00 0B
C1 8B 0D F0 64 61 00 0B  C1 8B 0D EC 64 61 00 0B
C1 8B 0D E8 64 61 00 0B  C1 8B 0D E4 64 61 00 0B
C1 8B 0D E0 64 61 00 0B  C1 8B 0D DC 64 61 00 0B
C1 8B 0D D8 64 61 00 0B  C1 8B 0D D4 64 61 00 0B
C1 8B 0D D0 64 61 00 0B  C1 8B 0D CC 64 61 00 0B
C1 8B 0D C8 64 61 00 0B  C1 8B 0D C4 64 61 00 0B
C1 8B 0D C0 64 61 00 0B  C1 8B 0D BC 64 61 00 0B
C1 8B 0D B8 64 61 00 0B  C1 8B 0D B4 64 61 00 0B
C1 8B 0D B0 64 61 00 0B  C1 8B 0D AC 64 61 00 0B
C1 8B 0D A8 64 61 00 0B  C1 8B 0D A4 64 61 00 0B
</code>```

Title: Strange function in Disassembly (IDA)


问:
tutorial of run-time hacking with Dnspy
Is anybody have good resource or tutorial of run-time hacking or memory hacking with .NET Applications with dnspy. </p>

Title: tutorial of run-time hacking with Dnspy


问:
Using Frida for early and late instrumentation
I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application.

This is what I want to do

Start Frida early in order to hook the early functions

Start Frida late in order to hook the late functions

So if I used Frida script to start the application, I can hook the early functions but Frida will show an error that it cannot find the late functions (unable to find export).

Currently, what I did was use one Frida script to start the application and then used another Frida script to attach to the already running process to hook the late function.

Starts Frida early

```<code>frida -U -f com.myapplication.file -l frida_script.js --no-pause
</code>```

Attach Frida to running process

```<code>frida -U -l frida_script2.js -p 4444
</code>```

Are there better ways to perform early and late hooking in one script such that some hooks are started early and some hooks can start once the .so file is loaded?


问:
How to proceed after running binwalk on this firmware?
I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP

So far I've used binwalk and gotten the following output:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
333646        0x5174E         Certificate in DER format (x509 v3), header length: 4, sequence length: 518
1927791       0x1D6A6F        Certificate in DER format (x509 v3), header length: 4, sequence length: 1424
1927795       0x1D6A73        Certificate in DER format (x509 v3), header length: 4, sequence length: 1436
5310901       0x5109B5        Unix path: /var/lib/jenkins/workspace
5310945       0x5109E1        Unix path: /rtos/h2/dji/gui/ew/app/#
5784963       0x584583        Unix path: /var/lib/jenkins/workspace
5785007       0x5845AF        Unix path: /rtos/h2/dji/gui/ew/app/#
7769572       0x768DE4        MySQL MISAM index file Version 5
7962227       0x797E73        MySQL MISAM index file Version 5
8388145       0x7FFE31        MySQL ISAM index file Version 8
9291993       0x8DC8D9        MySQL ISAM index file Version 8
11240978      0xAB8612        MySQL ISAM index file Version 1
11431188      0xAE6D14        Unix path: /var/lib/jenkins/workspace
11546615      0xB02FF7        Unix path: /var/lib/jenkins/workspace
11723142      0xB2E186        Unix path: /1/4/5/6]
11747234      0xB33FA2        SHA256 hash constants, little endian
12234577      0xBAAF51        Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#"8
18849863      0x11FA047       Unix path: /H/I/R/S/X+Y+
19246275      0x125ACC3       Unix path: /N/P/Q/U/V/X/Y/
19557133      0x12A6B0D       Unix path: /I/L/O/T\
20332025      0x1363DF9       Unix path: /A/D/E/H/I/~S
20368127      0x136CAFF       Unix path: /L/O/P/ZJ
20790576      0x13D3D30       Unix path: /Q/S/T/X/Y/
22060039      0x1509C07       Certificate in DER format (x509 v3), header length: 4, sequence length: 1042
22060800      0x1509F00       Certificate in DER format (x509 v3), header length: 4, sequence length: 1120
22061549      0x150A1ED       Certificate in DER format (x509 v3), header length: 4, sequence length: 1146
22062317      0x150A4ED       Certificate in DER format (x509 v3), header length: 4, sequence length: 1181
22062989      0x150A78D       Certificate in DER format (x509 v3), header length: 4, sequence length: 1194
22681349      0x15A1705       JPEG image data, JFIF standard 1.01
22825947      0x15C4BDB       MySQL ISAM index file Version 4
23840137      0x16BC589       SHA256 hash constants, little endian
26045398      0x18D6BD6       lzop compressed data,900,
26862957      0x199E56D       LZO compressed data
26939728      0x19B1150       ELF, 64-bit LSB no file type,
27467411      0x1A31E93       Unix path: /sysdeps/ieee754/dbl-64/mpexp.c8
27868566      0x1A93D96       Executable script, shebang: "/bin/sh"
27893779      0x1A9A013       ELF, 64-bit LSB processor-specific,
28661360      0x1B55670       Base64 standard index table
28883640      0x1B8BAB8       ELF, 64-bit LSB processor-specific,
29837774      0x1C749CE       lzop compressed data,800, LZO1X-1, os: MS-DOS
29877499      0x1C7E4FB       eCos RTOS string reference: "ecosW"
29889527      0x1C813F7       HTML document header
29916857      0x1C87EB9       xz compressed data
30065108      0x1CAC1D4       Copyright string: "copyright (C) 1996 okir@monad.swb.de)."
30807857      0x1D61731       Executable script, shebang: "/bin/sh"
31158507      0x1DB70EB       Unix path: /Min/Max/Avg/Cnt): olA/%u/3
31299086      0x1DD960E       Unix path: /home/dji/Documents/projects/camera_h2_linux_sdk/
31922164      0x1E717F4       ELF, 64-bit LSB processor-specific,
31924192      0x1E71FE0       Executable script, shebang: "/bin/sh"
31998874      0x1E8439A       Unix path: /usb/gadget/udc/a4
32010492      0x1E870FC       ELF, 64-bit LSB no file type,
32144366      0x1EA7BEE       ELF, 64-bit LSB no file type,
32266556      0x1EC593C       SHA256 hash constants, little endian
32932163      0x1F68143       Copyright string: "Copyright (C) 0"
33074794      0x1F8AE6A       Executable script, shebang: "/bin/sh"
33130836      0x1F98954       Executable script, shebang: "/bin/sh"
33515696      0x1FF68B0       Copyright string: "Copyright (C) 2009-2014 Free Software Foundation, Inc."
33516339      0x1FF6B33       Unix path: /install/share/gcc-4.9.2/f
33572727      0x2004777       ELF, 64-bit LSB processor-specific,
34161574      0x20943A6       Unix path: /H2_linux_merge/output.oem/AC101/host/usr/bin/ccachen
34181264      0x2099090       SHA256 hash constants, little endian
34321478      0x20BB446       Executable script, shebang: "/bin/sh"
35104099      0x217A563       ELF, 64-bit LSB processor-specific,
35457510      0x21D09E6       ELF, 64-bit LSB no file type,
35713684      0x220F294       ELF, 64-bit LSB no file type,
36000342      0x2255256       HTML document footer
36254694      0x22933E6       Executable script, shebang: "/bin/sh"
36356499      0x22AC193       Executable script, shebang: "/bin/sh"
36356656      0x22AC230       ELF, 64-bit LSB processor-specific,
37963842      0x2434842       Executable script, shebang: "/bin/sh"
38068731      0x244E1FB       ELF, 64-bit LSB processor-specific,
38141809      0x245FF71       Executable script, shebang: "/bin/sh"
38141949      0x245FFFD       ELF, 64-bit LSB processor-specific,
38227525      0x2474E45       ELF, 64-bit LSB processor-specific,
</code>```

This is a bit tricky, as I didn't initially know how to proceed. However, I first tried extracting the "xz compressed data" section using dd. I then tried to use unxz to extract the data, but it says that the xz is corrupt.

Next, I opened this xz inside of Bless hex editor and saw that it has the magic values: .7zXZ.YZ. I then researched and found out that .7zXZ is the start of the xz payload and YZ marks the end of it. So, if I'm not mistaken, this is a xz payload with only 1 byte in it, which seems to be a false alarm or maybe even a form of anti-reversing in this case. Moving on...

My next thought was to extract data using dd starting at the eCos RTOS reference. I opened the data in Bless to verify the magic value. Finally, I've opened it in IDA Pro but it does not parse the data correctly. I've tried MetaPC, ARM Little Endian (for which it asks bitness and I chose 32 bit and 64 bit). The only other options I can think of here are to try the LZ compressed areas but those are also commonly false positives. Lastly, I tried to extract and open the ELFs using 010 Editor and IDA Pro. In IDA, I get "The ELF header entry size is invalid (6096, expected 64). At this point, I could use some guidance from a more experienced firmware reverser.

Do I seem to be on the right track? What other steps would you take to locate the firmware goodies? Initially, these artifacts are all new to me.


问:
Reproducing video format
I received a promotional video screen with a USB interface. It comes with a couple example videos, one of which is here: https://drive.google.com/file/d/1B-wSURAgK-ePrfpKFM5nYbNhQ5mD-Ii2/view?usp=sharing md5sum 506a6c478b0874262802e8ae7d718c59

I'd love to figure out how to generate this file format, but I don't have much experience in reverse engineering. It seems to be a mostly normal AVI file, and can play in VLC just fine.

What I've got so far

I've been poking around with ffprobe, in a hex editor, and RiffPad, and found the following things:

it is a RIFF AVI with 2 streams - video and audio

the video frames are mjpeg - specifically mjpeg/AVI1, header FF D8 FF E0 00 10 41 56 49 31

the video frames are padded to the dword boundary instead of the word boundary which seems to be the standard. Riffpad and other such tools complain about this

ffmpeg -i original.avi -codec copy test.avi doesn't produce a working file - ffmpeg appends junk lists to some of the header information. deleting the lists and aligning frames to the dword boundary make the file play despite some differences in the header data.

I'm having a hard time finding a tool to generate similarly formatted frames. FFMPEG wants to generate JFIF data instead of AVI1, which doesn't work. Judging by this source, the original frames contain their own huffman encodings, and the container file lists the chunks as dc chunks, so compressed images. jpegtoavi generates db segments, which I can't copy over.

Any help with what to do next would be very appreciated.

Title: Reproducing video format


问:
How to capture specific data packets sent in an online game?
I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. Basically, I want to analyze byte flow after a specific event. Which tools can I utilize to achieve this?

I tried Wireshark, but as there are lots of packets are being sent in an arbitrary instance, I couldn't observe which one was sent on my specific event.

p.s. As an additional info, the game has illegal bot softwares. I want to understand how they developed the bot.


问:
IDA Pro Symbian Debugger 'general OS related' Error
I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error:

```<code>general OS-related error
</code>```

What went wrong? How do I solve the issue?

ContentLicense: CC BY-SA 3.0


问:
Tools for statistical analysis of binary streams
I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of that size, e.g. 80 02 42 0a (type: 0x80, size: 2 bytes, data: 66, 10).

To help me drill deeper I'm looking for a tool that allows me to extract the individual chunks of data, run queries against those, and arbitrarily transform the results. I'm looking for simple queries (like "all packets with a specific tag"), but also need more complex filters (e.g. "distribution of all size values for packets with a specific tag").

Are there any tools that allow me to easily perform those queries, given the following requirement?

Needs to understand the overall stream structure.

Needs to have basic decoding capabilities (e.g. to extract base128-encoded varints as used by Protocol Buffers).

Needs customizable filters (e.g. by tag, size, or data).

[Optional] Ability to control display of data, like 64-bit FILETIME values.

[Optional] Ability to render graphs.

Needs to run on Windows (preferably free).

1 The data is streamed off of an embedded device. I have access to fully self-contained chunks of that data as binary files.


问:
How to change the manufacturer property in the Android emulator?
I already asked this question on StackOverflow, but it is not getting attention; maybe here is a better place

I am running the Android emulator that comes with the Android Studio software. I created an AVD based on Pixel 2. Opening the ADB shell I get:

```<code>$ getprop ro.product.manufacturer
unknown
</code>```

I would like to change the string returned as property ro.product.manufacturer, because I have an app the refuses to run on an "unknown" device. How can I do that?

The file config.ini for the AVD has a line

```<code>hw.device.manufacturer=Google
</code>```

but this does not seem to be the same thing.


问:
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support only 1 byte length hardware breakpoints"

am using it on rooted mobile Samsung galaxy S6 , Armv8
server connection is fine i can live edit values and functions also set a break point on functions ( 1 byte op code ) it works fine  .

so i guess that either am doing something wrong or debugger is limited .
please note that am new to arm debugging o just want to find the op code that writes to this address for an android game .

thank you much appreciated .


问:
Some obstacles in reversing a JNI Native library
I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer

Though I still cannot understand how JavaObject is passed on? Looking through radare2,

```<code>410: sym.Java_com_asobimo_common_jni_NativeResource_getZipedFile (int16_t arg1, int16_t arg3, int16_t arg4);
           ; var int16_t var_0h @ sp+0x0
           ; var int16_t var_ch @ sp+0xc
           ; var int16_t var_14h @ sp+0x14
           ; var int16_t var_18h @ sp+0x18
           ; var int16_t var_1ch @ sp+0x1c
           ; var int16_t var_34h @ sp+0x34
           ; var int16_t var_40h @ sp+0x40
           ; arg int16_t arg1 @ r0
           ; arg int16_t arg3 @ r2
           ; arg int16_t arg4 @ r3
           ; DATA XREF from aav.0x0000c664 @ +0x64
           0x0000c974  ~   f0b5           push {r4, r5, r6, r7, lr}
</code>```

this is how the static function is called. I feel like the function makes references to passed class objects, since it subtracts 0x44 from sp letter on and then do some stuffs. But, how does this referencing works actually? I am pretty clueless. This is how the Java class looks like which corresponds to it:-

```<code>package com.asobimo.common.jni;

public final class NativeResource {
  static {
    System.loadLibrary("NativeResource");
  }

  public static native void deleteFile(String paramString);

  public static native byte[] getFile(String paramString);

  public static native byte[] getZipedFile(String paramString1, String paramString2);

  public static native boolean isZipedNormality(String paramString);

  public static native void saveFile(String paramString, byte[] paramArrayOfbyte, int paramInt);
}
</code>```

Also, this is not really a necessary thing to answer (and it kinda shifts away from focus of it, I am sorry) but how radare identifies the arguments' size? As it's clear by var int16_t var_40_h @ sp+0x40 being a reference (even though sp is subtracted by 0x40) and the fact that string function were being called using r0 pointer, over r2 and r3, (which makes it more obvious that they probably are int32_t)

And why radare didn't assign r1 to anything? And skipped arg2? It probably also has to do with JavaObject, but I can't really find anything by researching myself. I would really appreciate any help, I badly want that boss battle music hidden behind some encrypted zip files

In case it would help in making some sense, here is the .so file https://files.catbox.moe/foss7s.so


问:
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.

Basically whenever I stumble across a glibc call (memset, memcpy, etc.) IDA, instead of showing the correct name of the function, it shows a reference to MEMORY as a function call.

Example:

```<code>MEMORY[0xACFC3F9F](s, 0, 44);    // <----- memset
MEMORY[0xACFC3FBD](dest, 0, 40); // <---- memset
</code>```

The interesting part is that when debugging the reference changes to an actual function call (still unknown, but whatever).
While debugging the MEMORY part changes to:

```<code>((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(s, 0, 44);
((void (__cdecl *)(char *, _DWORD, signed int))unk_F769B4F0)(dest, 0, 40);
</code>```

In Ghidra the same code looks like this:

```<code>memset(s,0,0x2c);    // <--- correct function name
memset(dest,0,0x28); // <--- correct function name
</code>```

IDA should automatically detect std library functions, what could be the reason why it isn't happening here?

Update: I re-analyzed the executable from scratch (creating a new IDA database) and the references to the functions are here.

Unfortunately, after attaching to the debugger all the function calls became "MEMORY" again.

Here's the asm:

```<code>.text:566146D7                 mov     [esp], eax      ; s
.text:566146DA                 call    near ptr memset+566146DBh ; <--- memset call
.text:566146DF                 mov     dword ptr [esp+8], 28h ; '(' ; n
.text:566146E7                 mov     dword ptr [esp+4], 0 ; c
.text:566146EF                 lea     eax, [ebp+dest]
.text:566146F5                 mov     [esp], eax      ; s
.text:566146F8                 call    near ptr memset+566146F9h ; <--- memset call
.text:566146FD                 movsx   eax, [ebp+var_14C]
</code>```

The memset calls are here but with a memory offset pointing to the next address of the executable.


问:
Analyzing firmware image (eCos with YAFFS)
I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera.

I've downloaded the firmware from their website  (Smart dash camera: CA21L) and as a first step I tried to binwalk the firmware. The only "interesting" thing I found is a line which indicates that binwalk thinks there's a YAFFS filesystem embedded inside the file:

```<code>983141        0xF0065         eCos RTOS string reference: "eCos"
1503088       0x16EF70        YAFFS filesystem
1637704       0x18FD48        JPEG image data, JFIF standard 1.02
</code>```

Based on the offsets my guess is that there's a filesystem there. But I couldn't figure out how to mount/extract that because the output I got here is not really the same as for the most "firmware reversing tutorials" I've seen where you get "squashFS" and a compressed bootloader which binwalk clearly recognized.
Here it seems that besides the small hint of the YAFFS, and a lot of strings indicating an eCos OS is running, I don't really know what to make of the rest of the output.

I'm turning here because maybe an experienced individual can shed some light on what I'm seeing from the output, how exactly I could extract the file system (if at all) and what does it mean that the system is running eCos (Yes I have googled it but the structure of it is still unclear).

The first few bytes of the firmware binary:

```<code>sh@desktop:~/Desktop/camera/smart$ file firmware.bin
firmware.bin: data
sh@desktop:~/Desktop/camera/smart$ hd -v ./firmware.bin | head
00000000  00 04 00 80 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  4e 54 39 36 36 36 30 20  31 30 30 30 30 30 30 30  |NT96660 10000000|
00000060  32 30 31 30 30 37 30 31  20 7f 76 00 55 aa 67 f9  |20100701 .v.U.g.|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  4c 44 3a 47 53 36 36 30  20 20 20 20 20 20 20 20  |LD:GS660        |
00000090  01 00 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  |................|
</code>```

The full binwalk output:

```sh@desktop:~/Desktop/camera/smart$ binwalk ./firmware.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
148610        0x24482         Copyright string: "Copyright (c) 2014 Novatek Microelectronic Corp."
878029        0xD65CD         eCos RTOS string reference: "eCos_Init must call first."
878119        0xD6627         eCos RTOS string reference: "eCos."
879094        0xD69F6         eCos RTOS string reference: "eCos_ChkValid"
879110        0xD6A06         eCos RTOS string reference: "eCos_Close"
879126        0xD6A16         eCos RTOS string reference: "eCos_Open"
879327        0xD6ADF         eCos RTOS string reference: "ECOS\FW96660T.bin"
879431        0xD6B47         eCos RTOS string reference: "ecos bin"
879548        0xD6BBC         eCos RTOS string reference: "eCos Utility"
879580        0xD6BDC         eCos RTOS string reference: "ECOS\FW96660T.bin to start"
879623        0xD6C07         eCos RTOS string reference: "eCos"
879676        0xD6C3C         eCos RTOS string reference: "eCos"
880531        0xD6F93         eCos RTOS string reference: "eCosCmd_Open"
884656        0xD7FB0         CRC32 polynomial table, little endian
947150        0xE73CE         eCos RTOS string reference: "eCos uncompress. Req: 0x%08X Bytes."
962042        0xEADFA         eCos RTOS string reference: "eCosReadEx"
962066        0xEAE12         eCos RTOS string reference: "eCosRead"
962863        0xEB12F         eCos RTOS string reference: "eCos partition."
963011        0xEB1C3         eCos RTOS string reference: "ECOS.BIN"
963168        0xEB260         eCos RTOS string reference: "ecos"
963181        0xEB26D         eCos RTOS string reference: "eCos from EMB"
964861        0xEB8FD         eCos RTOS string reference: "eCos"
969277        0xECA3D         eCos RTOS string reference: "eCos FW bin..."
969370        0xECA9A         eCos RTOS string reference: "eCos FW read failed %d"
969978        0xECCFA         eCos RTOS string reference: "eCos form A:\"
970039        0xECD37         eCos RTOS string reference: "eCos."
970511        0xECF0F         eCos RTOS string reference: "eCos."
970576        0xECF50         eCos RTOS string reference: "eCos."
970610        0xECF72         eCos RTOS string reference: "eCos form Embedded Storage."
970693        0xECFC5         eCos RTOS string reference: "eCos."
970730        0xECFEA         eCos RTOS string reference: "eCos boot from temp all-in-one bin."
983121        0xF0051         eCos RTOS string reference: "eCosRun"
983141        0xF0065         eCos RTOS string reference: "eCos"
1503088       0x16EF70        YAFFS filesystem
1637704       0x18FD48        JPEG image data, JFIF standard 1.02
1637734       0x18FD66        TIFF image data, little-endian offset of first image directory: 8
1638058       0x18FEAA        JPEG image data, EXIF standard
1638070       0x18FEB6        TIFF image data, little-endian offset of first image directory: 8
1648972       0x19294C        JPEG image data, JFIF standard 1.02
1649002       0x19296A        TIFF image data, little-endian offset of first image directory: 8
1704134       0x1A00C6        eCos RTOS string reference: "eCos#1.00.005_Dec  2 2015, 14:52:25_,REV"
3964736       0x3C7F40        XML document, version: "1.0"
3992008       0x3CE9C8        XML document, version: "1.0"
3992444       0x3CEB7C        XML document, version: "1.0"
3998494       0x3D031E        Unix path: /jenkins/jobs/C10/workspace/NT9666x_SDK/Project/DemoKit/SrcCode/UIApp/Network/WifiJsonFlow.c
4084725       0x3E53F5        MySQL MISAM index file Version 2
4085637       0x3E5785        MySQL MISAM index file Version 2
7122340       0x6CADA4        MySQL MISAM compressed data file Version 4
7162838       0x6D4BD6        Unix path: /15/20/24/25/30/48/50/60/120/240fps can be served..
7341779       0x7006D3        Unix path: /DCE_LUT/DCE_FOV/DCE_ENH/DCE_CA are updated
7555647       0x734A3F        Ubiquiti firmware header, third party, ~CRC32: 0x0, version: "ING_LOGO"
7642794       0x749EAA        VxWorks symbol table, big endian, first entry: [type: function, code address: 0x1000, symbol address: 0x500]
7766216       0x7680C8        eCos kernel exception handler, architecture: MIPSEL, exception vector table base address: 0x8F7D902C
7767176       0x768488        eCos RTOS string reference: "ECOSDEMO_001_001"
7768111       0x76882F        eCos RTOS string reference: "ECOS#1.00.003_Nov 16 2015, 09:12:53_,REV"
9434103       0x8FF3F7        eCos RTOS string reference: "eCos world!!!!!!!!!!"
9434178       0x8FF442        eCos RTOS string reference: "eCos scheduling..."
9439624       0x900988        eCos RTOS string reference: "ecos-8189es-ap"
9440531       0x900D13        eCos RTOS string reference: "ecos"
9441864       0x901248        eCos RTOS string reference: "ECOS"
9444932       0x901E44        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl
9444952       0x901E58        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl"
9444965       0x901E65        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl"
9445112       0x901EF8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx"
9445125       0x901F05        eCos RTOS string reference: "ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx"
9446048       0x9022A0        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx
9446068       0x9022B4        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx"
9446081       0x9022C1        eCos RTOS string reference: "ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx"
9446244       0x902364        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c"
9446257       0x902371        eCos RTOS string reference: "ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c"
9447564       0x90288C        eCos RTOS string reference: "eCos does not support daemon option"
9450526       0x90341E        eCos RTOS string reference: "ecos threads"
9457811       0x905093        eCos RTOS string reference: "ECOS_Open failed"
9458055       0x905187        eCos RTOS string reference: "ECOS_CmdLine"
9458075       0x90519B        eCos RTOS string reference: "ECOS_Open"
9471668       0x9086B4        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx
9471688       0x9086C8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx"
9471701       0x9086D5        eCos RTOS string reference: "ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx"
9472136       0x908888        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/smp.hxx
9472156       0x90889C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/smp.hxx"
9472169       0x9088A9        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/smp.hxx"
9472348       0x90895C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/thread.inl"
9472361       0x908969        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/thread.inl"
9472520       0x908A08        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx"
9472533       0x908A15        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx"
9473212       0x908CBC        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx"
9473225       0x908CC9        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx"
9474168       0x909078        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx
9474188       0x90908C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx"
9474201       0x909099        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx"
9474568       0x909208        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx"
9474581       0x909215        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx"
9475288       0x9094D8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx"
9475301       0x9094E5        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx"
9476040       0x9097C8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx"
9476053       0x9097D5        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx"
9476844       0x909AEC        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx"
9476857       0x909AF9        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx"
9477032       0x909BA8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx"
9477045       0x909BB5        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx"
9477420       0x909D2C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl"
9477433       0x909D39        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl"
9478044       0x909F9C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx"
9478057       0x909FA9        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx"
9478852       0x90A2C4        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx
9478872       0x90A2D8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx"
9478885       0x90A2E5        eCos RTOS string reference: "ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx"
9480844       0x90AA8C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl"
9480857       0x90AA99        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl"
9481020       0x90AB3C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl"
9481033       0x90AB49        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl"
9481608       0x90AD88        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl"
9481621       0x90AD95        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl"
9481796       0x90AE44        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx"
9481809       0x90AE51        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx"
9485076       0x90BB14        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx
9485096       0x90BB28        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx"
9485109       0x90BB35        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx"
9485396       0x90BC54        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx"
9485409       0x90BC61        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx"
9485592       0x90BD18        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx"
9485605       0x90BD25        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx"
9486484       0x90C094        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx"
9486497       0x90C0A1        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx"
9486612       0x90C114        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl"
9486625       0x90C121        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl"
9490172       0x90CEFC        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/hal/mips/arch/v2_0_60/src/hal_misc.c"
9490185       0x90CF09        eCos RTOS string reference: "ecos-2.0.6/packages/hal/mips/arch/v2_0_60/src/hal_misc.c"
9490300       0x90CF7C        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx
9490320       0x90CF90        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx"
9490333       0x90CF9D        eCos RTOS string reference: "ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx"
9490868       0x90D1B4        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx"
9490881       0x90D1C1        eCos RTOS string reference: "ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx"
9491104       0x90D2A0        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx"
9491117       0x90D2AD        eCos RTOS string reference: "ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx"
9491432       0x90D3E8        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx
9491452       0x90D3FC        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx"
9491465       0x90D409        eCos RTOS string reference: "ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx"
9491852       0x90D58C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx"
9491865       0x90D599        eCos RTOS string reference: "ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx"
9492048       0x90D650        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c
9492068       0x90D664        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c"
9492081       0x90D671        eCos RTOS string reference: "ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c"
9495328       0x90E320        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c
9495348       0x90E334        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c"
9495361       0x90E341        eCos RTOS string reference: "ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c"
9495407       0x90E36F        eCos RTOS string reference: "ecos/support.c"
9496188       0x90E67C        eCos RTOS string reference: "eCos_node"
9496344       0x90E718        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c
9496364       0x90E72C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c"
9496377       0x90E739        eCos RTOS string reference: "ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c"
9496423       0x90E767        eCos RTOS string reference: "ecos/synch.c"
9496712       0x90E888        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c"
9496725       0x90E895        eCos RTOS string reference: "ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c"
9496771       0x90E8C3        eCos RTOS string reference: "ecos/timeout.c"
9502064       0x90FD70        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx
9502084       0x90FD84        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx"
9502097       0x90FD91        eCos RTOS string reference: "ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx"
9502996       0x910114        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c
9503016       0x910128        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c"
9503029       0x910135        eCos RTOS string reference: "ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c"
9503332       0x910264        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx
9503352       0x910278        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx"
9503365       0x910285        eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx"
9503952       0x9104D0        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl"
9503965       0x9104DD        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl"
9504976       0x9108D0        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx"
9504989       0x9108DD        eCos RTOS string reference: "ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx"
9505136       0x910970        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx"
9505149       0x91097D        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx"
9505300       0x910A14        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx"
9505313       0x910A21        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx"
9505472       0x910AC0        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx"
9505485       0x910ACD        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx"
9506128       0x910D50        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c
9506148       0x910D64        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c"
9506161       0x910D71        eCos RTOS string reference: "ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c"
9509540       0x911AA4        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl
9509560       0x911AB8        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl"
9509573       0x911AC5        eCos RTOS string reference: "ecos-2.0.6/configs/nt96660.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl"
9510764       0x911F6C        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx"
9510777       0x911F79        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx"
9511328       0x9121A0        eCos RTOS string reference: "ecos p "
9512114       0x9124B2        eCos RTOS string reference: "ecos=0x%x"
9515207       0x9130C7        eCos RTOS string reference: "ECOS_CmdLine"
9515227       0x9130DB        eCos RTOS string reference: "ECOS_Open"
9515247       0x9130EF        eCos RTOS string reference: "ECOS_Mount"
9515267       0x913103        eCos RTOS string reference: "ECOS_Umount"
9516040       0x913408        HTML document header
9517351       0x913927        HTML document footer
9519824       0x9142D0        HTML document header
9519933       0x91433D        HTML document footer
9519944       0x914348        HTML document header
9520064       0x9143C0        HTML document footer
9520480       0x914560        eCos RTOS string reference: "eCos/1.0"
9523675       0x9151DB        eCos RTOS string reference: "ECOS_CmdLine"
9523695       0x9151EF        eCos RTOS string reference: "ECOS_Open"
9525414       0x9158A6        eCos RTOS string reference: "ECOS_CmdLine"
9525438       0x9158BE        eCos RTOS string reference: "ECOS_Open"
9547888       0x91B070        Base64 standard index table
9549256       0x91B5C8        Unix path: /cygdrive/d/Firmware/__svn/ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl
9549283       0x91B5E3        eCos RTOS string reference: "ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl"
9549303       0x91B5F7        eCos RTOS string reference: "eCos/include/cyg/libc/time/time.inl"
9562672       0x91EA30        XML document, version: "1.0"
9565402       0x91F4DA        XML document, version: "1.0"
9565636       0x91F5C4        HTML document header
9565701       0x91F605        HTML document footer
9565872       0x91F6B0        Base64 standard index table
9566150       0x91F7C6        HTML document header
9566275       0x91F843        HTML document footer
9566556       0x91F95C        HTML document header
9566696       0x91F9E8        HTML document footer
9566708       0x91F9F4        HTML document header
9566738       0x91FA12        HTML document footer
9567232       0x91FC00        XML document, version: "1.0"
9568484       0x9200E4        SHA256 hash constants, little endian
9579171       0x922AA3        eCos RTOS string reference: "ECOS_CmdLine"
9579191       0x922AB7        eCos RTOS string reference: "ECOS_Open"
9580100       0x922E44        Unix path: /home/pluswang/nova/project-ecos/project-ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h
9580128       0x922E60        eCos RTOS string reference: "ecos/project-ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h"
9580141       0x922E6D        eCos RTOS string reference: "ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h"
9580146       0x922E72        eCos RTOS string reference: "ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h"
9626164       0x92E234        Unix path: /cygdrive/d/Project/eCos/ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl
9626184       0x92E248        eCos RTOS string reference: "eCos/ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl"
9626189       0x92E24D        eCos RTOS string reference: "ecos-kit/ThirdParty/eCos/include/cyg/libc/time/time.inl"
9626209       0x92E261        eCos RTOS string reference: "eCos/include/cyg/libc/time/time.inl"
9626400       0x92E320        PEM RSA private key
9626596       0x92E3E4        PEM certificate
9626700       0x92E44C        Private key in DER format (PKCS header length: 4, sequence length: 605
9628092       0x92E9BC        Unix path: /cygdrive/c/project-ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx
9628112       0x92E9D0        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx"
9628125       0x92E9DD        eCos RTOS string reference: "ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx"
9628292       0x92EA84        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx"
9628305       0x92EA91        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx"
9628432       0x92EB10        eCos RTOS string reference: "ecos/NT96660/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx"
9628445       0x92EB1D        eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx"
9644452       0x9329A4        HTML document header
9644572       0x932A1C        HTML document footer
9645052       0x932BFC        XML document, version: "1.0"
```

I also have a pretty good reason to believe the binary is not encrypted:

Any guidance or direction to resources would be extremely helpful, thanks in advance.


问:
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.

I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I know this is a call to a inline structure function.

So the first step, I convert those 16 lines of code to a structure (i.e Matrix) which makes it a little bit more clear to understand what's happening

Then I'm stuck where I want to make it show as 1 line, which will call to the underline inline structure function Identity().

So those 16 lines of code:

Would show as s_mtx.Identity() or maybe Identity(s_mtx)

Is that even possible doing it within HexRays decompiler? Maybe some script I can write to do that?

This gets really tedious when you have a function with many matrix multiplications, vectors etc...

Maybe @IgorSkochinsky?

Thanks a lot in advance!


问:
Performing Buffer overflow in Linux
I have buffer overflow in a program i check(it is an array of pointers, and i can overflow the data in the first pointer), but the data i can write is not on the stack, it is on a space the system allocated(it does not have name in /proc{id}/maps). and it is not the heap.
Is there any option to perform code execution via this scenario ?
As well as, is there option to overflow different segments ?

Thanks,

Title: Performing Buffer overflow in Linux


问:
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "4-level-deep" stack etc).

It seems IDA does not track SP-related statements, even simple sequence of "mov SP, F123h" (inside the "caller" subroutine) followed by "jmp sp" (inside the "callee" subroutine) is not recognized. Therefore IDA can't show me a proper proximity view and I have to track the SP value and the whole control flow by hand.

Is there a way to automate this process?

I've read that I can add XREFs manually using ALT+F11. When I press ALT+F11 the callee dialog appears, but after I enter the address and click OK nothing happens. At least nothing visible.

Why? Is it supposed to work only for "call" instructions, but not for "jmp"s? If not, where does the cursor have to be placed before pressing ALT+F11?

P.S. I'm using IDA Pro 6.8.

Title: IDA Pro SP tracking


问:
Theos Tweak compilation errors
While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error

```<code>bash: line 1:  4665 Done                    swift --version
      4667 Broken pipe: 13         | head -1
      4669 Killed: 9               | cut -d'v' -f2
      4670 Killed: 9               | cut -d' ' -f2
      4672 Killed: 9               | cut -d'-' -f1

....

bash: -c: line 3: syntax error: unexpected end of file
make: *** [/var/root/theos/makefiles/package.mk:80: internal-install-check] Error 1
</code>```

I did some searching online but could not find a solution. If anyone knows about this, appreciate if you can provide some suggestions.

Title: Theos Tweak compilation errors


问:
Disassembly - First steps
I decided that I need to understand this more thoroughly, so am working in parallel with two resources: one more modern and one original from @Aleph1.

In the essay, there is a basic code snippet, called example1.c, thus:

```<code>void function(int a, int b, int c) {
    char buffer1[5];
    char buffer2[10];
}
void main() {
    function(1,2,3);
}
</code>```

In the illustrated disassembly of that, once complied obvs, thus:

```<code>pushl %ebp
movl %esp,%ebp
subl $20,%esp
</code>```

where $20 is the size due to word size, as the 5 char buffer takes 8 bytes (2 words) and the 10 char buffer takes 12 bytes (3 words). So far so simple. This makes perfect sense to me.

While playing along on Ubuntu 12.04 - 32bit version [chosen due to the other parallel disassembly blog post] - the same disassembly comes out as:

```<code>push   %ebp
mov    %esp,%ebp
sub    $0xc,%esp
</code>```

where $0xc is 12 in decimal. What is the reason for this discrepancy, assuming that I've copied the code properly. It's not really holding up my progress, but I feel that I should be able to understand why my code is subtracting by 12 bytes, and the example by 20. My best guess is that it's down to the architecture of the OS that I'm using in some way, but would like someone with more experience to validate this or tell me why.

Update

I was comparing apples with oranges, which I've just realised. The code from Aleph1's essay where it talks about the subl $20 came from the -S (assembly) output from gcc, and is discussing the prolog whereas the code I took the sub 0xc came from within gdb and running disassemble main.

I have run gcc -S to produce example1.s - but that produces a different result again, although I suspect it's down to Johan's comment about gcc options, which happen to be gcc -g -fno-stack-protector -z execstack -S -o example1.s example1.c. Looking in the prolog, the result that I get here is subl %16 (which in dec is 22).

It has simply raised more questions! :D

Update 2

Dump of assembler code within gdb is:

```<code> 0x080483bc <+0>:   push   %ebp
 0x080483bd <+1>:   mov    %esp,%ebp
 0x080483bf <+3>:   sub    $0xc,%esp
</code>```

Is that why we see $0xc (12 in decimal) because it's showing as <+3> (i.e. +3 words, 12 bytes)?

Title: Disassembly - First steps


问:
Sniffing vacuum cleaner
First of all I'm a noob. I have a basic cheap chinese vacuum cleaner robot. I want to be able to use it from anything but the official app, but I am not intelligent enough to make a custorm firmware or anything like that to avoid the servers. So I thought "it will be easy, just sniff the traffic from the APP and then replicate it from a python script or whatever". I did that with mitmproxy. I am able to see the login process(url and parameters), and some other actions of the APP. However when I click on "start cleaning", the robot starts moving but the APP doesn't seem to send anything according to mitmproxy.

Any advice about what to look for or how does it work?

Thank you in advice.

Title: Sniffing vacuum cleaner


问:
Can you add data to a binary, without affecting its jump labels?
I'm a total beginner, so I don't know the vocabulary yet to search effectively. What I want to do is add some data (let's say level data), to an old game ROM, but that would probably shift all the jump labels by the amount of bytes I added.

I thought about disassembling the ROM, finding its starting point and parsing my way through the jump instructions to find all (absolute) labels and tweak them after I know where and how much data I added.

Is that feasible/practical and are there tools for such an operation already?


问:
How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?
So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file.

how can i do this in IDA debugger? tried googling but couldn't find any good answer.


问:
reversing xiaomi update firmware encrypted?
I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera

Running binwalk on the file I see this output

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1246033       0x130351        Certificate in DER format (x509 v3), header length: 4, sequence length: 518
3624121       0x374CB9        Certificate in DER format (x509 v3), header length: 4, sequence length: 3
4165132       0x3F8E0C        Unix path: /usr/local/share/script/bcm_disconn_device.sh
4180704       0x3FCAE0        Unix path: /usr/local/share/script/bt_start.sh
4218888       0x406008        Unix path: /usr/local/share/script/wifi_start.sh
4233160       0x4097C8        Unix path: /usr/local/share/script/bcm_start.sh HID&
4240412       0x40B41C        Unix path: /usr/bin/AmbaRTSPServer --en_audio --en_rtcp
4435576       0x43AE78        Unix path: /usr/local/share/script/wifi_set_setting.sh
4450536       0x43E8E8        Unix path: /usr/bin/fimi_moniter
4452856       0x43F1F8        Unix path: /usr/local/share/script/wifi_start.sh fast
4529204       0x451C34        CRC32 polynomial table, little endian
4531740       0x45261C        CRC32 polynomial table, little endian
4532888       0x452A98        Copyright string: "Copyright 2004-2014 Ambarella Corp."
4992168       0x4C2CA8        Unix path: /usr/local/share/script/sd_script.sh mount /tmp/SD0 c: ambafs
4993520       0x4C31F0        Unix path: /usr/local/share/script/sync_rtc.sh
5004056       0x4C5B18        Digi International firmware, load address: 0x504D5549, entry point: 0x4C324343,
5120308       0x4E2134        Unix path: /usr/bin/remoteapi_syssvc_daemon
6196757       0x5E8E15        MySQL MISAM compressed data file Version 3
6296161       0x601261        MySQL MISAM compressed data file Version 2
6296173       0x60126D        MySQL MISAM compressed data file Version 4
7593257       0x73DD29        MySQL MISAM compressed data file Version 1
8307929       0x7EC4D9        MySQL MISAM compressed data file Version 9
9611653       0x92A985        Neighborly text, "neighbor=%dration_threshold_0=%d _1=%d _2=%d _3=%d"
21415612      0x146C6BC       JPEG image data, JFIF standard 1.01
24183116      0x171014C       device tree image (dtb)
28385400      0x1B12078       Linux kernel version 3.10.7
28406940      0x1B1749C       gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
28491684      0x1B2BFA4       LZO compressed data
28571234      0x1B3F662       Unix path: /var/run/rpcbind.sock
29085488      0x1BBCF30       Unix path: /dev/vc/0
29164016      0x1BD01F0       xz compressed data
29194736      0x1BD79F0       Unix path: /lib/firmware/updates/3.10.71
29315074      0x1BF5002       Neighborly text, "neighbor %.2x%.2x.%pM losti/c1_work/svn_fimi/trunk/ambalink_sdk_3_10/linux/net/bridge/br_stp_timer.c"
29727764      0x1C59C14       ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
29727880      0x1C59C88       ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
29728004      0x1C59D04       ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
29728120      0x1C59D78       ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
29740988      0x1C5CFBC       CRC32 polynomial table, little endian
29985772      0x1C98BEC       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000

</code>```

binwalk -e doesn't work very well and i just get a makefile and some empty folders.

I think the firmware might be encrypted; because of the two certificates in DER format at the top of the file but I am unsure about this.

checking the entropy with binwalk and again; it doesn't seem to be encrypted

```<code>DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Falling entropy edge (0.736286)
4177920       0x3FC000        Falling entropy edge (0.633902)
21635072      0x14A2000       Falling entropy edge (0.818787)
23842816      0x16BD000       Falling entropy edge (0.823909)
29011968      0x1BAB000       Falling entropy edge (0.652727)
32653312      0x1F24000       Falling entropy edge (0.668729)
33280000      0x1FBD000       Falling entropy edge (0.746394)
33390592      0x1FD8000       Falling entropy edge (0.630683)
35340288      0x21B4000       Falling entropy edge (0.815448)
35487744      0x21D8000       Falling entropy edge (0.814134)
35598336      0x21F3000       Falling entropy edge (0.818659)
35725312      0x2212000       Falling entropy edge (0.811020)
35872768      0x2236000       Falling entropy edge (0.807910)
35946496      0x2248000       Falling entropy edge (0.774434)
37621760      0x23E1000       Falling entropy edge (0.679220)
42127360      0x282D000       Falling entropy edge (0.661422)
42422272      0x2875000       Falling entropy edge (0.803659)
42569728      0x2899000       Falling entropy edge (0.849527)
42680320      0x28B4000       Falling entropy edge (0.807766)
42827776      0x28D8000       Falling entropy edge (0.813596)
42938368      0x28F3000       Falling entropy edge (0.786144)
43139072      0x2924000       Falling entropy edge (0.723178)
44371968      0x2A51000       Falling entropy edge (0.800123)
44519424      0x2A75000       Falling entropy edge (0.810571)
44740608      0x2AAB000       Falling entropy edge (0.670949)
45936640      0x2BCF000       Falling entropy edge (0.669111)
49762304      0x2F75000       Falling entropy edge (0.765717)
57507840      0x36D8000       Falling entropy edge (0.748053)
57581568      0x36EA000       Falling entropy edge (0.833038)
57856000      0x372D000       Falling entropy edge (0.846944)
58224640      0x3787000       Falling entropy edge (0.839880)
58593280      0x37E1000       Rising entropy edge (0.950003)
58630144      0x37EA000       Falling entropy edge (0.845293)
59015168      0x3848000       Falling entropy edge (0.647316)
59199488      0x3875000       Falling entropy edge (0.830295)
59310080      0x3890000       Falling entropy edge (0.713949)
59568128      0x38CF000       Falling entropy edge (0.673632)
62160896      0x3B48000       Falling entropy edge (0.807818)
62951424      0x3C09000       Rising entropy edge (0.961620)
62988288      0x3C12000       Falling entropy edge (0.816265)
66797568      0x3FB4000       Falling entropy edge (0.797360)
66945024      0x3FD8000       Falling entropy edge (0.799068)
67055616      0x3FF3000       Falling entropy edge (0.695640)
69537792      0x4251000       Falling entropy edge (0.844167)
69648384      0x426C000       Falling entropy edge (0.844830)
69795840      0x4290000       Falling entropy edge (0.751251)
72941568      0x4590000       Falling entropy edge (0.838126)
</code>```

I tried using dd to pull out the jpeg data but it seems like that might be a false positive.

Looking at some of the strings in the binary; there seems to be some 3rd party AI vision software; broadcom modem, zhouyanhui@compile:[gcc 4.9.3] etc...

My question; what are some other steps that I could take to get further into this firmware?


问:
AGESA Extraction - AMI UEFI
Are there any community tools that are aimed specifically at extracting or replacing AGESA code in a UEFI?  In AMI UEFIs, AGESA is said to be scattered among multiple modules.  I have read that in AWARD BIOSes it's contained within a single module.  Are there any modern AWARD AMD UEFIs?

Thank you for any guidance.

Edit: Removed the long intro, straight to business.

Title: AGESA Extraction - AMI UEFI


问:
Duo MFA Enrollment API Parameters
Not sure if this is the right forum. I want to enroll my device for Duo MFA without using the Duo app. Duo uses simple HOTP codes, so I used this script to find the HOTP secret and enter it manually in my preferred authenticator app.

The enrollment succeeds (I see my device in the list of enrolled devices), and the codes generated by the script don't give an "invalid code" error. Instead, they give a "Duo Mobile None is not allowed" error, asking me to upgrade to a newer version of the app.

Obviously I need to pass some API params so Duo thinks I'm running a supported version. However, the Duo API documentation isn't clear on how version, platform, and OS version are reported during enrollment. (In fact, I don't even see documentation for that API - just authentication for an individual user and administration for all users in a company).

The API I'm using is /push/v2/activation/{code}, where {code} is the activation code stored in the enrollment QR code. I've tried adding 'version' (3.33.0.3, 3.33.0, etc.), 'platform' (apple%20ios), and 'type' (tablet) parameters, with those values based on documentation for other APIs. Enrollment succeeds regardless, but I continue to see the "Duo Mobile None is not allowed" message. Looking at the Python client repo on Github didn't help me understand how to enroll devices.

If possible I'd like to report the platform as Apple iOS, but another solution might be imitating a hardware token or the generic_smartphone type mentioned in the other API docs.

Can someone with more experience than me suggest a way to discover the correct API parameter names and values, or some other way to proceed? Thanks in advance.

Title: Duo MFA Enrollment API Parameters


问:
Format of Alcatel_Lucent I-240W-A backup file
I am trying to modify the backup file of this router in order to change some configurations.

Here is the structure I have until now:

16 bytes of the header, zlib compressed xml with the configuration and 32 more bytes of unknown data.

This is the header:

```<code>- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000000  0012 3123 0000 8e3a 7866 4ae5 0006 7255  ..1#...:xfJ...rU
</code>```

At offset 0x4 is the length of the zlib data and at offset 0x8 is the crc32 checksum of the same data.

And these are the 32 bytes at the end of the file:

```<code>- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00008e39  77da 46e5 2d71 285e c377 6691 c1b5 c1ff  w.F.-q(^.wf.....
0x00008e49  0f7d ba8c 4b83 ff1f 30ce 8c1b f381 8a0c  .}..K...0.......
</code>```

I tried to change the xml, update the length and the crc32, leaving the unknown bytes the same but the router did not reset its configuration.

I can confirm it did not work because when I use the unmodified backup file it resets the password for the admin account.

PS: I can't make the file public because it contains sensitive information


问:
x64dbg "Use Graph command or menu action to draw control flow graph here..."
When I press "G" in the CPU view of the debugger I often get the following screen:

In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios what to look for next time when I encounter such an issue. Is it from my side because I did not enable or did not care about something?

Do you also sometime encounter such a message?


问:
How can I debug a non-main .NET assembly using dnSpy?
I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the program (it's a DLL). I need to find out which code calls a class/method from the DLL and one way I thought of doing this is to debug the program. However, I would have to discover manually which functionality I need to perform in the program in order to get it to call this particular class.

Is there a better way to do this? I also tried to search for the text call to the method in the source code but haven't found anything significant. Lastly, in OllyDbg, a user can manually load a DLL using its DLL loader. Is this possible to do in dnSpy or another .NET tool?