问:
Dynamic Analysis with gdb on ELF binaries with no compilation/linking information
I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to compilation/linking etc., I am not able to set up the proper environment in order to run them within gdb.

In particular, I am receiving the following errors:

warning: Error reading shared library list entry at 0x1600

warning: Corrupted shared library list: 0x804c7c0 != 0x7c

Do you know how could I possibly resolve those issues or what can I do in order to set my environment properly for dynamic analysis?

Thank you so much in advance for all of your input.


问:
trying to understand this mov memory[register] instruction
Windows 10, IDA Home, 64bit application compiled with Visual Studio.

I'm reverse engineering a crackme and i found this instruction :

```<code>  mov     cl, byte_51B000[eax]
  mov     byte_51B018[edx], cl
</code>```

in these 2 byte_ location are null terminated strings.

I'm not sure to understand exactly what it's doing. Is it like an array index where byte_* is the array and [eax/edx] is the index ? i can't find this kind of syntax anywhere, is it IDA specific ?

ContentLicense: CC BY-SA 4.0


问:
How to discover how a program gets keyboard input?
I'm reversing a windows x86 binary that I can't figure out how the program is getting the keyboard input.

I've searched for the windows api functions I was used to but the program doesn't call them.

So... Is there a function that every different method to get the keyboard input calls? If not, what should I do in order to discover how a given program gets the keyboard input?


问:
In which program do I reverse engineer UEFI firmwares
I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it is only a software incompatibility, and I gave up all hope on getting help in other forums, I came to the conclusion I have to reverse engineer myself the code and find the if statement that fucks with me. (Edit : It is an NVME disk in an AHCI slot that I am able to access if that is not the boot disk. There is a dxe module that allows it to be bootable, however I have a very strong feeling that there is an if statement that defacto denies it to be booted from nvme for planned obsolescence)

I have an UEFI file that I managed to get with an SPI programmer from the motherboards MX25l12873F chip, and thats where my knowledge stops.

I know that I am looking for a display output of "2103: Detection error on SSD0 (M.2)" and all information related to NVME.

UEFITool 0.25 is able to find 8 instances of nvme and 1 instance of Detection error in separate dxe modules.

However I feel like I am going so deep that there is no forum specific for my kind of project, and I ran into a few problems: I don't know which disassembler, reverse engineer tool to use, and how to use them. I was trying to go with IDA, but when I searched for nvme, I could find nothing. Another post here mentioned that GHidra is better for these kinds of tasks, but I could not figure out how to correctly load the raw binary. This whole environment is new to me, but what should I do to correctly load in the whole image so I could just go and backtrack from the errors or get a control flow graph that I can follow around and maybe modify that if statement?


问:
Advice for retrieving functions and tables from Intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU
I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables, and plot them out before going onto DIY hardware.

Does anyone know which platforms to use to analyze Ford/Intel 8061/8065 bin files, or possibly disassemble them? I checked into the bin files today using Notepad++ hex editor plugin, and didn't get many strings except for 'Ford copyright 2002', but I do see some hex patterns floating around…  Thus, would I find a disassembling platform, or hack it with the 8061 manual?

Also, pardon my ignorance, but how do you regulars retrieve bin files? I know you can stick the ROM into the ROM reader, but intuitively I feel that people also get bin files from the OBD port upon KOEO and get the 'ROM dump' from the RAM in the ECU. Is that the 'frontdoor' way of getting live data?

P.S.: Excuse me for my use of semantics.


问:
x64dbg show some text in Chinese
While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.

This happened after I moved to a new computer but both of them were Windows 10.

In my old computer I didn't have this issue with the same file.

Any idea how to fix it?

I am working on the latest version Oct 2 2020.

Title: x64dbg show some text in Chinese


问:
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.

So i start searching for the way to do that...

I used HxH hex editor for trying to modify the firmware bin file.

i searched for the strings -> deleted some strings that have the keyword Messages, Games, Radio or Calendar -> but that doesn't looks correct

So i searched more and found binwalk in linux.

I used it and here's the results

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
------------------------------------------------------------------------------------------------------
197170        0x30232         Unix path: /source/base/src/doidleonpage.c
290966        0x47096         Unix path: /source/efs/src/efs_item.c
340308        0x53154         Unix path: /Layer1/source/c/datacnfproc.c
439316        0x6B414         Unix path: /Layer1/source/c/systeminfo.c
454360        0x6EED8         Unix path: /chip_module/busmonitor/v5/busmonitor_phy_v5.c
1044005       0xFEE25         MySQL MISAM index file Version 7
1047421       0xFFB7D         MySQL ISAM compressed data file Version 5
1076680       0x106DC8        MySQL MISAM index file Version 3
1083384       0x1087F8        MySQL ISAM index file Version 2
1084942       0x108E0E        MySQL MISAM index file Version 2
1095977       0x10B929        MySQL ISAM compressed data file Version 11
1115351       0x1104D7        MySQL ISAM compressed data file Version 2
1133241       0x114AB9        MySQL ISAM compressed data file Version 5
1163534       0x11C10E        MySQL MISAM compressed data file Version 9
1169361       0x11D7D1        MySQL MISAM index file Version 2
1169878       0x11D9D6        MySQL ISAM compressed data file Version 1
1172147       0x11E2B3        MySQL MISAM index file Version 7
1175240       0x11EEC8        MySQL MISAM index file Version 5
1216892       0x12917C        Unix path: /source/src/c/sci_mem.c
1222192       0x12A630        Unix path: /source/src/c/threadx_os.c
1235544       0x12DA58        Unix path: /source/src/c/sci_log.c
1240224       0x12ECA0        Unix path: /source/src/c/threadx_appmem.c
3853392       0x3ACC50        LZMA compressed data, properties: 0x5A, dictionary size: 16777216
                              bytes, uncompressed size: 4096 bytes
3858764       0x3AE14C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216
                              bytes, uncompressed size: 4096 bytes
3858804       0x3AE174        LZMA compressed data, properties: 0x5A, dictionary size: 16777216
                              bytes, uncompressed size: 4096 bytes
3858844       0x3AE19C        LZMA compressed data, properties: 0x5A, dictionary size: 16777216
                              bytes, uncompressed size: 4096 bytes
3984072       0x3CCAC8        LZMA compressed data, properties: 0x5A, dictionary size: 16777216
                              bytes, uncompressed size: 4096 bytes
4268656       0x412270        PC bitmap, Windows 3.x format,, 60 x 80 x 4
6060579       0x5C7A23        XML document, version: "1.0"
6064503       0x5C8977        XML document, version: "1.0"
6067639       0x5C95B7        XML document, version: "1.0"
6069663       0x5C9D9F        XML document, version: "1.0"
6071627       0x5CA54B        XML document, version: "1.0"
6073771       0x5CADAB        XML document, version: "1.0"
6075911       0x5CB607        XML document, version: "1.0"
6078019       0x5CBE43        XML document, version: "1.0"
6082035       0x5CCDF3        XML document, version: "1.0"
6084719       0x5CD86F        XML document, version: "1.0"
6087079       0x5CE1A7        XML document, version: "1.0"
6088615       0x5CE7A7        XML document, version: "1.0"
6091495       0x5CF2E7        XML document, version: "1.0"
6094375       0x5CFE27        XML document, version: "1.0"
6098727       0x5D0F27        XML document, version: "1.0"
6101915       0x5D1B9B        XML document, version: "1.0"
6105723       0x5D2A7B        XML document, version: "1.0"
6108279       0x5D3477        XML document, version: "1.0"
6110791       0x5D3E47        XML document, version: "1.0"
6113675       0x5D498B        Unix path: /Customer/XFV/PowerOffAnim/shutdown-01.bmp" width="128"
                              height="128">
6115267       0x5D4FC3        XML document, version: "1.0"
6118599       0x5D5CC7        XML document, version: "1.0"
6121467       0x5D67FB        XML document, version: "1.0"
</code>```

after extracting the .bin file, i got

```<code>total 71480
-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3ACC50
-rw-r--r-- 1 shakir shakir 4535216 Oct 30 01:33 3ACC50.7z
-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3AE14C
-rw-r--r-- 1 shakir shakir 4529844 Oct 30 01:33 3AE14C.7z
-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3AE174
-rw-r--r-- 1 shakir shakir 4529804 Oct 30 01:33 3AE174.7z
-rw-r--r-- 1 shakir shakir    4096 Oct 30 01:33 3AE19C
-rw-r--r-- 1 shakir shakir 4529764 Oct 30 01:33 3AE19C.7z
-rw-r--r-- 1 shakir shakir    4426 Oct 30 01:33 3CCAC8
-rw-r--r-- 1 shakir shakir 4404536 Oct 30 01:33 3CCAC8.7z
-rw-r--r-- 1 shakir shakir 2328029 Oct 30 01:33 5C7A23.xml
-rw-r--r-- 1 shakir shakir 2324105 Oct 30 01:33 5C8977.xml
-rw-r--r-- 1 shakir shakir 2320969 Oct 30 01:33 5C95B7.xml
-rw-r--r-- 1 shakir shakir 2318945 Oct 30 01:33 5C9D9F.xml
-rw-r--r-- 1 shakir shakir 2316981 Oct 30 01:33 5CA54B.xml
-rw-r--r-- 1 shakir shakir 2314837 Oct 30 01:33 5CADAB.xml
-rw-r--r-- 1 shakir shakir 2312697 Oct 30 01:33 5CB607.xml
-rw-r--r-- 1 shakir shakir 2310589 Oct 30 01:33 5CBE43.xml
-rw-r--r-- 1 shakir shakir 2306573 Oct 30 01:33 5CCDF3.xml
-rw-r--r-- 1 shakir shakir 2303889 Oct 30 01:33 5CD86F.xml
-rw-r--r-- 1 shakir shakir 2301529 Oct 30 01:33 5CE1A7.xml
-rw-r--r-- 1 shakir shakir 2299993 Oct 30 01:33 5CE7A7.xml
-rw-r--r-- 1 shakir shakir 2297113 Oct 30 01:33 5CF2E7.xml
-rw-r--r-- 1 shakir shakir 2294233 Oct 30 01:33 5CFE27.xml
-rw-r--r-- 1 shakir shakir 2289881 Oct 30 01:33 5D0F27.xml
-rw-r--r-- 1 shakir shakir 2286693 Oct 30 01:33 5D1B9B.xml
-rw-r--r-- 1 shakir shakir 2282885 Oct 30 01:33 5D2A7B.xml
-rw-r--r-- 1 shakir shakir 2280329 Oct 30 01:33 5D3477.xml
-rw-r--r-- 1 shakir shakir 2277817 Oct 30 01:33 5D3E47.xml
-rw-r--r-- 1 shakir shakir 2273341 Oct 30 01:33 5D4FC3.xml
-rw-r--r-- 1 shakir shakir 2270009 Oct 30 01:33 5D5CC7.xml
-rw-r--r-- 1 shakir shakir 2267141 Oct 30 01:33 5D67FB.xml
</code>```

My questions:

How to get the .c files like /source/base/src/doidleonpage.c ?

Why the file's name begin with hex ?

What to do next in order to get all the files ?

What's the correct way to pack the files to a .bin file after unpacking and
modifying them to flash it to the phone ?

Am i in the correct path ?

Firmware Link: http://www.mediafire.com/file/yl056lfk8xubt1o/GT-E1200Y_Hebrew_SINGAL_SIM.bin/file


问:
Detours ws2_32.dll [Send]
I have a program that calls send (), I need to change the host to my own, but this does not work (either the program crashes or the request does not reach the server) - I log requests on the server. What could be the problem?</p>
```<code>int WINAPI Mine_Send(SOCKET s, const char* buf, int len, int flags) {

string sdata = "Host: myhost.com\r\r\nConnection: close\r\r\nAccept-Encoding: gzip,deflate\r\r\n\r\r\n";

const char* cstr = sdata.c_str();

return Real_Send(s, cstr, strlen(cstr), flags);
}
</code>```

Title: Detours ws2_32.dll [Send]


问:
Decoding messages sent/received by Python websocket client
I am using the websocket module for my client in python3, and I am trying to troubleshoot some errors I am getting that lead to the client disconnecting after seemingly random intervals.

When I enabled trace with websocket.enableTrace(True) I can see some entries that I am not sure how to decrypt. Here is an example:

Thread-3:send: b'\x88\x82\xc1$\xf7\xa6\xc2\xcc'

Any idea how to decrypt the message and see if this could explain the source of my problem?

Thank you!


问:
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.

I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are out of question. Injection is not a problem in my case.)

I need hooking onto arbitrary addresses.
I want the hooking library saving registers, call my native function, and then restoring registers, and return/jump to specific addresses.

It is very tedious to do this on manually at a per-site basis and therefore I want an existing library. Furthermore, x64 MSVC does not support asm. It seems that manual hook is impossible unless other tool-chain are used?

Does such kind of hooking libraries exists?


问:
How to parse objdump output data?
I'm somehow newbe in reverse engineering and currently I'm reading RE4B book.

In the image above:

I can't figure out the role of s in the functions f1 and f2. As far as I know, based on the last line in the image (i.e. s     db 'world', 0xa, 0), the variable s is a pointer to the beginning of world string. So, why this value is over-writed with -1C in the functions? (s = dword ptr -1Ch)

As you know, we can use stack to pass function arguments. The question is why the compiler used mov [esp+1Ch+s], offset s ; "world\n" instead of mov [esp], offset s ; "world\n"?

Title: How to parse objdump output data?


问:
I found an arbitrary free, (free(<abitrary address>)), managed to locate a candidate address I wish to free, how do I proceed from here?
While doing my first code auditing as a novice vulnerability resarchers I managed to stumble upon
my first free() in my target.
I managed to find a candiate location where I can control this value and thus trick my target to free any address.

Given I can turn this free() to an infoleak, how do I proceed from here with getting code execution?

Should I read Malloc-Demaleficarum and follow one of houses in order to trick malloc into returning my fake chunk? (i can call this free many times once i defeated ASLR).

Any hints and advice will be very welcome, I'm looking for the methodolodgy rather than a full step-by-step solution.


问:
Delphi mt38 CRC (Tricore 1766 Arch)
I want to calculate CRC32 for Delphi mt38 and found the below assembly algorithm and converted it to C. It seems that this algorithm is defined for n = 256 or 1024. I want to calculate CRC32 for n = 1638400 and expect to get CRC32 = 0xFB6568AF for input data = {0}, but it  doesn't give the expected answer. How can I calculate it?
Thank you in advance.

The assembly algorithm:

```<code>CheckSum:                               ; CODE XREF: sub_CDBA6
            movh.a          a15, #@HIS(CKS_loop_count)
            lea             a15, [a15]@LOS(CKS_loop_count)
            ld.b            d15, [a15]0
            jz16            d15, loc_CE256
            mov32           d14, #0x100
            j16             loc_CE25A
; ---------------------------------------------------------------------------

loc_CE256:                              ; CODE XREF: CheckSum
            mov32           d14, #0x400

loc_CE25A:                              ; CODE XREF: CheckSum
            mov16           d13, #0
            movh.a          a14, #@HIS(table_address)
            lea             a14, [a14]@LOS(table_address)
            j16             loc_CE2FA
; ---------------------------------------------------------------------------

loc_CE266:                              ; CODE XREF: CheckSum:loc_CE2FA
            movh.a          a15, #@HIS(DATA_address)
            ld32.a          a7, [a15]@LOS(DATA_address)
            ld16.bu         d10, [a7]
            ld32.w          d12, dword_D0000D34
            ld32.w          d11, dword_D0000D30
            jlt.u           d12, d11, loc_CE286
            call32          sub_7FCC0
            add16           d11, d2
            jlt.u           d12, d11, loc_CE2A8

loc_CE286:                              ; CODE XREF: CheckSum+36
            mov.u           d6, #0xFFFF
            ld32.w          d15, CRC_value
            sh32            d7, d15, #-8
            addih           d6, d6, #0xFF
            and16           d7, d6
            xor16           d15, d10
            and32           d15, d15, #0xFF
            addsc16.a       a15, a14, d15, #2
            ld16.w          d15, [a15]
            xor16           d15, d7
            st32.w          CRC_value, d15
loc_CE2A8:                              ; CODE XREF: CheckSum+40
            movh.a          a15, #@HIS(DATA_address)
            ld32.a          a7, [a15]@LOS(DATA_address)
            add16.a         a7, #1
            lea             a15, [a15]@LOS(DATA_address)
            st16.a          [a15], a7
            ld32.w          d15, dword_D0000D34
            add16           d15, #1
            st32.w          dword_D0000D34, d15
            ld32.w          d7, dword_D0000D26
            jlt.u           d15, d7, loc_CE2F8
            ld32.w          d15, CRC_value
            movh.a          a15, #@HIS(CRC_Variable)
            st32.w          [a15]@LOS(CRC_Variable), d15
            mov16           d15, #1
            st32.b          take_CKS_var, d15
            movh.a          a15, #@HIS(CKS_loop_count)
            lea             a15, [a15]@LOS(CKS_loop_count)
            ld.b            d15, [a15]0
            jnz16           d15, loc_CE2FE
            mov16           d15, #1
            movh.a          a15, #@HIS(CKS_loop_count)
            lea             a15, [a15]@LOS(CKS_loop_count)
            st16.b          [a15], d15
            ret16
; ---------------------------------------------------------------------------

loc_CE2F8:                              ; CODE XREF: CheckSum+84
            add16           d13, #1

loc_CE2FA:                              ; CODE XREF: CheckSum+22
            jlt.u           d13, d14, loc_CE266

loc_CE2FE:                              ; CODE XREF: CheckSum+A6
            ret16
; End of function CheckSum
</code>```

The converted C algorithm:

```<code>uint32_t crc32(uint32_t n, uint32_t *data) {
    uint32_t i = 0;
    uint32_t ch;
    crc = 0xFFFFFFFF;
    while (i < n) {
        ch = data[i];
        crc = ((crc >> 8) & 0xFFFFFF) ^
              *(crc32_table + ((((crc ^ ch) & 0xFF) << 2) & 0xFF));
        i++;
    }
    return crc;
}
</code>```

Title: Delphi mt38 CRC (Tricore 1766 Arch)


问:
After jumping to the xref operand of a function I found via string searching in IDA, I am brought to an rdata section?
First post here, so sorry. I'll try to keep it short. Anyways, when trying to xref an operand (to find its offset), it brings me to an rdata function. It looks like this:

```<code>.rdata:00000001419318D8                 dq offset aFhealth      ; "fHealth"
</code>```

Any idea how I can get the offset from this? It's the only thing that shows up when I search for fHealth in the strings view, and in this game the game itself is stored in the exe, not in another dll.


问:
Where to start with reversing a custom JavaScript VM?
I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start to decompile the script. Not asking to be spoonfed, just looking for some tips! Thanks!</p>


问:
IDA stack depth differences when branching
I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions.

For example:

```<code>call dword ptr [edx+0xC8h]
</code>```

which is really:

```<code>pD3DDevice->SetRenderState();
</code>```

IDA doesn't correctly guess the stack pointer change of these calls in every case, so I have to go through and Alt+K the correct SP value manually.

But after doing this I start running into a problem where one side of a branch will have the wrong SP value

I can Alt-K the first instruction with the erroneous SP value but this only takes effect on the next instruction.

Edit:


问:
How to go to the variable's stored location directly in decompiler mode of IDA?
When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to "stack locations" instead of the actual address that the variable/structure is stored :

```<code>-0000002C KeyHandle dd ?                          ; offset
-00000028 RegistryPath LSA_UNICODE_STRING ?
-00000020 var_20 dd ?
-0000001C var_1C dd ?
-00000018 var_18 dd ?
-00000014 var_14 dd ?
-00000010 var_10 dd ?
-0000000C var_C dd ?
-00000008 var_8 dd ?
</code>```

And clicking on the variable names in above tab doesn't go to the address either.

also I'm not sure why but everytime, all the values of this place are "?", which is not really useful, so in order for me to go to actually go to the address this variable is stored, i have to point my mouse on it, find its address, then write it in cntrl+g to go there.

it would be a lot better if i could just click on the variable and it went to the address that this variable is stored, is there any way i can do this?


问:
Windows: Is it possible to mix FastIoDispatch with the registration of IOCTLs?
I am reverse engineering a Windows device driver. My main previous experience was with drivers I had written before, or toy drivers from tutorials.

I started reversing the driver by searching for IOCTL handlers. However, in the initial driver entry the Driver Object struct lines up such that the function that appears to contain IOCTLs aligns with the "FasIODispatch" member. I am on the fence as to whether this is a mistake on my part, or whether it makes sense to define IOCTLs in a Fast I/O dispatch table.

Here is what I mean:

Now deep nested within that function, there are many comments directly describing the contents as IOCTL handling code.

For instance note the following debug string in the driver:

Now, the help here is to help me understand whether this is:
a) Me misinterpreting the driver object struct offsets such that a MAJOR_FUNCTION is missed and place of FastIoDispatch
b) A sensible interpretation where a fastIo Dispatch table includes definitions of IO Controls.

I am leaning towards B, but I do not have the experience with FastIO file driver development to know what a fastio file driver dispatch table would look like. The reason I am concerned I have something wrong is that all of the data I have seen so far makes it seem like one would IRP handling structures and FastIO separately. Mixing the two would seem to me as if it were against the point of using FastIO, but who knows what driver developers do in practice.

Please let me know if there's anything else I can do to help device this. Note this is a 3rd party device driver I am RE'ing in my spare time. I'm not sure what the policy is here, but I'm not sure I should post the name if you want to RE it yourself.


问:
Accessing Windows 10 Feedback Hub Data
I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and WireShark didn't give me much data) to see the requests being sent to Microsoft's servers.
I have tracked down that the request that receives the feedbacks is the following:

```<code>GET https://uif.microsoft.com/FeedbackCloudService.svc/feedbacks?&language=en-US&sortCategory=0&searchCategory=1&feedbacksFilter=0&issueFilter=0&statusFilter=0&buildFilter=0&userFilter=1&filterFormFactor=1&isRefresh=False&hasSticky=False&useCol=1 HTTP/1.1
</code>```

But this request require a Bearer token (not JWT) which changes each day. The token is never being received from any of the previous requests sent what i can gather so I assume it's being generated locally in the app. Example of what that token can look like:

```<code>Bearer t=EwAgA6V3BAAUGPuzwScRsx1D3Ae+Cp5u2pto1vUAAb8PDcrWR7+vMEF4YZMTWJmipBhl8htHXLaRgddZ7MtcdDscYYsiLZgX7BhPCLB8sSJtzvaA2N73lMP80jv+vSk180vi7FAtgIzRGk9VPFn5Ogs3M2ysJVv5m/r8DXIJ8IHyki726AgreMpm2BW0UPCmcKUY1KFJh/Vmdc9n1woMJYaUh5DhSPndHhoN4F51vlt6ZZ6Pg6fmX7YreEj+4RdUgmRe9JD2L+BwRmwPpbls821UdhspQ5rQskH5HanqoKm9k1iWxiutno2EWW1aVbCPrPFNVjmpawz9vsT8RMIhD919g9YQagudz8ezLaR7vWBfnbRM+yMt/yjNROJzfcQDZgAACKFy0iuQaBDL8AGPGDzJEYGt9XjfIMdTU+2T3/O8yBB19wengT93OCEUNIJz1xZ36i3LeNVaGl0lv+Rl2HAvRNywf/YwQjpQ7bxY1KbmvLmLTYGwea8XigCgHwJIcg+vxnDEwmIgdt+tewlRFGdPmlDAK4TS6tusq/kl1mGWrR25fVqwoS1D4EyhaQB12OQIVXo+hiIR9ZIHgcc6OOJ75G2SADNRACxH8sA3gPLNCtQgJxQEinmUOjZr1HepstvSFq5TI21hUuk5cwxWEINdjvZeCg75KCWf3582MZvEWwEX3MuOw6BJmhuW0prwp8kL/WaOypfb7wXXWFuk1drYWEEMfz1raXnsNf9vR3Kp4+kS6lM5giOdrsWx3UpqSFGqGhTwlDdexpwW+vgkxh3jutWetYvBl+7R00faU+rxj0CrEMKev8HnEuJVfBv20UQ5b4GFq2w73PzDjH61NW8YplI7UggfDLRKnfPtT5ZuOISRJUtY9RjKUYfgN7PJouY4bAx24qepaDpqfHkJIB0n5qMQ/TmCukL2BT5CrNQIoUt0W6ii+U2sq31V0fbpMlGq9EjWTiDQ171VJiJ2YXQn/iHaamq6I4lYT5Rw1jxw465GU+FkrqX1lSQnlYDWqMctT/HDG2gF1KZ9nT56RqRnoWxjFqVr5+jQn+zIIgI=&p=
</code>```

So now I wonder if there's any way to crack open the Feedback Hub app and see how this token is being generated or where it's getting it from. I know pretty much nothing about RE and especially not about UWP RE since it's not dotnet so I can't use dotPeek on it or similar.
Any help would be appreciated!

Title: Accessing Windows 10 Feedback Hub Data


问:
Is it possible to somehow derive the decryption key for iOS app binaries?
While disassembling an IPA downloaded directly from the App Store CDN, I noticed that the binary had an unusually large entropy. Looking this occurrence up confirmed my suspicion that it was encrypted, and that they were decrypted at launch time— which suggests that the decryption key is somewhere on the device. Why wouldn’t it be possible to obtain this key using a jailbroken device? Am I overlooking something critical? Thanks!</p>


问:
Is there a meaning to the test instruction if it isnt followed by a conditional jump?
Pasting a snippet of code I found inside a malware sample.

```<code>0040F695    push ecx
0040F696    lea ecx,dword ptr ss:[esp+8]
0040F69A    sub ecx,1000
0040F6A0    sub eax,1000
0040F6A5    test dword ptr ds:[ecx],eax
0040F6A7    cmp eax,1000
0040F6AC    jae sample.40F69A
0040F6AE    sub ecx,eax
0040F6B0    mov eax,esp
0040F6B2    test dword ptr ds:[ecx],eax
0040F6B4    mov esp,ecx
0040F6B6    mov ecx,dword ptr ds:[eax]
0040F6B8    mov eax,dword ptr ds:[eax+4]
0040F6BB    push eax
0040F6BC    ret
</code>```

I am not sure what the test instruction achieves here. I am used to seeing a conditional jump right after it. But here there is a test, cmp and then a conditional jump and also a test followed by no jumps. Would it make any difference if the test instructions were omitted?


问:
Protection of Financial Apps against repackaging
I have tried repackaging few financial apps and when I tried running their repackaged version, I found out that either it is getting crashed at the launcher activity, or at the later point it is getting crashed.

I have a doubt that how the developers of these financial apps make their app more secure against repackaging?

Is signature checking the only way, developer will use as an anti-repackaging measure or is there any other way which developer can use?

Are the developers using any existing framework which automatically makes their app more secure?


问:
how do I use Remote Binary Protocol in cutter
how do I use Remote Binary Protocol I tried to connect to gdbserver through the normal method but it would just hang and not connect. I let it go like that for 1 hour</p>


问:
Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container
My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using

sudo docker run --rm -it -p 12345:12345 -v /host_dir:/container_dir --privileged arm64v8/alpine /bin/ash

I then proceed to install gdb in the container using apk add gdb. Subsequently I run ps aux just to get a list of the processes running in the container in order to test gdbserver --attach COMM...PID command in the container. Interestingly absolutely no output no matter how much time goes on. As a result, I switch to the host and simply do the same exercise on the Ubuntu machine, i.e., I attach to a random process with pid 23056. The output to gdbserver --attach :12344 23056 is Attached; pid = 23056 Listening on port 12344, which is what I expected to happen with gdbserver in the container. Any help as to why gdbserver in the container doesn't behave properly is appreciated!

EDIT 1:

I tried again and first ran sudo docker run --rm -it --privileged -p 7777:7777 -v home_dir:container_dir arm64v8/alpine and then ran gdbserver localhost:7777 ./binary and then as suggested in the comments I used netstat -l in the container and got tcp 0      0 0.0.0.0:7777            0.0.0.0:*   LISTEN. So it seems that clearly gdbserver is listening for a tcp connection. Then I use gdb-multiarch binary on the host machine and then (gdb) target remote localhost:7777 to get:

Remote debugging using localhost:7777

Ignoring packet error, continuing...

warning: unrecognized item "timeout" in "qSupported" response

Ignoring packet error, continuing...

Remote replied unexpectedly to 'vMustReplyEmpty': timeout

Any idea?!

EDIT 2:

I ran the docker container without the --publish or -p attribute and clearly no matter what IP:PORT I use, gdb-multiarch says the Connection timed out.


问:
How to use smalivm and simplify to find a certain static constant from APK or remove confusion?

smalivm: Provides a virtual machine sandbox for executing Dalvik methods. After executing a method, it returns a graph containing all possible register and class values for every execution path.

I want to find a static constant from a APK. Because of its use of obfuscation, the code is difficult to read. But I know that the constant is returned from a function after confusion, and I am sure that it is a fixed value. I think smalivm can find out the return value of this function, but I can't find a sample article that fully describes how smalivm is used except for this article. This got me into trouble.

I don't know much about simplify. Does simplify work equally well when not using smalivm?


问:
How to reverse engineer Electron V8 Snapshot Data Blobs?
Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be platform / CPU architecture specific binaries (and may vary depending on the platform) but I am not sure. They have no typical entry point like a normal PE.

Any advice on reverse engineering these snapshot data blob binary files would be appreciated! I am actually looking for a tool like x64dbg or IDA Pro but also thinking of making a similar debugger by myself if there isn't any available. However, the file specs are needed first. Thanks.


Title: Need Help with decryption backup config.bin file "ZTE ZXHN H267N v1.1"

Body:
hi i'm trying to decrypt config.bin file from new router I got from my company, I tried a tool found on github "https://github.com/mkst/zte-config-utility" I got this ERROR:

```<code>python3 examples/decode.py --key 'tHG@Ti&GVh@ql3XN' --serial 'ZTEFG7GL7B112171' config.bin config.xml
Traceback (most recent call last):
  File "examples/decode.py", line 41, in <module>
    main()
  File "examples/decode.py", line 36, in main
    payload_type = zcu.zte.read_payload_type(infile)
  File "/home/user/.local/lib/python3.8/site-packages/zcu-0.1.0-py3.8.egg/zcu/zte.py", line 51, in read_payload_type
  File "/home/user/.local/lib/python3.8/site-packages/zcu-0.1.0-py3.8.egg/zcu/zte.py", line 45, in read_payload
AssertionError
</code>```

binwalk gives me:

```<code>binwalk -E -N config.bin

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Rising entropy edge (0.950362)
18432         0x4800          Falling entropy edge (0.617036)

</code>```
```<code>binwalk -W config.bin

OFFSET      config.bin
--------------------------------------------------------------------------------
0x00000000  04 03 02 01 00 00 00 00 00 00 00 0F 5A 58 48 4E |............ZXHN|
0x00000010  20 48 32 36 37 4E 20 56 31 2E 31 01 02 03 04 00 |.H267N.V1.1.....|
0x00000020  00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0x00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0x00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0x00000050  00 00 00 00 00 00 00 00 00 47 B0 00 00 47 C0 00 |.........G...G..|
0x00000060  00 00 00 70 B0 93 D8 95 41 0B 8B A6 26 7B 59 35 |...p....A...&{Y5|
0x00000070  44 77 FF 9C 74 B2 02 15 29 F9 28 EA 5A F2 C5 84 |Dw..t...).(.Z...|
0x00000080  66 B1 2C 3E 10 5A 76 AA 2D D1 9E 9D AA 6E 49 1E |f.,>.Zv.-....nI.|
0x00000090  5F A1 6D 0D 42 E0 6C E9 D9 84 81 23 99 5A B5 22 |_.m.B.l....#.Z."|
0x000000A0  09 BC 78 5A CB EF AF 4B D7 1E A2 40 D4 11 7F 7E |..xZ...K...@...~|
0x000000B0  EE EC DC E8 D7 CC 9C 8B EE BD 02 6C A7 BB F8 B6 |...........l....|
0x000000C0  76 01 2F 0A CD CE F4 B1 02 BF A9 C3 37 D1 3D 44 |v./.........7.=D|
0x000000D0  80 55 DD C9 DB 59 70 1C D9 9F DA 89 D6 04 14 66 |.U...Yp........f|
0x000000E0  AA 9B 77 AE 1D BB 0C C0 BF 2F F2 86 3D 3B E5 CA |..w....../..=;..|
0x000000F0  1E EF 25 2D 44 02 09 DE 6A BF 3A 91 56 65 58 6E |..%-D...j.:.VeXn|
0x00000100  B2 7B 5F 18 1F 18 90 3E 43 56 B8 9A 1A 5B 3A BC |.{_....>CV...[:.|
0x00000110  6E D0 5B 44 5F 2B 9E CC BC F4 12 8B 61 50 E4 C8 |n.[D_+......aP..|
0x00000120  1C 50 FF B9 2F 1E 34 83 57 63 72 45 5E E4 83 17 |.P../.4.WcrE^...|
0x00000130  8F ED 29 AC 0E 27 DF FD 30 C1 63 44 D2 35 2F E9 |..)..'..0.cD.5/.|
0x00000140  65 5B 6A AA 39 54 9D 5C 34 29 63 43 C6 1D 67 80 |e[j.9T.\4)cC..g.|
0x00000150  89 7B EB 08 A3 30 A9 67 A8 C0 38 EA B4 B1 7B 45 |.{...0.g..8...{E|
0x00000160  6D C5 3A A6 FC 90 52 05 20 62 E0 82 C8 A3 76 98 |m.:...R..b....v.|
0x00000170  D9 D8 7D B1 BE CC 1A B6 15 CA BB 85 5B 15 EE 1D |..}.........[...|
</code>```

any idea guys to decrypt config.bin file


问:
Acquire command line of remote process in Windows OS
I'd like to use C/C++/CS API to get the command line that invoked another process according to PID.

I've seen that this is done in processHacker that is an openSource project, but I couldn't find the exact way for how it's done. Perhaps anyone can share the undocumented method with me ? thanks !


问:
Weird x86 function calling convention
I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime.

The function seems to be an __stdcall as it ends with a move into eax and ret 0x4. The first weird thing is it takes one parameter on the stack (the result of GetCommandLineA) but right at the start it does lea eax, [edi+0x8] without ever writing to edi. I figured out it's a custom calling convention and the second parameter is passed in edi. It's called from a very big (400 lines when decompiled) main function, so I didn't know what exactly is being passed but it seemed like an address on callers stack. I thought it's some array of pointers until I realized it's actually 3 parameters passed as one. The callers stack looks like this:

```<code>...
|----------|
|  char *  |   >   command line on heap
|          |   <   edi
|----------|
|   int    |   >   argument counter
|----------|
|  char *  |   >   char*[256] pointers to arguments
|----------|
|  char *  |
|----------|
|  char *  |
|----------|
...
</code>```

The function copies the command line to heap, assigns the address to [edi], sets [edi+0x4] to 0 and calls memset([edi+0x8],0,1024). Then it goes through the command line and does this:

```<code>        00401185 8b 4f 04        MOV        ECX,dword ptr [Addr + 0x4]
        00401188 89 74 8f 08     MOV        dword ptr [Addr + ECX*0x4 + 0x8],Heap
        0040118c 01 5f 04        ADD        dword ptr [Addr + 0x4],EBX                   # EBX=1
</code>```

if it finds a new argument.

How can a function operate on it's caller's stack?

Title: Weird x86 function calling convention


问:
Miasm VS Triton - which to choose?
Hello and thank you for reading my question,

I was wondering, which is the right tool for me to choose according to the following:

I will be using it mainly for Malware analysis and for exploit development, fuzzing and research. It should have as low overhead as possible when instrumenting, can be integrated with angr/qiling or provide similar capabilities at low/lower overhead, hopefully easy to use and understand and has decent documentation and examples, and hopefully can be extended for custom needs if functionality is not available.

When I researched about them, even though their github seems quite recent, both frameworks(triton and miasm) seem to be quite old, while triton is a bit newer. I came across miasm in regards to deobfuscation and it seemed great, but I am looking for something more extensive and faster(lower overhead if such thing exists). If you know of a newer tool/framework that can aid me, please post its name as it can help me a lot instead of reviewing papers for different conventions and betting on projects "randomly"(without any disrespect, just hoping for practicality).

Thank you for your help.

If you can write the advantages or disadvantages for each tool, it will be help me to make a wise decision. I am sure others will fun your answers lucrative and learn a lot from them as well.

Title: Miasm VS Triton - which to choose?


问:
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects that they can confuse the debugger and cause incorrect results even when the program is compiled with gccgo. As a consequence, although GDB can be useful in some situations (e.g., debugging Cgo code, or debugging the runtime itself), it is not a reliable debugger for Go programs, particularly heavily concurrent ones. Moreover, it is not a priority for the Go project to address these issues, which are difficult."

I'm also aware of projects such as IDAGolangHelper or other scripts to aid already established reverse engineering tools such as Ghidra in interpreting Golang binaries. Nevertheless, I would like to know assuming one prefers a self-containing debugging tool that is already successful in understanding the eccentric Go runtime, what will your choice(s) be? Also, I would appreciate any comments on Radare2's ability in handling Go binaries.

EDIT 1 (Clarification of Question): Assuming working on a x86_64 host it seems to me that QEMU's system mode is an essential part of the environment considering the fact that ptrace is not implemented in the QEMU's user mode. The other factor is obviously the libc implementation. For a dynamically-linked binary with the ld-musl-aarch64.so.1 interpreter this adds a Linux distribution with musl as the native libc implementation unless one wishes to build musl on a distribution already having glibc installed. So I guess my question would be what other functionalities (or tools) will you add to QEMU and Alpine?


问:
Creating stack variables when they are addressed by non-SP register
So, I have ARM code which uses R7 as the register to access the stack variables:

In the first basic block IDA successfully identified R7 as stack pointer and created the variables. But then, after 40123C, there's still code which references stack variables via R7, and IDA didn't create the variables. If I press K on [R7,#4] it creates the stack variable at +4 offset:

Where in fact, it should have created the variable at -0x14.

Is there any way I can make IDA create stack variable at those LDR R3, [R7,#4] properly?


问:
What exactly does the selectnbrecv function from Golang do?
I'm reverse engineering a Golang binary and came across the function selectnbrecv. However, I don't understand the documentation. I'll appreciate it if someone can explain to me the context and operation of the function. Thanks!


问:
How to dump heap from packed program (unpack asprotect)
I have a packed program. I have found the oep of the program but the problem is every call to the system dll like kernel32, user32, ... change to a call to the heap. So the packer first allocate a big chunk of heap, copy the dll function to the heap and then instead of the call to dll it call the heap.

So my question is is there anyway to dump the heap to section? if not then how can i fix the iat in this situation?

Edit: After some experiments, i found that it use asprotect to pack. The iat got obfuscate, instead of call to the function it call to the heap and then the heap will jump to another heap which contain a part of the function and then jump to the real function. So the problem now boil down to how can i fix the iat for it to run? I did set hardware breakpoint on the time the iat create but the function doesn't get written in the iat


问:
IPCamera based on RA5350 CRC error on startup
I have an old IP camera that no longer works, doesn't start the ipcamn executable (application that also listens for port 80 connections).
Therefore I cannot access it via the network and the camera doesn't perform its intended purpose.

It is based on a RA5350 chip, if I attach a serial to USB adapter to it I can see it booting, then it outputs:

```<code>Data CRC 01e4cb65 != calculated CRC ed5f8089 for node at 00240af0
Data CRC 01e4cb65 != calculated CRC ed5f8089 for node at 00240af0
Data CRC 01e4cb65 != calculated CRC ed5f8089 for node at 00240af0
</code>```

The system is usable, I can move around, I even copied the contents in search of which program outputs this error.

I have found that the camera uses two processes videocatch and ipcamn (this is true according to other internet resources as well).
The ipcamn is the process outputting these errors. However upon disassembling or looking at the strings contained in it or the .so files on the system I cannot find anything related to the error above.

I'd like to trace the error to its cause and see if it's fixable.
Any ideas?

```<code># cat /proc/cpuinfo
system type             : Ralink SoC
processor               : 0
cpu model               : MIPS 24K V4.12
BogoMIPS                : 239.61
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available
</code>```

I also tried to rule out HW problems by copying the binaries over to a Debian MIPS system in QEMU, but I cannot run the executables on MIPS nor on MIPSEL:

```<code>user@debian-mips:~/mnt/bin$ ./ipcamn
-bash: ./ipcamn: cannot execute binary file
</code>```
```<code>root@debian-mipsel:/home/user/mnt/bin# ./ipcamn
bash: ./ipcamn: No such file or directory
</code>```
```<code>root@debian-mipsel:/home/user/mnt/bin# file ipcamn
ipcamn: ELF 32-bit LSB executable, MIPS, MIPS-II version 1 (SYSV), dynamically linked (uses shared libs), stripped

</code>```

The file exists and is executable.


问:
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.

Basically, I am looking for an apktool for .aab


问:
Methods to alert inappropriate use of JS code
Let's say we have a JS code library that is not for sale, just internal. Of course, anyone who can access the website will be able to download that and reuse it.

To avoid others to reuse that library, the first thing to do is obfuscate it, but what about the alternative methods to warn the owner about the inappropriate use of that library?

This JS code is behind a login website, so it's not possible to just use it adding a:

```<code><script src="https://original.web.site/script/library.js"></script>
</code>```

(it will give a 404 error)

So it must be downloaded and installed in a new website. In this case, I think that it's possible to just add a  that alerts the owner about the inappropriate use of the library (note the use of http protocol that shows the referer link).

To find and block this kind of warnings, my first idea is to test the library in localhost and check if it is accessing to external URLs (Developer Tools in Google Chrome provide this functionality).

My question is: Is there any similar method to warn the owner about inappropriate uses of the library? How to effectively find this kind of warnings and get rid of them?


问:
Parsing binary file to Idb faster with Ida
When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores?

Is there any way to make that process faster? run it on all over cores?

Maybe if I need to parse to idb only functiond that contains specific string ,can I do that insread of parsing all binary to Idb?


问:
How does one start with reversing router config encryption?
There is not enough info on the web from what I have seen.

Most write ups/guides/blog-posts are like this:

They provide only the decrypt/encrypt script-tool with how to run it and nothing else

They provide the script with where to find the keys but not how he was able to locate them or the steps to do so nor where he got the signature part which is necessary for encrypting (so a one can apply that method to a bit diff version of the router)

They provide everything but the encrypting function.

So, I was never able to find a guide that I can replicate on just the same model but with a different key or signature not a single full guide.

Now let's say you have a firmware file & the config file. Knowing that you can extract the firmware files using 7-zip/binwalk or whatever, how to proceed from there to figure out the encryption of the config file?

Note that the answer doesn't have to go into much detail; just a quick walk through the steps in general is fine.


问:
ZTE AES-256-CBC Encrypted backup config file
i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output

```<code>Encrypted Data Start Position: 227
Encryption Algorithm: AES-128
Encryption Key: 34303263333864653339626564363635
Compression: zlib / deflate
</code>```

and

```<code>Encrypted Data Start Position: 227
Encryption Algorithm: AES-128
Encryption Key: 4772574D33487A264C54767A26665E39
Compression: zlib / deflate
</code>```

also someone told me

the encryption algorithm was changed to AES-256-CBC and key and iv are
derived from MAC, SerialNumber and EncryKey.

snprintf(&g_keySeed, 65, "%s%sMcd5c46e", EncryKey, SN);
snprintf(&g_ivSeed, 65, "G21b667b%s%s", MAC, EncryKey);

sha256(key_seed, key_seed_len, &aes_key);

sha256(iv_seed, iv_seed_len,&aes_iv);

without telling me what's that encrykey and didn't reply again.

the firmware and config files


问:
Ghidra: What are "hash" function variables in the listing view
The variables at the bottom prefixed with HASH:xxxxx:8, what are these variables and why are they here?

When I delete them Ghidra insists on re-adding them when I Commit local names so I'm guessing they must be of some importance or Ghidra is detecting they exist in some way.


问:
What is .data.rel.ro used for in GO on Linux?
I'm reversing a GO binary, and I was trying to locate where some symbols appear in the binary. I did the following:

Used nm on the binary - which did not recognize any symbols

Used go tool nm - same as #1

Ran strings and piped to grep - Did not find the symbols I was looking for

Finally, opened the binary in radare2 and ran command izzz~search and I found the symbols I was looking for in .data.rel.ro section.

I don't understand what data in this section is used for in the context of GO. Is this where function symbols that are loaded into the binary reside? I'm not sure why else these would be located here, and also why nm couldn't find them.


问:
Edit ASCII value in Assembler (using Immunity Debugger)
I am trying to edit ASCII String via Immunity Debugger:

However when I right click to do binary edit and then I click ok, the MOV DWORD instruction is replaced with some random instruction which cause the program to crash:

This is the result:

Why is the MOV DWORD instruction completely destroyed and replaced with these random instructions ?


问:
How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?
I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them.
I have dumped and decoded the bios and got some useful datas,
according to datas we can see u-boot.bin, u-boot.bin.cpu2 and fsoc/spi_boot_fsoc.bin images so i want to know how we can extract these  bootloader images and so install custom  open source projects like OpenWRT, pfsense.

Any help would be appreciated
thanks..

```<code> no_repeat=1�uart=loadb 100000;go 100000
�mbu=sete tftpip 172.30.80.145;sete myip 172.30.80.154;tftp u-boot.bin;go 8000000
�cpu2img=u-boot.bin.cpu2
�crc=crc $fileaddr $filesize�sfwr=sf probe 0;tftp b000000 fsoc/spi_boot_fsoc.bin;sf wrimg b000000 0
�bootdelay=3
�baudrate=9600
�ethact=nplite#0
�silent=0
�dhcpen=0
�netmask=255.255.255.0
�imagename=fgt90d.out
�tftport=0
�mac0=08:5b:0e:xx:xx:xx
�sn=FGT90DXXXXXXXXXX
�ver=FortiGate-90D (20:14-02.28.2014)
�bootcmd=flat
�myip=10.10.0.100
�tftpip=10.10.0.10
�gatewayip=10.10.0.101
</code>```

Here is the entire bios dump
https://pastebin.pl/view/e641d7a3

Thank you for your help


问:
Right way to reverse a VM
I'm currently reversing a virtualized sample  that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the custom vm opcodes in order to determine what the program actually does. Unlike most other vms, there are no vftables which makes it very hard for me to reverse since there are more than 100 virtual handlers which are not defined as functions (All of the handlers are defined in loc_XXXX code blocks. Example image is below).

Trying to decompile the vm_dispatch function leaves me with this:

```<code>  ...
  a lot of local variable initialization
  ...
  assign vm handlers
  ...
  bytecode_array[53] = &loc_4041A3;
  regs->VIP = 0x6000;  // virtual ip
  memcpy(bytecode_array + regs->VIP, bytecode, bytecode_size);
  regs->R5 = -1;
  vm_code = *(bytecode_array + regs->VIP++);
  __asm { jmp     [ebp+eax*4+vm_handler_array]; jump to the appropriate handler }// switch jmp
}
</code>```

I know it's not fully decompiled because there are more than 100 blocks, each executing a specific vm bytecode. None of that is reflected on the decompiler output.

It's really time-consuming to go through each loc_XXXX without being able to define VM specific structures like VM and REG and to read the low-level assembly. My question is, is there any:

Way to convert loc_XXXX code blocks to functions to that I can decompile the code and create structures?

Right approach to read the assembly / make it easier?

Title: Right way to reverse a VM


问:
Conditional breakpoint on register containing string catch everything
I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything:

I also tried with dereferenced register [ESI] == "Sessions" but it didn't work.

What is the problem with my conditional breakpoint?


问:
Automating binary patching in Hopper Disassembler using python
I am curious to know if anyone has done anything similar to what I am looking to achieve...

I have a .ipa file (iOS application) that I load into to Hopper Disassembler.

I search for a string to prompt me to a location that I traverse to patch.

Patch the instruction as needed.

Recompile and create a new executable.

Coding this isn't what I am struggling with. Finding what tools to use is. I am pretty experienced with Python, but am open to using any language to patch and create a new executable automatically. Has anyone automated a workflow like this before? I know this stack exchange should be more geared towards specific reverse engineering questions, but I figured this might be the best place to post my question. Thanks to all of those who reply in advance.


问:
Is this executable packed, encrypted or what?
I have an executable that I'd like to patch, but I'm very new to RE. I some have assembly knowledge of x86 as first learned language last year, but not of this one: PowerPC (in this case is PPC32), which I will learn when needed to patch the program.

But I think the main problem on me understanding what's this is that I've never seen a packed or encrypted (well, maybe encrypted). But I have no idea how to know which one is the case - or if it's another thing. I once asked a person and they told me it might be packed. Another one said it might be encrypted. Is there any way of knowing which one it could be, or if it's another which I don't know about?

Image of the beggining of the file in IDA's Graph view (was vertical, but it would take too much space):

Image of random part of the file, in IDA's Text view:

Can it be seen from there what's the problem with it? There's almost no code. And the developer said it was protected, so the program is not meant to be like this. But I have no idea what all those numbers mean. Never saw anything like that (only patched one program by now and was very easy, but still very cool to do).

Bellow MUCH of that red stuff are strings. Above it's the first picture. If it helps in any way, the file format is PRX for PS3 (https://www.psdevwiki.com/ps3/PRX) - don't worry, the program is not official. It's one of the unofficial programs made for unlocked PS3s by the community. But I'd like to patch something on it, as it's not working and I may know the problem, but the developer is not available to help anymore.

Thanks in advance for any help!


问:
Jumping to a specific logation for DLL injection : OllyDbg
Hypothetically,  If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates:
Can I call a jmp function like "xyz-volatile(jmp 0x1100000);" to jump to the space before the sandbox initiates?</p>


问:
Tracing all (or most of) function calls in a specific Android app
I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call, in JNI, that makes (IIRC Android itself "calls" it, not the app, the app just makes it) a specific Toast. And try to hook on that function that makes it, for example with Frida's Interceptor.

The problem is, that I haven't found a way to trace all function calls. I used some tips, like using frida-trace and tracing "Java_*" (where * is a wildcard) calls. But as this app probably has non-standard JNI calls (IIRC dynamically loading JNI libraries, where function names can have any name).

Then I used a tool called jnitrace, which I found available open source on GitHub. This tool didn't report any functions at all. Until I opened a WebView in the app. Then it started printing out lots and lots of data referencing to the Chromium library, even after I stopped using the WebView.

I found out about Frida's Stalker, but using some scripts that say "to print all function calls" just crash the app. Any app, so I think it's not the problem of the specific app I'm reverse engineering.


问:
Why do some antiviruses hook x64 Ntdll in WOW64 process?
Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.</p>


问:
Restoring online functionality of an obsucure Korean PS2 horror game
Last year I posted for help in order to reverse-engineer and translate a Korean exclusive Horror game for the Playstation 2 called Mystic Nights. Here is the Original Post.

Thanks to the kind folks here as well as a lot of trial and error, I finally finished the translation 6 or so months ago.

The game has an online mode to play with Friends [Network Mode] but Sony's korean servers for this game have been down for several years. Is there a way to ge this mode working again with hamachi or something? Any help would be greatly appreciated. There is no footage online about this game's multiplayer mode so this is very interesting.


问:
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:

```<code>#include <idc.idc>

static main()
{
    for (i=0; i<10; i++)
    {
        PauseProcess();

        GetDebuggerEvent(WFNE_SUSP, -1);
        Message("%s\n", GetFunctionName(ScreenEA()));

        ResumeProcess();

        //Sleep(50);                      //does not work, see remarks below
        //GetDebuggerEvent(WFNE_SUSP, 1); //same
    }
}
</code>```

The main idea is to pause/resume process at regular intervals and check what is the current function (for profiling purposes).

What I am searching for is a IDC function that will pause the script for a given amount of time (eg : 50ms) while the process will be still running. A function that would resume debugged process execution from a suspended state and run code for a given amount of time will be OK too.

What I have tried so far :

Sleep(time) : does not works as expected as it stop the execution of the debugged process as well (which is not what I want). I would like process to continue running while script is waiting.

GetDebuggerEvent(WFNE_SUSP, 1) : idea is wait for suspend event (which will never happen) and use timeout (set to 1 second here). It works but the issue is time is specified in seconds which is a too big interval (it would have been OK if I could specify it in milliseconds).


问:
How to download restricted backup config file on HG8245H router
I have HG8245H router and I want to download backup config file to which I dont have access as regular user in my case its caled root. So I downloaded firmware of my router and extracted it using binwalk and found .asp files in particlar cfgfile.asp and cfgfileroot.asp. Cfgfile.asp contain this snippet of java code below which is missing in page from where I should download configs so I opened `Inspect Elements in Firefox and add it in side java tags

```<code>function backupSetting() {

    var Form = new webSubmitForm();
    Form.setAction('cfgfiledown.cgi?&RequestFile=html/management/cfgfile.asp');
    Form.addParameter('x.X_HW_Token', getValue('onttoken'));
    Form.submit();
}
</code>```

Also cfgfileroot.asp had missing html code so I added that to after regular code

```<code>  <table width="100%" height="5" border="0" cellpadding="0" cellspacing="0">
    <tr>
      <td> </td>
    </tr>
  </table>
  <table width="100%" cellpadding="0" cellspacing="0">
    <tr>
      <td> <input style="width:150px" class="submit" name="saveconfigbutton" id="saveconfigbutton" type='button' onClick='SaveSetting()' BindText="s0709"> </td>
      <td> <input style="width:150px" class="submit" name="btnsaveandreboot" id="btnsaveandreboot" type='button' onClick='SaveandReboot()' BindText="s070a"> </td>
    </tr>
  </table>
</div>
<table width="100%" height="18" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td> </td>
  </tr>
</table>
<script language="JavaScript" type="text/javascript">
    if(curUserType != sysUserType)
    {
        document.write('<div id="downloadConfig" style="display:none"> ');
    }
    else
    {
        document.write('<div id="downloadConfig"> ');
    }
</script>

  <table width="100%" border="0" cellspacing="0" cellpadding="0">
    <tr>
      <td class="prompt">
        <table width="100%" border="0" cellspacing="0" cellpadding="0">
          <tr>
            <td class="title_common" BindText="s070b"></td>
          </tr>
        </table>
      </td>
    </tr>
  </table>
  <table width="100%" height="5" border="0" cellpadding="0" cellspacing="0">
    <tr>
      <td> </td>
    </tr>
  </table>
  <table width="100%" cellpadding="0" cellspacing="0">
    <tr>
      <td>
        <input class="submit" style="width:220px" name="downloadconfigbutton" id="downloadconfigbutton" type='button' onClick='backupSetting()' BindText="s070c" >
      </td>
    </tr>
  </table>
</div>
<form action="cfgfileupload.cgi?RequestFile=html/management/reset.asp&FileType=config&RequestToken=<%HW_WEB_GetToken();%>" method="post" enctype="multipart/form-data" name="fr_uploadSetting" id="fr_uploadSetting">

<script language="JavaScript" type="text/javascript">
    if(curUserType != sysUserType)
    {
        document.write('<div id="uploadConfig" style="display:none">');
    }
    else
    {
        document.write('<div id="uploadConfig">');
    }
</script>

    <table width="100%" height="10%" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td class="prompt">
          <table width="100%" border="0" cellspacing="0" cellpadding="0">
            <tr>
              <td class="title_common" BindText="s070d"></td>
            </tr>
          </table>
        </td>
      </tr>
    </table>
    <table width="100%" height="5" border="0" cellpadding="0" cellspacing="0">
      <tr>
        <td> </td>
      </tr>
    </table>
    <table>
      <tr>
        <td BindText="s070e"></td>
        <td>
            <div class="filewrap">
            <div class="fileupload">
              <input type="hidden" name="onttoken" id="hwonttoken" value="<%HW_WEB_GetToken();%>">
              <input type="text" id="f_file" autocomplete="off" readonly="readonly" />
              <input type="file" name="browse" id="t_file" size="1"  onblur="StartFileOpt();" onchange="fchange();" />
              <input id="btnBrowse" type="button" class="submit" BindText="s070f" />
            </div>
            </div>
        </td>
        <td> <input class="submit" name="btnSubmit" id="btnSubmit" type='button' onclick='uploadSetting();' BindText="s0710" /> </td>
      </tr>
    </table>
  </div>
</form>

<script>
var all = document.getElementsByTagName("td");
for (var i = 0; i < all.length; i++)
{
    var b = all[i];
    var c = b.getAttribute("BindText");
    if(c == null)
    {
        continue;
    }
    b.innerHTML = ssmpLanguage[c];
}

var all = document.getElementsByTagName("input");
for (var i = 0; i < all.length; i++)
{
    var b = all[i];
    var c = b.getAttribute("BindText");
    if(c == null)
    {
        continue;
    }
    b.value = ssmpLanguage[c];
}
</script>
</code>```

Here is how it look's modified

After that I gone from this page displayed below

to

But when I click Downlod configuration file nothing happens :(

If you have HG8245 or HG8245H plese log in as in my case telecomadmin or user with wich you can access to backup config and send me content of https://192.168.100.1:80/html/managment/cfgfileroot.asp that page


问:
Adding an export entry into dll file
There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can  access those items but since is a binary file any edit to it would lead to a crash. I have no knowledge in reverse engineering but i need to add several items into export table of this dll in order to remove the current limitation that i am stuck with. as i understand i must use a hex editor and first edit something called "ExportDirectory.NumberOfFunctions" which i am unable to find. Probably because i am looking in the wrong direction.

I understand there is no easy way to do this, so i am open to learning if is not possible to do this using any tools.

Regards

Title: Adding an export entry into dll file


问:
Is there a way to replace the load method in an objective c class with a stub method in a mach-o binary?
I am learning about parsing and editing mach-o files and I am stuck on particular issue.

I am able to read the segments and sections within a binary which is a test iOS app written in Objective-C. I am looking for a way to replace the load method in a class with a stub method e.g my_load in another class within the same binary. Is there a way to do this? Any help would be much appreciated.


问:
Ghidra SDK Register TypeFlags are not populated
I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the decision without using the name of the register, since that depends on the architecture).

So for instance if there is this P-Code Op:
INT_ADD (register, 0x20, 8) , (const, 0xffffffffffffffc8, 8)

The first parameter is in reality RSP because this operation calculates the offset of a variable on the stack. So my goal is to find an architecture-independent way to ask Ghidra whether this register is the stack or the base pointer.

I looked at the Register class in Ghidra and it seems that Register instances should have an attribute called typeFlags, that could be used to ask what kind of register it is:

```<code>public class Register implements java.io.Serializable, Comparable<Register> {

    private static final List<String> EMPTY_COLLECTION = new ArrayList<>();

    private final static long serialVersionUID = 1;
    public final static int TYPE_NONE = 0; // nothing special
    public final static int TYPE_FP = 1; // frame pointer
    public final static int TYPE_SP = 2; // stack pointer
    public final static int TYPE_PC = 4; // program counter
    public final static int TYPE_CONTEXT = 8; // processor state
    public final static int TYPE_ZERO = 16; // Register is always zero
    public final static int TYPE_HIDDEN = 32; // Register should not be exposed to users.
    public final static int TYPE_DOES_NOT_FOLLOW_FLOW = 64; // Register value should NOT follow disassembly flow

    /** Register can be used in SIMD operations **/
    public final static int TYPE_VECTOR = 128;

    private String name;
    private String description; // description of the register
    private Address address; // smallest address containing bits for this register
    private int numBytes;
    private int leastSigBit;
    private int bitLength;
    private int typeFlags; // type of register
    private boolean bigEndian;
</code>```

So I wrote a function that converts the Varnode to a Register instance using the 'Language' of the analysed binary and checks the typeFlags:

```<code>        /*
         *  Checks if the varnode is a stack or a frame pointer, depending on the language in use
         */
        public Boolean isStackRegister(Varnode input) {
            if (input.isRegister()) {
                Register reg = language.getRegister(input.getAddress(), input.getSize());
                printf("XXX %s %s\n", language.toString(), input.toString(language));
                int typeFlags = reg.getTypeFlags();
                // check if the register is either a frame pointer or a stack pointer
                if ((typeFlags & Register.TYPE_SP) != 0 || (typeFlags & Register.TYPE_FP) != 0) {
                    return true;
                }
            }
            return false;
        }
</code>```

I was expecting the typeFlags attribute to be correctly populated, however, in the debugger, I see that it is set to 0 even if it is the RSP:

For me, this feels like a Ghidra bug or a not implemented feature.

Anybody know how to get the typeFlags working, or any other way to check whether a register is a Stack or Base pointer, without using its name?


问:
Disassembler with pixel/bitmap view
I am looking for an ARM disassembler that runs on Linux that has a graphic "pixel" or "bitmap" view like the one shown in the pictures below:

I am reverse engineering some old Nokia firmwares using the ARM7TDMI, and I've been using for several months a disassembler called WinARM by Digicroxx seemingly made for these phones. It has a "Bitmap View" which shows each bit as a black or white pixel, which I find very useful when looking for certain memory regions with graphics. However, it is quite slow and buggy, and only works on Windows, so I'm stuck booting into a virtual machine to use this old software.

I have tried both Ghidra and Cutter, and have looked into IDA Pro, Hopper, and Binary Ninja, but have been unable to find such a feature, and I am unsure what this type of feature would be called, if it even has a name.

Do any modern disassemblers with ARM support (specifically ARMv4T) that run on Linux come with such a view, or is there a program that would allow me to view the binary file as an interactive graphic with the machine code alongside it?

Title: Disassembler with pixel/bitmap view


问:
Adding my own assembly code to x64 .exe
I have assembly code like this:

```<code>   142cccc0c c7 43 18        MOV        dword ptr [RBX + 0x18],0x4000
             00 40 00 00
   142cccc13 e8 a8 79        CALL       FUN_141a845c0                                    undefined FUN_141a845c0()
             db fe
   142cccc18 8b f0           MOV        ESI,EAX
</code>```

It's a part of some function. I'd like to add my own function call after that and pass the return value (I guess it's stored in ESI).

I saw this: adding instructions in IDA, but I'm wondering if there's any easier method?

Title: Adding my own assembly code to x64 .exe


问:
QEMU with GDB: Stepping Instruction causes Windows VM BSOD
I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing.

I have set breakpoints in GDB of the applications' OEP and some of the RIP addresses (is that even correct term?) of it's functions. However, this is where I'm tripping over.

When these functions fire, GDB pauses QEMU and I can see that the breakpoint was hit. QEMU's virtual machine is paused and I can do things like save memory dump and whatnot via the QEMU Monitor. However I wanted to see, for example, what the next address is that the function calls. So I use si to step to the next instruction. This is literally Russian roulette - it will sometimes step onto the next instruction, or cause the Win10 VM to freeze and then crash to a BSOD with either KERNEL_EXCEPTION_NOT_HANDLED or SERVICE_EXCEPTION_NOT_HANDLED, etc.

I was reading somewhere that I need to tell Windows to relax its internal stack protection by enabling "Debugging Mode" so it doesn't BSOD when I use step instruction. Is this correct or am I using the wrong GDB command that's causing Windows to BSOD?

Cheers.


问:
objdump says "64-bit address is disabled"
I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file:

```<code>48 bf 88 77 66 55 44 33 22 11
</code>```

I want to disassemble this as Intel x86-64 raw machine code. I am expecting this to show a single instruction:

```<code>movabs rdi, 0x1122334455667788
</code>```

I'm passing -mi386:x86-64 to objdump but it just gives me this error message. For comparison, with -mi386 it works but is obviously the wrong architecture:

```<code>C:\test> objdump.exe -D -b binary -mi386 test.raw

test.raw:     file format binary

Disassembly of section .data:

00000000 <.data>:
   0:   48                      dec    %eax
   1:   bf 88 77 66 55          mov    $0x55667788,%edi
   6:   44                      inc    %esp
   7:   33 22                   xor    (%edx),%esp
   9:   11                      .byte 0x11
</code>```

Versus:

```<code>C:\test> objdump.exe -D -b binary -mi386:x86-64 test.raw

test.raw:     file format binary

Disassembly of section .data:

00000000 <.data>:
   0:   64-bit address is disabled
</code>```

Does the MinGW build of objdump not support this architecture?


问:
"rabin2 -E" and "afll" no output for an exe file
```<code>    $ rabin2 -I test.exe
    arch     x86
    baddr    0x400000
    binsz    3229424
    bintype  pe
    bits     32
    canary   false
    retguard false
    class    PE32
    cmp.csum 0x0031d950
    compiled Fri Jun 19 18:22:17 1992
    crypto   false
    endian   little
    havecode true
    hdr.csum 0x0031d950
    laddr    0x0
    lang     c
    linenum  true
    lsyms    true
    machine  i386
    maxopsz  16
    minopsz  1
    nx       false
    os       windows
    overlay  true
    pcalign  0
    pic      false
    relocs   true
    signed   true
    sanitiz  false
    static   false
    stripped false
    subsys   Windows GUI
    va       true

    $ rabin2 -E test.exe
        [Exports]

        nth paddr vaddr bind type size lib name
        ________________________________________

$ radare2 test.exe
 -- Enhance your graphs by increasing the size of the block and graph.depth eval variable.
[0x0040a5f8]> afll
[0x0040a5f8]>
</code>```

Can anyone say why there is no output when execute rabin2 -E test.exe and afll ?
What should I try next?
I am a total beginner, in using radare2/rabin2.

Regards.


问:
IDA pro and Bochs Debugger
I am debugging a shellcode in IDA Pro

```<code>IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2
</code>```

I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want to debug it.

I am using the Bochs Debugger which is installed on the same machine as the IDA Pro.

I load the shellcode from a text file as a Binary File and the Loading Segment is set to: 0x00000000 and Loading offset to: 0x00000000

```<code>seg000:00000000                 db 0FFh
seg000:00000001                 db 0FEh ; ¦
seg000:00000002                 db  55h ; U
seg000:00000003                 db 0EBh ; d
seg000:00000004                 db  6Eh ; n
seg000:00000005                 db  33h ; 3
seg000:00000006                 db 0C0h ; +
seg000:00000007                 db  64h ; d
</code>```

The actual code starts from the offset, 0x02 so, I press C and it displays the correct disassembly

```<code>seg000:00000000                 db 0FFh
seg000:00000001                 db 0FEh ; ¦
seg000:00000002 ; ---------------------------------------------------------------------------
seg000:00000002                 push    ebp
seg000:00000003                 jmp     short loc_73
seg000:00000005
seg000:00000005 ; =============== S U B R O U T I N E =======================================
seg000:00000005
seg000:00000005
seg000:00000005 sub_5           proc near               ; CODE XREF: sub_AE+6p
seg000:00000005                 xor     eax, eax
</code>```

now, I select "Local Bochs Debugger", select the code starting from offset, 0x2 and press F9.

It gives the error: "**Failed to map a database segment to virtual address, 00000000. This usually happens if the debugged program has segments that overlap with BOCHS loader segments**".

So, I reload the shellcode from the text file and this time set the Loading Segment to: 0x00400000 and leave the Loading Offset set as: 0x00000000

now, when I repeat the steps above, it tries to launch the Bochs Debugger (I just get a busy icon, so I guess it is attempting to launch the Bochs Debugger) and after few seconds, gives me the warning:

```<code>"Failed to run bochs with: C:\Program Files (x86)\Bochs-2.6.2\bochsdbg.exe" -f "C:\shellcodes\shellcode.bochsrc" -q

Please make sure that BOCHS is configured properly:
1. You are using bochsdbg.exe executable
2. You are using a supported version of BOCHS."
</code>```

ContentLicense: CC BY-SA 3.0

Title: IDA pro and Bochs Debugger


问:
Print write and comment into .gdbinit file
Is there any way how to write comment into gdb file?

b*0x1111 # break point at function
or
b*0x1111 // break point at function
or b*0x1111 ; break point at function
That return an error .

Or maybe is there a way to print for screen output like

write('hi!') or display('hi!') doesn't work


问:
Pin DBI tool - Create executable
I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable.

I mean, rather than creating a module and forcing people to download Pin + the module, is it possible to directly create a tool (executable)?

Title: Pin DBI tool - Create executable


问:
Android app leaking data
While going through the app analysis i found that when i use logcat it shows me encrypted data ..now the app is obfuscated ... When i use burp suite with my android emulator it was making a POST request to a method of an api in form of JSON Array (Encrypted)...is there any way that i can decrypt this text or find decryption key?

Also i have found that after deobfuscating i found a method named as void decode() but it doesnt reveal any information..so is there is anyway to use this method explicitly?

Title: Android app leaking data


问:
Calculate stack layout with Ida Python
In Arm in the beginning of function

```<code>push r4-r6,lr
sub sp sp 0x4
</code>```

In the end of function

```<code>pop r4-r6,pc
add sp sp 0x4
</code>```

That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , related to caller function

How do calculate it with Ida Python? I mean calc the offset of stack between 2 function

idc.get_func_attr(ea, idc.FUNCATTR_FRSIZE) retudn only the size of local var, that didn't calculate the size of registers that push to stack

Title: Calculate stack layout with Ida Python


问:
Need help learning to extract and modify PS1 ISO files
I was wanting to make a randomizer for a playstation game, Parasite Eve 2.

I've spent a ton of time trying to figure this out just googling around and eventually wound up here.
Does anyone have an idea of a good starting point for me to just begin learning how to do that? I'm not sure how to extract files or modify them on the ISO. I'm not trying to change models or anything like that. Just swap around some internal IDs like putting a gun where a coke can is supposed to be.

Honestly, I'm not even really sure what to ask for help doing. I've been doing a lot of work in cheat engine and hex editing stuff but that only takes you so far.
I posted this same question to the reverse engineering reddit, but it mentioned posting here as well so I did.


问:
IDA error: "write access to const memory has been detected"
I'am a newbie of IDA and after disassably a file I get this error on some subroutine:

"write access to const memory has been detected"

```<code>// write access to const memory has been detected, the output may be wrong!
_BYTE *__thiscall sub_49D020(_BYTE *this, int a2, int a3, int a4, int a5)
{
  _BYTE *v5; // esi

  v5 = this;
  sub_45C210(a2, a3, a4, a5);
  *(_DWORD *)v5 = &off_4DE648;
  ++dword_5BB8D4;
  v5[68] = 1;
  if ( dword_5BBDD0 )
  {
    if ( dword_5BBD70 )
      sub_41CBE0();
    sub_485810(*(_DWORD *)(dword_5BBDD0 + 28));
  }
  return v5;
}

.text:0049D020 ; =============== S U B R O U T I N E =======================================
.text:0049D020
.text:0049D020
.text:0049D020 sub_49D020      proc near               ; CODE XREF: sub_412400+35↑p
.text:0049D020                                         ; sub_42A080+34↑p ...
.text:0049D020
.text:0049D020 var_10          = dword ptr -10h
.text:0049D020 var_C           = dword ptr -0Ch
.text:0049D020 var_4           = dword ptr -4
.text:0049D020 arg_0           = dword ptr  4
.text:0049D020 arg_4           = dword ptr  8
.text:0049D020 arg_8           = dword ptr  0Ch
.text:0049D020 arg_C           = dword ptr  10h
.text:0049D020
.text:0049D020 ; FUNCTION CHUNK AT .text:004D9650 SIZE 00000008 BYTES
.text:0049D020
.text:0049D020                 push    0FFFFFFFFh
.text:0049D022                 push    offset SEH_49D020
.text:0049D027                 mov     eax, large fs:0
.text:0049D02D                 push    eax
.text:0049D02E                 mov     large fs:0, esp
.text:0049D035                 push    ecx
.text:0049D036                 mov     eax, [esp+10h+arg_C]
.text:0049D03A                 mov     edx, [esp+10h+arg_4]
.text:0049D03E                 push    esi
.text:0049D03F                 mov     esi, ecx
.text:0049D041                 mov     ecx, [esp+14h+arg_8]
.text:0049D045                 push    eax
.text:0049D046                 mov     eax, [esp+18h+arg_0]
.text:0049D04A                 push    ecx
.text:0049D04B                 push    edx
.text:0049D04C                 push    eax
.text:0049D04D                 mov     ecx, esi
.text:0049D04F                 mov     [esp+24h+var_10], esi
.text:0049D053                 call    sub_45C210
.text:0049D058                 mov     dword ptr [esi], offset off_4DE648
.text:0049D05E                 mov     ecx, dword_5BB8D4
.text:0049D064                 inc     ecx
.text:0049D065                 mov     [esp+14h+var_4], 0
.text:0049D06D                 mov     dword_5BB8D4, ecx
.text:0049D073                 mov     byte ptr [esi+44h], 1
.text:0049D077                 mov     eax, dword_5BBDD0
.text:0049D07C                 test    eax, eax
.text:0049D07E                 jz      short loc_49D09D
.text:0049D080                 mov     ecx, dword_5BBD70
.text:0049D086                 test    ecx, ecx
.text:0049D088                 jz      short loc_49D08F
.text:0049D08A                 call    sub_41CBE0
.text:0049D08F
.text:0049D08F loc_49D08F:                             ; CODE XREF: sub_49D020+68↑j
.text:0049D08F                 mov     ecx, dword_5BBDD0
.text:0049D095                 mov     ecx, [ecx+1Ch]
.text:0049D098                 call    sub_485810
.text:0049D09D
.text:0049D09D loc_49D09D:                             ; CODE XREF: sub_49D020+5E↑j
.text:0049D09D                 mov     ecx, [esp+14h+var_C]
.text:0049D0A1                 mov     eax, esi
.text:0049D0A3                 mov     large fs:0, ecx
.text:0049D0AA                 pop     esi
.text:0049D0AB                 add     esp, 10h
.text:0049D0AE                 retn    10h
.text:0049D0AE sub_49D020      endp
</code>```

Can you please help me to solve this problem ?

Thanks !


问:
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.

so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX " and these execute all functions.
I was able to find some functions by referenced string but this particular function, I just can't, any name I guess ends up wrong.

I want to unlock upgrades. I tried Cheat Engine's Ultimap and found nothing ( except the saving function which saves when a different addon/upgrade is selected ). it seems the checking function is run constantly maybe with different arguments.

so as the calling routine is like this I cant trace back. it's so confusing. there was another game by this engine ( Just Cause 4 ) where I could trace back a string like " X is locked" and reach the deciding code but this one is just driving me crazy.

I think the game uses Vtable but can't find it (i think even if I do, I need leaked SDK and symbols to recognize functions) I tried the IDA pro 7.5+ plugins with no luck.

there are also strings like " bla-bla\bla-bla\XXX_unlock_condition.gsr" and i don't know if they are packed within exe (denuvo protected) or packed within .arc and .tab files. and if it's possible to dump them.


问:
Decompressing XML file with unknown compression method
Would there be anyway at all to determine the compression method used for this XML file given only the compressed XML?

I've looked into different XML compression methods such as EXI, but can't seem to be able to decode this.

It's a vehicle XML file from the game stormworks, they recently updated the game so dedicated servers compress vehicle files to save storage space and for faster file transfer times between the server and clients. We had planned to create a sub-system of our server management program that parsed the blocks used in the vehicle to determine what blocks and how many were used.

Here is the compressed XML in plain text: https://pastebin.com/zSg7DrF3 and on dropbox: https://www.dropbox.com/s/yufpcxxx8utuo57/vehicle.bin?dl=0

Thanks


问:
Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset
I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP.

The device has a custom android repo that doesn't allow me to install apps or anything of that nature, so I can't go that route.

I'm trying to do a readback of the preloader partition with spflash tool, then use WwR to generate the scatter. The details of how this works can be found here. It's pretty simple.

When I attempt the readback, I'm getting this error:

```<code>s_dl_get_dram_setting_fail(5054)
</code>```

Everything I've read indicates that this is due to an incorrect scatter file. However, just to be safe, I used a secure boot bypass found here just to make certain that secure boot isn't the problem. With the bypass however, I get the same error.

From everything I've read, a readback is the one thing I should be able to do without the factory rom/scatter files. Which is why I'm perplexed as to why I'm getting this error when doing a simple readback.

I've even payed the tech guys at Hovatek (who were very helpful) to help work on this. We tried the newest Infinity Box with dongle as well, to no avail.

Here is the partition info in the scatter generated by WwR:

```<code>- partition_index: SYS0
partition_name: PRELOADER
file_name: preloader.bin
is_download: true
type: SV5_BL_BIN
linear_start_addr: 0x0
physical_start_addr: 0x0
partition_size: 0x80000
region: EMMC_BOOT_1
storage: HW_STORAGE_EMMC
boundary_check: true
is_reserved: false
operation_type: BOOTLOADERS
reserve: 0x00
</code>```

Seems to me the only variable properties are physical_start_addr and partition_size. However, it seems that when I look at scatter files for other mediatek chipsets, it's always either 0x80000 or 0x40000. And from what I've read this shouldn't matter just doing a readback. But I've tried both to no avail.

Does anyone know anything else I could try?? I'm even willing to try ROMs from other devices with the same chipset. At this point I don't care if I brick it.


问:
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on the screenshot).

A solution provided by escalatedquickly stated that “By debugging the program we can see where on the heap the two buffers are allocated. In my case, they are allocated at ‘0x000056050A21F670’ and ‘0x000056050A21F690’ respectively”. I’ve searched how to get these addresses, but I have only found solutions for cases when the variable names are known (e.g., here and here).

How do I find the buffers’ addresses in GDB to replicate what escalatedquickly did?


问:
Android app Viber (com.viber.voip) mitm
I want to see what viber is sending out of my android phone, I'm using mitm proxy (custom server) but the app is using certificate pining to detect the proxy and close the connection after the handshake is done.

I know the basic method of patching OkHttp's CertificatePinner.
The problem with viber is that they went to extreme lengths to hide the pinning.
Most apps I have seen were easy to patch, and the signature or the cert was not hidden.

I found around 7 keystores (bks) in the app, but no calls to CertificatePinner, no sha1/ or sha256/ signatures. am I missing something?

I also looked for Custom TrustManagers but could not find anything useful, mostly because the app is full of ads, (google, facebook, yandex, adjust.com, ...) some of these ad libraries have their own certificates and keystores

Any ideas on how the app is pinning the certificate? did I miss something?

(PS: this is for research purposes only)

Title: Android app Viber (com.viber.voip) mitm


问:
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )

The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this get_name_ea_simple('ntdll_NtCreateFile') but "module 'ntdll' has no names"

Although the call get_name_ea_simple('kernel32_CreateFileW') works just fine: 0x770d08d0
(if debugger paused on executable EP)

And here is second problem - exec script commands after debugger loads all modules info.
If I do something like:

```<code>run_to(get_inf_attr(INF_MIN_EA)) # start the debugger and execute to the entry point
CreateFileW = get_name_ea_simple('kernel32_CreateFileW')
    if CreateFileW == BADADDR:
        warning('kernel32_CreateFileW is null')
        return
</code>```

I'll get my warning.
So how to do it right?

IDA 7.5

Added

I found out that if we stop at the entry point and manually load symbols for ntdll, then the following command works get_name_ea_simple('ZwCreateFile')

Title: IDAPython NtCreateFile


问:
How to get the functions that call or access a string in Binary Ninja?
I am reversing engineering a program. Right now I was using Hopper.
With Hopper once I find a string I can right click and I have an option call "References to ..."
that will return a list of functions that call or access this data.

When I try to use Binary Ninja. I find the string then I noticed that "Cross Reference" is empty. This is the main reason I don't use Binary Ninja but I want to use it because there are other things I really like.

Anybody knows if I have to check any specific option or do anything special to get the same result?


问:
Disassembly a win Linux file
I have a file that has a compiled assembly code and being loaded into javascript code for execution.
How can I “inspect” the file? I am aware of tools like immunity debugger or ollydbg but I am not sure they can help me here.

How can I see or evaluate the contents of that file?

OwnerDisplayName: Badddy

Title: Disassembly a win Linux file


问:
propagate manually set types to redefine a function in IDA pro?
Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments?

for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 variables to something else, i have to again manually do this inside the function as well, and so on.. is there anyway to fix this? i tried reanalyzing but still they didnt propagate


问:
Load an IDB file when debugging kernel to get the function names in IDA?
I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.

Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded location in kernel so i can get their function names? there are multiple IDB files that can get loaded anywhere in memory.


问:
Confusion about if statement in disassembly
I recently got into reverse engineering applications for fun. Can someone please help me with this if statement.

```<code>140005914  75  38         JNZ       LAB_14000594e
140005916  48  8b  4      MOV       RCX, qword ptr [RSP + 0x58]
14000591b  48  8d  0      LEA       RAX, [s_ELECTRON_ENABLE_LOGGING_1460]      ;  = "ELECTRON_ENABLE_LOGG
140005922  48  8d  5      LEA       RDX, [RSP + 0x48]
140005927  48  89  02     MOV       qword ptr [RDX], RAX => s_ELECTRON_ENA    ;  = "ELECTRON_ENABLE_LOGG
14000592a  48  c7  4      MOV       qword ptr [RDX + 0x8], 0x17
140005932  48  8b  01     MOV       RAX, qword ptr [RCX]
140005935  ff  50  10     CALL      qword ptr [RAX + 0x10]
140005938  84  c0         TEST      AL, AL
14000593a  75  12         JNZ       LAB_14000594e
14000593c  c7  44  2      MOV       dword ptr [RSP + 0x60], 0x0
140005944  b9  04  0      MOV       ECX, 0x4
140005949  e8  02  7      CALL      FUN_14256cd50                              ;  undefined FUN_14256cd50
</code>```

Which according to Ghidra decompiles to the following.I would like to change it from =='\0' to =='\1'. I know Test AL, AL is doing a comparison, but where does the 0 in the if statement comes from?

```<code>if ((char)uVar8 == '\0') {
    pcStack144 = "ELECTRON_ENABLE_LOGGING";
    uStack136 = 0x17;
    cVar4 = (**(code **)(*ppcStack128 + 0x10))();
    if (cVar4 == '\0') {
      auStack120[0] = 0;
      FUN_14256cd50(4);
    }
  }
</code>```

Thanks in advance.


问:
Program closes when running Charles proxy
I came across an program that closes itself when I run Charles proxy and if I'm running charles before the progran it won't run. Anyone know what type of security if this and can it be reversed?

Thanks in advance


问:
API-Monitor not logging buffer
I have a problem with API-Monitor.

When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't show the buffer. I really don't know why this is happening. Both buffers reside in a valid memory space before and after the call.

I think its either because API-Monitor doesn't recogonize the size of the buffer and therefore doesn't capture the content or it only monitors const char* types of buffers (idk why but thats the difference between the singature of the two functions).

Here are some images:

it works with send(). It logs all the data that was sent

and here it says "Not Avaliable". Nothing shows up in the buffer-viewer. The return-value ist 5 so we can be sure that actually data was written into the buffer.

Title: API-Monitor not logging buffer


问:
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?

File Link


问:
Reverse engineering PS2 Naruto 3D Model Format
As a personal project, I've been trying to reverse engineer the model for a Naruto PS2 game, but to no success in trying to visualize vertex data and faces with Model Ressearcher, and the .OBJ extraction using PCSX2 didn't work either, since it uses culling. Could you guys please help me out? thanks in advance.

Samples: https://drive.google.com/file/d/1AIwxQT7cg9l2PO1N_0zm1rXhUpyp1y0_/view?usp=sharing


问:
Patching a program in IDA
I've opened a simple Hello World program in IDA (Pro 7.5) like that:

```<code>    global  _main
    extern  _printf

    section .text
_main:
    push    message
    call    _printf
    add     esp, 4
    push    message2
    call    _printf
    add     esp, 4
    ret
message:
    db  'Hello, World 1', 0xD, 0xA, 0
message2:
    db  'Hello, World 2', 0xD, 0xA, 0
</code>```

Now i've made a simple detour - moved the code and data definition to the unused end of the code segment like this:

```<code>str1  db 'Hello, World1',0Dh,0Ah,0
                                         ; DATA XREF: .text:detour↓o
str2  db 'Hello, World2',0Dh,0Ah,0
                                         ; DATA XREF: .text:00404057↓o
str3  db 'Hello, World3',0Dh,0Ah,0
                                         ; DATA XREF: .text:00404064↓o↓o
      db    0
      db    0
 ; ---------------------------------------------------------------------------

 detour:                                 ; CODE XREF: .text:_main↑j
   push    offset str1     ; "Hello, World 1\r\n"
   call    _printf
   add     esp, 4
   push    offset str2     ; "Hello, World 2\r\n"
   call    _printf
   add     esp, 4
   push    offset str3     ; "Hello, World 3\r\n"
   call    _printf
   add     esp, 4
   jmp     go_back
</code>```

Leaving in the main function only the jmp code like that:

```<code>_main:
  jmp detour
go_back:
  retn
</code>```

And this yeiled me a problem. The output of the patched program is :

```<code>Hello, World1

Hello, World2

Hello, World3

ABh@@Hello, World2

Hello, World3

ABh@@Hello, World3

ABh@@
</code>```

Instead just:

```<code>Hello, World 1
Hello, World 2
Hello, World 3
</code>```

It turned out that the patching process just changed the last byte of each string from "00" to "0A"(line feed char)!. There is the screenshot of the data section from IDA debugger running:

And the the code section:

That's the reason of that fucked up output. But the question is WHY does it happened?

Title: Patching a program in IDA


问:
Best way from high level software developer to malware analyst
I am a software developer with commercial experience in Python and mainly Scala working on high level programming, e.g. REST APIs, and only personal/university projects experience in C++.

I would like to work as a reverse engineer and I am very passionate about low level software. Do you believe working as a C++ developer would help in the transition to malware analyst? would it be worth it in order to achieve my goal, also considering the not increasing salary when changing job in such an horizontal way?

I would really appreciate your help given my level of confusion on how to approach this career change

Thanks in advance !!

Giulia


问:
Opened up a stick-blender to retrieve its motor but the circuit board broke. What is the circuit I should reproduce?
See question title and pictures. It’s plugged into 230v and has quite high rpm and torque. I’m trying to see if I can reuse this motor in a different application.

Edit: Looks like there is a diode on the opposite side of the capacitor as well


问:
Two different values on a register, on the same instruction? (Cheat Engine)
My situation is that I'm trying to find the send function of an online game. I found the buffer pointer and looked what accesses to it. It was obviously an instruction, which used the buffer pointer, but if I breakpoint on that instruction it doesn't contain the buffer ptr.
Why are the values different if I breakpoint?
First Picture: edx stores the adress of the buffer.
Second Picture: Breakpoint on that same exact instruction, but edx is not the same, which doesn't really make sense.