问:
UC_ERR_WRITE_UNMAPPED when emulation starts on binary
Whenever I try to emulate my obfuscated driver it fails at uc_emu_start with UC_ERR_WRITE_UNMAPPED. I get all success return codes on: uc_mem_map and uc_mem_write but when I call uc_emu_start ; I get the UC_ERR_WRITE_UNMAPPED error. So, I added a hook on the error code to see what address it was writing to and I found that it was: 0xfffffffffffffff8. I don't understand why it is writing to this address because I put 0x1000 as my base address (std::uint64_t BASE_ADDRESS = 0x1000;) which is then used at
uc_emu_start. Any help would be appreciated.

```<code>// EMU.cpp : This file contains the 'main' function. Program execution begins and ends there.
//
#include <unicorn.h>
#include "capstone/capstone.h"
#include <iostream>
#include <list>
#include <queue>
#include <iomanip>
#include "PE.h"
#include "BasicBlock.h"
#include "Optimizations.h"
#include "CCapstoneHelper.h"
static bool hook_mem_invalid(uc_engine* uc, uc_mem_type type, uint64_t address,
    int size, int64_t value, void* user_data)
{
    switch (type) {
    default:
        // return false to indicate we want to stop emulation
        return false;
    case UC_MEM_WRITE_UNMAPPED:
        printf(">>> Missing memory is being WRITE at 0x%" PRIx64
            ", data size = %u, data value = 0x%" PRIx64 "\n",
            address, size, value);
        // map this memory in with 2MB in size
        uc_mem_map(uc, 0xaaaa0000, 2 * 1024 * 1024, UC_PROT_ALL);
        // return true to indicate we want to continue
        return true;
    }
}
int main()
{
    try {
        // UNICORN
        uc_engine* uc;
       uc_err err;

        // CAPSTONE
        csh handle{};
        cs_insn* insn;
        //size_t count;
        std::queue<uint64_t> Q;
        std::map<uint64_t, bool> seen;
        std::uint64_t BASE_ADDRESS = 0x1000;

#define MEGABYTES_TO_MAP 15

        std::cout << "[+] Starting emulation..." << std::endl;
        if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle) != CS_ERR_OK) {
            throw std::runtime_error("cs_open failed");
        }

        if (uc_open(UC_ARCH_X86, UC_MODE_64, &uc) != UC_ERR_OK) {
            throw std::runtime_error("uc_open failed");
        }

        if (uc_mem_map(uc, BASE_ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL) != UC_ERR_OK) {
            throw std::runtime_error("uc_mem_map failed");
        }

        cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);

        // get pointer to file from Init()
        insn = cs_malloc(handle);
        std::cout << "[+] Finding driver entry point..." << std::endl;
       PE::CPe pe = PE::CPe::CPe("C:\\Program Files (x86)\\Driver\\Driver.sys");

       std::cout << "[+] Found: " << std::hex << pe.get_entry_point_address_relative_to_mapped_file() << std::endl;

       std::cout << "[+] Starting emulation..." << std::endl;
       BasicBlock::CBasicBlock block_buffer{};
       BasicBlock::_basic_block basic_block{};
       basic_block.start_address = pe.get_entry_point_address_relative_to_mapped_file();
    //   BASE_ADDRESS += pe.get_entry_point_file_offset();
        const std::uint8_t* addr = (std::uint8_t*) basic_block.start_address;

       // we are at entry point. Start emulation until we reach end of basic block?
       // At entrypoint, set start of basic block to entry point address.
       // Emulate until we reach a JUMP instruction
        std::cout << "[+] Removing anti-disassembly..." << std::endl;
        Optimizations::COptimizations optimizations;
        std::uint8_t anti_d_pattern[] = {0xEB, 0xFF, 0x64, 0x24, 0x08};
        std::uint64_t num_of_bytes_fixed = optimizations.remove_antidisassembly(anti_d_pattern, sizeof(anti_d_pattern), pe);

        uint64_t target = 0;
       size_t code_size = 0x1000;

       CapstoneHelper::CCapstoneHelper capstone_helper_obj;

       uc_hook hook;
       err = uc_hook_add(uc, &hook, UC_HOOK_MEM_WRITE_UNMAPPED, hook_mem_invalid, NULL, 1, 0);

       while (true) {

           std::uint64_t prev_base_address = BASE_ADDRESS;
          while (cs_disasm_iter(handle, &addr, &code_size, &BASE_ADDRESS, insn)) {
               if (capstone_helper_obj.is_cs_cflow_ins(insn)) {
                   basic_block.end_address = (std::uint64_t)addr;
                   break;
               }

           }

           std::uint32_t error;
           // write code and then some into memory
           //uc_mem_map(uc, prev_base_address, MEGABYTES_TO_MAP * 1024 * 1024, UC_PROT_ALL);
          // if (uc_mem_map(uc, BASE_ADDRESS, MEGABYTES_TO_MAP * 1024 * 1024, UC_PROT_ALL) != UC_ERR_OK) {

               err = uc_mem_write(uc, prev_base_address, reinterpret_cast<void*>(basic_block.start_address), (basic_block.end_address - basic_block.start_address));
               if (err != UC_ERR_OK) {
                  throw std::runtime_error("uc_mem_write failed");
              }

            // resolve file offset from base_address;

               err = uc_emu_start(uc, prev_base_address, prev_base_address + (basic_block.end_address - basic_block.start_address) , 0, 0);
               if (err != UC_ERR_OK) {
                   throw std::runtime_error("uc_emu_start failed");
               }

               /* TODO:
               1. Write anti-disassembly remover because capstone won't properly disassemble.
               Anti disassembly byte string: EB FF 64 24 08 (Removing EB byte results in " jmp    QWORD PTR [rsp+0x8]"
               Use file pointer to do operations before we disassemble with capstone.
               2. Add check for control flow instructions (look at PBA)
               */

       }

        uc_close(uc);
        cs_close(&handle);

    }
    catch (std::exception& e) {
        std::cout << "Error: " << e.what();
        getchar();
        std::abort();
    }

        return 0;
}
</code>```


问:
How does windbg correctly resolve symbol addresses for optimised code?
When you debug optimised code, I know that address arithmetic doesn't work correctly:

```<code>0:004> u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69
u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69
dwmcore!CPartitionVerticalBlankScheduler::PresentFrame+0x15:
000007fe`f97420f1 81eca0000000    sub     esp,0A0h
000007fe`f97420f7 33db            xor     ebx,ebx
000007fe`f97420f9 458ad1          mov     r10b,r9b
000007fe`f97420fc 418be8          mov     ebp,r8d
000007fe`f97420ff 488bf2          mov     rsi,rdx
000007fe`f9742102 488bf9          mov     rdi,rcx
000007fe`f9742105 389a10010000    cmp     byte ptr [rdx+110h],bl
000007fe`f974210b 740c            je      dwmcore!CPartitionVerticalBlankScheduler::PresentFrame+0x26d (000007fe`f9742119)
</code>```

Offset 0x69 from dwmcore!CPartitionVerticalBlankScheduler::WaitForWork is actually in another function. So how does windbg manage to correctly apply the dwmcore!CPartitionVerticalBlankScheduler::PresentFrame symbol to an offset 0x54 from dwmcore!CPartitionVerticalBlankScheduler::WaitForWork when the pdb clearly must contain another address for the symbol that is at a much greater offset than 0x54 for the original unoptimised code?

When you disassemble the WaitForWork function, it somehow manages to resolve the original offsets such that you can see what dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69 really means

```<code>uf dwmcore!CPartitionVerticalBlankScheduler::WaitForWork
dwmcore!CPartitionVerticalBlankScheduler::WaitForWork:
000007fe`f9742088 48895c2408      mov     qword ptr [rsp+8],rbx
000007fe`f974208d 57              push    rdi
000007fe`f974208e 4883ec20        sub     rsp,20h
000007fe`f9742092 833d6ba50d0000  cmp     dword ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x24 (000007fe`f981c604)],0
000007fe`f9742099 488bd9          mov     rbx,rcx
000007fe`f974209c 48bf0100000000000080 mov rdi,8000000000000001h
000007fe`f97420a6 0f856bfc0600    jne     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x20 (000007fe`f97b1d17)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x5c:
000007fe`f97420ac 488b4b18        mov     rcx,qword ptr [rbx+18h]
000007fe`f97420b0 488d5370        lea     rdx,[rbx+70h]
000007fe`f97420b4 e8b7f1ffff      call    dwmcore!CPartitionManager::GetWork (000007fe`f9741270)
000007fe`f97420b9 833d44a50d0000  cmp     dword ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x24 (000007fe`f981c604)],0
000007fe`f97420c0 8bd8            mov     ebx,eax
000007fe`f97420c2 0f859dfc0600    jne     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x74 (000007fe`f97b1d65)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0xb4:
000007fe`f97420c8 8bc3            mov     eax,ebx
000007fe`f97420ca 488b5c2430      mov     rbx,qword ptr [rsp+30h]
000007fe`f97420cf 4883c420        add     rsp,20h
000007fe`f97420d3 5f              pop     rdi
000007fe`f97420d4 c3              ret

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x20:
000007fe`f97b1d17 8a05eba80600    mov     al,byte ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x28 (000007fe`f981c608)]
000007fe`f97b1d1d 3c04            cmp     al,4
000007fe`f97b1d1f 7308            jae     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x2e (000007fe`f97b1d29)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x2a:
000007fe`f97b1d21 84c0            test    al,al
000007fe`f97b1d23 0f858303f9ff    jne     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x5c (000007fe`f97420ac)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x2e:
000007fe`f97b1d29 48853dc0a80600  test    qword ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x10 (000007fe`f981c5f0)],rdi
000007fe`f97b1d30 0f847603f9ff    je      dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x5c (000007fe`f97420ac)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x37:
000007fe`f97b1d36 488b0dbba80600  mov     rcx,qword ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x18 (000007fe`f981c5f8)]
000007fe`f97b1d3d 488bc1          mov     rax,rcx
000007fe`f97b1d40 4823c7          and     rax,rdi
000007fe`f97b1d43 483bc1          cmp     rax,rcx
000007fe`f97b1d46 0f856003f9ff    jne     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x5c (000007fe`f97420ac)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x49:
000007fe`f97b1d4c 488b0d4db10600  mov     rcx,qword ptr [dwmcore!Microsoft_Windows_Dwm_CoreHandle (000007fe`f981cea0)]
000007fe`f97b1d53 488d15e6fd0500  lea     rdx,[dwmcore!EVTDESC_SCHEDULE_WFW_Start (000007fe`f9811b40)]
000007fe`f97b1d5a e871f30100      call    dwmcore!TemplateEventDescriptor (000007fe`f97d10d0)
000007fe`f97b1d5f 90              nop
000007fe`f97b1d60 e94703f9ff      jmp     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x5c (000007fe`f97420ac)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x74:
000007fe`f97b1d65 8a0d9da80600    mov     cl,byte ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x28 (000007fe`f981c608)]
000007fe`f97b1d6b 80f904          cmp     cl,4
000007fe`f97b1d6e 7308            jae     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x83 (000007fe`f97b1d78)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x7f:
000007fe`f97b1d70 84c9            test    cl,cl
000007fe`f97b1d72 0f855003f9ff    jne     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0xb4 (000007fe`f97420c8)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x83:
000007fe`f97b1d78 48853d71a80600  test    qword ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x10 (000007fe`f981c5f0)],rdi
000007fe`f97b1d7f 0f844303f9ff    je      dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0xb4 (000007fe`f97420c8)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x8c:
000007fe`f97b1d85 488b0d6ca80600  mov     rcx,qword ptr [dwmcore!Microsoft_Windows_Dwm_Core_Provider_Context+0x18 (000007fe`f981c5f8)]
000007fe`f97b1d8c 488bc1          mov     rax,rcx
000007fe`f97b1d8f 4823c7          and     rax,rdi
000007fe`f97b1d92 483bc1          cmp     rax,rcx
000007fe`f97b1d95 0f852d03f9ff    jne     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0xb4 (000007fe`f97420c8)

dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x9e:
000007fe`f97b1d9b 488b0dfeb00600  mov     rcx,qword ptr [dwmcore!Microsoft_Windows_Dwm_CoreHandle (000007fe`f981cea0)]
000007fe`f97b1da2 488d15a7fd0500  lea     rdx,[dwmcore!EVTDESC_SCHEDULE_WFW_Stop (000007fe`f9811b50)]
000007fe`f97b1da9 448bc3          mov     r8d,ebx
000007fe`f97b1dac e8e3240200      call    dwmcore!Template_q (000007fe`f97d4294)
000007fe`f97b1db1 90              nop
000007fe`f97b1db2 e91103f9ff      jmp     dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0xb4 (000007fe`f97420c8)
</code>```

You can see that offset 0x69 from WaitForWork really means offset 0x31. So why does windbg just not detect that it is optimised and recalculate offsets to avoid the confusion and just say 0x31 in the stack trace as the symbol name, it clearly has the ability to do so. Furthermore, how does it even get the original symbol (symbol offset) for the address right (which was my first question). Does it compare instruction bytes? I found this link but it only tells you what happens, which I already know, and not how.

ContentLicense: CC BY-SA 4.0


问:
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:

```<code>.text:00488DA0 ; =============== S U B R O U T I N E =======================================
.text:00488DA0
.text:00488DA0 ; Attributes: bp-based frame
.text:00488DA0
.text:00488DA0 ; int __stdcall sub_488DA0(int, int, int, char, int, float, float, float, int)
.text:00488DA0 sub_488DA0      proc near               ; CODE XREF: sub_4853C0+53↑p
.text:00488DA0                                         ; sub_489270+43↓p ...
.text:00488DA0
.text:00488DA0 var_8           = dword ptr -8
.text:00488DA0 var_4           = dword ptr -4
.text:00488DA0 arg_0           = dword ptr  8
.text:00488DA0 arg_4           = dword ptr  0Ch
.text:00488DA0 arg_8           = dword ptr  10h
.text:00488DA0 arg_C           = byte ptr  14h
.text:00488DA0 arg_10          = dword ptr  18h
.text:00488DA0 arg_14          = dword ptr  1Ch
.text:00488DA0 arg_18          = dword ptr  20h
.text:00488DA0 arg_1C          = dword ptr  24h
.text:00488DA0 arg_20          = dword ptr  28h
.text:00488DA0
.text:00488DA0                 push    ebp
.text:00488DA1                 mov     ebp, esp
.text:00488DA3                 sub     esp, 8
.text:00488DA6                 push    ebx
.text:00488DA7                 mov     ebx, dword ptr [ebp+arg_C]
.text:00488DAA                 push    esi
.text:00488DAB                 mov     esi, ecx
.text:00488DAD                 mov     [ebp+var_4], esi
.text:00488DB0                 cmp     ebx, 0FFFFFFFFh
.text:00488DB3                 jl      short loc_488DBD
.text:00488DB5                 cmp     ebx, 400h
.text:00488DBB                 jl      short loc_488DD9
.text:00488DBD
.text:00488DBD loc_488DBD:                             ; CODE XREF: sub_488DA0+13↑j
.text:00488DBD                 cmp     [ebp+arg_10], 7
.text:00488DC1                 jz      short loc_488DD9
.text:00488DC3                 push    ebx             ; char
.text:00488DC4                 push    offset a1startsoundBad ; "^1StartSound: bad edictnum %i"
.text:00488DC9                 call    sub_426A40
.text:00488DCE                 add     esp, 8
.text:00488DD1                 pop     esi
.text:00488DD2                 pop     ebx
.text:00488DD3                 mov     esp, ebp
.text:00488DD5                 pop     ebp
.text:00488DD6                 retn    24h
.text:00488DD9 ; ---------------------------------------------------------------------------

.text:00488E22 etc.....

.text:00489261 loc_489261:                             ; CODE XREF: sub_488DA0+BA↑j
.text:00489261                                         ; sub_488DA0+D5↑j ...
.text:00489261                 pop     edi
.text:00489262                 pop     esi
.text:00489263                 pop     ebx
.text:00489264                 mov     esp, ebp
.text:00489266                 pop     ebp
.text:00489267                 retn    24h
.text:00489267 sub_488DA0      endp
</code>```

here IDA pseudocode:

```<code>void __thiscall sub_488DA0(char *this, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10)
</code>```

here my code:

```<code>typedef void(__fastcall *HookFileWolfram) (char * pThis, void * EDX, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10);
void  __fastcall HookWeaponFileSubWolfram(char * pThis, void * EDX, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10)
{
    HookFileWolfram originalFunction = (HookFileWolfram)AddressOfHookSoundFunction;

    LF::Log_Update("Print values: pThis: " + SC::To_String(pThis) + " a2: " + SC::To_String(a2));

    return originalFunction(pThis,EDX,a2,a3,a4,a5,a6,a7,a8,a9,a10);
}
</code>```

and here the output:

```<code>  18/07/2022 08:32:43.860  Print values: pThis: 2O/ a2: 1143863296
  18/07/2022 08:32:42.420  Print values: pThis: G/ a2: 0
</code>```

I need to detect correctly the parameter pThis.

Can you please let me known a way to detect the pThis parameter ?

Thank you !


问:
Ida Pro can't decompile big function
I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error :

```<code>The graph is too big (more than 1000 nodes) to be displayed on the screen.
Switching to text mode.
(you can change this limit in the graph options dialog)
</code>```

What can I do to decompile that function?

Title: Ida Pro can't decompile big function


问:
Help with baml to xaml conversion?
i have used iLSpy to decompile a .NET EXE file after the process is completed. i copied the content of xaml files from iLSpy one by one, saved the as unicode files and replaced the baml files in Visual studio project.
With the binary files (baml) the program run perfectly
With the new replaced xaml files there are many compiler errors.

Where is the error exactly?

Note: the errors are related to xaml design.

all references are correct.

ContentLicense: CC BY-SA 3.0

Title: Help with baml to xaml conversion?


问:
Intercept android app DNS lookup with Frida
I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or  getaddrinfo but this does not seem to be the case. For example this Frida trace command does not hit either function

```<code>frida-trace -U -i "gethostbyname" -i "getaddrinfo" "com.android.my_app"
</code>```

According the answer to this question, the netd daemon might be responsible for DNS resolution on android

"DNS lookups are centralized in the netd daemon to allow for
system-wide caching, while apps call functions (such as getaddrinfo)
in Bionic. The query is sent over a UNIX socket to
/dev/socket/dnsproxyd to the netd daemon, which parses the request and
calls getaddrinfo again to issue DNS lookups, then caches the results
so that other apps can use them."

However hooking this daemon doesn't result in any hits either:

```<code>frida-trace -U -i "gethostbyname" -i "getaddrinfo" "netd"
</code>```

I am new to Frida so I am not sure if I am missing something here. I would appreciate some insight into how I can hook the DNS lookup call


问:
Reverse Engineering Bluetooth led strips unsuccessful
duplicate of this, and a few other kinda but nothing in any have solved my issue

I've got some phopollo bluetooth led strips that I was trying reverse engineer the bluetooth protocol for so I could control them from python code and whatnot. I've successfully captured the color change packet using btsnoop_hci from an android phone and the official Apollo lighting app and put that into wireshark to find out the color change packet is 0207000e000a00040012090056ff000000f0aa Where everything up to ff0000 (the color in rgb values 0-255) is the same followed by 00f0aa which is always the same.  Except for the second btye "07" which I have no idea what does. It changes everytime you disconnect and reconnect to the device but doesn't change in-between. it seems to only be 01-09? because so far its been 07, 05 and 02. Wireshark says its the broadcast flag but I couldn't find too much information deeper online.

Anyway I used gattool to connect to the led strips and used char-write-cmd and char-write-req to try and write the packet to handel 0x0009 which is what wireshark says it is, I tried this with every number for the second byte 00-09 but nothing changed the color of the leds. It wrote the value but nothing happened. I tried doing the same thing with the nRF connect app on my iphone and it also didn't do anything. I also tried with another byte that I thought could have been on or off but nothing there or with any other bytes I tried.


问:
Why output is disabled in console when using int3?
I am using NASM(2.15) assembler to generate code. But I am unable to figure out why it does not show output in the console(windows system) when using int3 - software breakpoint, it only shows output in the debugger console while debugging.

code:

```<code>global _main
extern _printf

section .text
_main:
    int3             ; [*] Comment/Uncomment this to enable/disable output
    push dword[esp+4]
    push fmt_d
    call _printf
    add esp, 8
    xor eax, eax
    ret

section .data
fmt_d: db 'argc = %d', 10, 0
</code>```

However, when int3 is disabled, we get output as usual in both the consoles(windows system, debugger console).

What is special about the int3 command that inhibits the printf's output capability?

I assembled and linked both cases once int3 enabled and then disabled into pf_disable.exe, pf_enable.exe using NASM & MinGW 4.8.2-gcc.exe.
Then I matched the assembly output(.asm) generated by IDA for 2 cases, but there were only 3 differences,

Hash of files(CRC,MD5) are different.

Different offset of fmt_d in the .data section, which is obvious as int3 was introduced in one case and absent in another in _main function.

.obj files for both the cases are almost same except, one has int3 while other hasn't in _main function.

With above differences, I understand it has to do something more than just int3 but I am unable to figure out.


问:
Mod Coder Pack for minecraft 1.8.8 failed to decompile
I tried to decompile minecraft 1.8.8 using MCP918 and I have an error that I cannot fix.

Here are the logs:

https://zerobin.net/?07c9671c16bc4011#g6co8FZc8RJkkQiPb6pu65HixcEORkWZGN8qHPXkHew=

Some informations:

Java development kit version:11
Os: windows 11


问:
How exactly Hex editor is used?
I'm new to reverse engineering. So I decided to start with some game files in my computer. The main goal was to understand how hex editor used to identify files and extract needed data.

In my case I have 2 .ebx files and Chunk ID file. The goal is to use the ebx to extract the data in the chunk file but I am confused. I used 010 editor template to see whether it will find any wav/mp3 data, and it did. I appreciate if someone can explain some of the stuff here and give me some good tuts where I can learn this kind reversal?

Chunk ID file

Ebx File audio

Title: How exactly Hex editor is used?


问:
Where can I get source code for ASCII graph parser?
My plan is to see source code graph in vim of doxygen.
I almost use TUI on Linux.
So, Where can I get C, Python based source code for ASCII graph parser?</p>


问:
how to find a string in memory having ARM instructions ARDP and LDR?
hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what address will be assigned to the register "x1".

my disassembly experience is very small, i will be happy for any help.

will this user's question help me? getting function address by reading ADRP and ADD instruction values


问:
Ghidra graphing questions
I'm trying to learn RE with Ghidra, and have a few Ghidra-specific questions.

Exceeded limit of 500 nods - any way to increase this threshold?

Any other way to choose which section of the code is graphed other than highlighting it? Specifically looking for a way to graph an entire program without having to jump to a non-code section.

And most importantly, using Ghidra's Calls graph, sometimes I will get a comprehensive graph including jumps to external imported functions (showing things like KERNEL32.DLL::Sleep), while other times such as in case I choose to bundle more functions in the graph resulting in more nodes, it will omit such things such as imported functions even though the calling function is still within the graph. Can I make it more comprehensive, forcing it show everything even if there are more nodes (or other factors impacting it)?

Thanks a lot :)

Title: Ghidra graphing questions


问:
Binwalk doesn't give results
I'm trying to reverse engineer a .bin file but binwalk doesn't give much information other than it says that there is a bitmap contained. The .bin file is 32 MB. Ghidra also doesn't input anything useful. Any ideas about how I can decompile a .bin file? I know that there are other tools out there for decompiling .bin files but they're not free and not for rudimentary use.</p>

Title: Binwalk doesn't give results


问:
how to find address in memory using ADRP and ADD (ARM64) instructions?

This part of the disassembler code takes the symbol "1" from memory to change i I need to know what address is assigned to the "x1" register, but the debugger does not work for me.

I have little experience in reverse engineering so I would appreciate any help.


问:
What is the most effective tool to analyze apk file
I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes.
However, I am facing an issue for signle apk app that has so many files and obfuscations. I can deal with obfuscations but I want to analyze the code flow, for example I want to see what methods and return values are triggered after pressing a button. Android studio has smali add-ons but stopped working and cannot get even the specified return values at given debugging point.
I read about Frida, IDA pro and ghidra. I want to start one of them at least so I can do the most difficult tasks. I will dedicate my time to master it but I want a hint from experts in this regard. Could you please suggest a direction for me.</p>


问:
Wrong EP on an .elf CrackMe
I am trying to solve an elf CrackMe. I opened it with IDA Pro and I saw start function is on address 0x1E8. I opened the elf with HxD and I saw entry point is 0x1E9 (and no results on file for 01E8)...

If I run on Kali terminal:

```<code>readelf --symbols CrackMe
</code>```

I don't get any result. If I run:

```<code>readelf --sections Crackme
</code>```

I get over 20 sections.

If I try to execute the binary on Kali terminal:

```<code>./CrackMe
</code>```

I get

```<code>zsh: exec format error.
</code>```

I changed manually the byte of entry point that is different with HxD, E9 --> E8, but I don't get any different results when I execute all again using the edited file.

Any ideas? Thank you.

Title: Wrong EP on an .elf CrackMe


问:
debug native code and net code
I have a .net dll with a lot of calculations and formulas.
From this dll, I want to set breakpoints to see the calculated results for a specific field.

The main program is written in native code. So, I cannot use dnspy for debugging.

I was trying to use visual studio for my class library and set the exe file to debugger external source.

This shows me a “debugger was found” error

Can anyone help me how is the best way for my request?

Title: debug native code and net code


问:
Need help finding a windows struct
What I know about it:

```<code>struct unknown_struct
{
    struct _KAPC apc;
    struct _KEVENT event;
    char unknown[2056];
};
</code>```

So first a kernel apc struct then a kernel event struct and the total size is 0x878 (2168) bytes. Anybody know a struct on 64-bit windows that matches this description? Thanks.

Title: Need help finding a windows struct


问:
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?

```<code>.text:00000001C00218C2                 call    cs:wcsnlen
.text:00000001C00218C9                 nop     dword ptr [rax+rax+00h]
.text:00000001C00218CE                 mov     rdx, r15
.text:00000001C00218D1                 mov     ecx, ebx
.text:00000001C00218D3                 lea     r8d, [rax+rax]
.text:00000001C00218D7                 call    RtlCompute37Hash
.text:00000001C00218DC                 bts     eax, 1Fh
.text:00000001C00218E0                 lea     r8, [rsp+0B8h+Context] ; Context
.text:00000001C00218E5                 xorps   xmm0, xmm0
.text:00000001C00218E8                 mov     edx, eax        ; Signature
.text:00000001C00218EA                 lea     rcx, stru_1C0077988 ; HashTable
.text:00000001C00218F1                 mov     ebx, eax
.text:00000001C00218F3                 movdqu  xmmword ptr [rsp+0B8h+Context.ChainHead], xmm0
.text:00000001C00218F9                 call    cs:RtlLookupEntryHashTable
.text:00000001C0021900                 nop     dword ptr [rax+rax+00h]
</code>```

When I double clicked it, I got this

```<code>.idata:00000001C007E378                                         ; sub_1C0014BCC+107↑p ...
.idata:00000001C007E380 ; PRTL_DYNAMIC_HASH_TABLE_ENTRY __stdcall RtlLookupEntryHashTable(PRTL_DYNAMIC_HASH_TABLE HashTable, ULONG_PTR Signature, PRTL_DYNAMIC_HASH_TABLE_CONTEXT Context)
.idata:00000001C007E380                 extrn RtlLookupEntryHashTable:qword
.idata:00000001C007E380                                         ; CODE XREF: KfdAleRemoveFlowContextTable+102↑p
.idata:00000001C007E380                                         ; KfdAleAcquireEndpointContextFromFlow+92↑p ...
.idata:00000001C007E388 ; BOOLEAN __stdcall KeTestSpinLock(PKSPIN_LOCK SpinLock)
.idata:00000001C007E388                 extrn KeTestSpinLock:qword
</code>```

Title: How to reverse an import function?


问:
How can I hook structure members in frida
I have a code like this:

```<code>class CURLNetRequest : public CNetRequestBase
{
    DEFINE_LOGCLASS;

    struct ProxySettings
    {
        void initFromConfig();

        String  host;
        int     port;
        String  username;
        String  password;
    };

    struct AuthSettings
    {
        AuthSettings( AuthMethod m, const String& u, const String& p )
        : method(m)
        , user(u)
        , password(p)
        {}

        const AuthMethod method;
        const String user;
        const String password;
    };
...
</code>```

I want to hook the structure members i.e. user and password using frida. so far I did like below:

```<code>const some_func_pointer = Module.getExportByName('librhodes.so', '_ZN3rho3net14CURLNetRequest10CURLHolder11set_optionsEPKcRKNSt6__ndk
112basic_stringIcNS5_11char_traitsIcEENS5_9allocatorIcEEEESD_PNS0_11IRhoSessionEPNS_9HashtableISB_SB_EERKNS1_13ProxySettingsERKNS1_12AuthSettingsE');
const some_func = new NativeFunction(some_func_pointer, "void", ["int", "pointer"]);
Interceptor.replace(some_func_pointer, new NativeCallback(function (size, data) {
  console.log(size)
  console.log(data.readUtf8String())
  some_func(size, data);
}, "void", ["int", "pointer"]));
</code>```

and I can only get the AuthMethod m which could either be POST or GET in this case. How can I hook others like username and password.

FYI, this is rhomobile built app, and the above snippet taken from the open source code, so apparently decompiling librhodes.so  produces some stripped functions, etc.

please help me with this.


问:
Fix screen resolutions to landscape in bios
I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.) to be in portait-left. Linux behaves similarly: during early boot (efifb driver, i suppose) it's in portait-left, then it switches to portait-right (when it switches to i915, probably).

Ofc I can rotate the screen in tty and the desktop environment but that's not a solution. I can't rotate bootloaders (I sometimes edit text in them, so I need them to display normally) and some applications (e.g. ncurses), and also this causes the touchscreen to be inverted in X and Y, thus unusable.

So, I disassembled the device. The lcd driver bord is small and doesn't seem to have any rom chips on it. It connects directly to the motherboard with a wide thin flat flex cable. So, I assume everything, incl. edid is in the bios rom on the motherboard. This is the only chip that looks like a rom chip.

So I took a dump of the bios. I have a hex editor but I don't understand anything in these byte sections, not to mention the bytes themselves. Maybe someone can explain it to me? Or maybe there is resources that I can start with?


问:
radare2: How to load a DLL along with the application?
I am reverse engineering a Windows application for which there is no PDB file available.
When loading it in r2, I get the following imports (They are correct):

```<code> nth  vaddr      bind type lib          name
―――――――――――――――――――――――――――――――――――――――――――
545  0x00012008 NONE FUNC COREDLL.dll  Ordinal_545
557  0x0001200c NONE FUNC COREDLL.dll  Ordinal_557
</code>```

Stub functions are called in the disassembly, like this

```<code>bl fcn.000111c8
</code>```

and fcn.000111c8 essentially loads the address and calls the actual function

```<code>┌ 12: fcn.000111c8 ();
│           0x000111c8           ldr ip, sym.imp.COREDLL.dll_Ordinal_545
│           0x000111cc           ldr ip, [ip]
└           0x000111d0           bx ip
</code>```

I have the COREDLL.dll file and it contains correct debug symbols. I would like to tell r2 to use them to get the function names for these plt entries, so that I see the real function names from the DLLs instead of generated names like "Ordinal_xxx".

How do I do that?


问:
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. The source code must be compatible with Windows 8.1/10/11 targeting the Intel x86 architecture.</p>


问:
IDA debug function spawned by pthread_once
I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?</p>


问:
Calculator shows incorrect result for 32-bit subtraction?
I was trying to argue about the operation of a routine called micros() and millis() that is used on the Arduino platform, and I ended up finding this calculator. The calculator shows a different result than 8-bit (ATmega328 - Arduino Nano) and 32-bit (ESP32) processors. They even cited the result of the Windows calculator, which shows the same result as the aforementioned microcontrollers.

Nano/ESP32: 0x1 - 0xFFFFFF00 = 0x101

Calculator: 0x1 - 0xFFFFFF00 = 0xFFFFFEFF

I found an explanation for calculating subtraction for 8-bit numbers,

Does anyone know of an answer made with 32-bit numbers?.


问:
How can I enumerate and hook all non-exported functions in lib.so using frida?
I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported functions, tried possibilities but still no luck, for example; this stack overflow question though it looks like my problem and still get not applicable the solution mentioned there.

previously I loaded the lib into ghidra and auto analyzed it and then used this python script, just to get frida hooks on functions interested. what this script does is that it gets all functions in the lib and then generates frida hook script for them, may be technically some fallacies, didn't investigate it. btw the plugin outputs the function interested hook:

```<code>//Hook function setAuthUser @ 0x8e427c
Interceptor.attach(Module.findBaseAddress("librhodes.so").add(ptr(0x7e427c)), {
  onEnter: function (args) {
    console.log("=> setAuthUser(" + args[0] + ")")
  },
  onLeave: function (result) {
    console.log("setAuthUser() => " + result)
  },
})
</code>```

when I ran this script with the apk attached with frida gadget, I got no results. so apparently the function address is a miss. so what I wanted is that is there in frida a way to get all non-exported functions and their addresses to hook them. because I believe the offsets given by ghidra is not matching to the running apk lib? may be? no idea and I'm beginner to this.

please help this


问:
Disassembly of raw binary of AARCH64 using Ghidra not complete
I am trying to disassemble a raw binary with AARCH64:LE:64:v8A:default (as per below mentioned specs).

Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 8
On-line CPU(s) list: 0-7
Vendor ID: Nvidia
Model: 0
Model name: ARMv8 Processor rev 0 (v8l)
Compiler - aarch64-gnu-linux GCC compiler

Here are the steps I followed:

After importing the bin file, I ran auto analysis with default options selected.

Selected the code (ctrl+A) then pressed d (for manual disassembly).

This ran for around 3 hrs and the disassembled code that it generated still had many bytes as "??". Also, when I try to generate the code flow, it runs into heap memory issue (currently heap size set to 4GB).

Is there any step that I am missing out? Or if anyone can help me what else I can try further?


问:
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:

```<code>nt!ExAllocatePool:
    ...
    sub rsp, 0xd0
    ...
    mov qword ptr [rsp+0xf8], rbx
</code>```

Windows only allocated 0xd0 bytes for locals but then it decides to step on the callers stack since 0xf8 is > 0xd0! What am I missing here? This HAS to be a bug in Windows.


Title: Assemby reverse engineering

Body:
I'm new to assembly and need some help understanding what this program does. This program takes a username and serial. If the combination is correct, it prints the magic words.
I need to write a keygen for this program.
Any help would be appreciated. Thanks</p>
```<code>0x08049530 <+0>:    lea    0x4(%esp),%ecx
   0x08049534 <+4>: and    $0xfffffff0,%esp
   0x08049537 <+7>: push   -0x4(%ecx)
   0x0804953a <+10>:    push   %ebp
   0x0804953b <+11>:    mov    %esp,%ebp
   0x0804953d <+13>:    push   %ebx
   0x0804953e <+14>:    push   %ecx
   0x0804953f <+15>:    sub    $0x40,%esp
   0x08049542 <+18>:    call   0x8049160 <__x86.get_pc_thunk.bx>
   0x08049547 <+23>:    add    $0x2ab9,%ebx
   0x0804954d <+29>:    mov    %ecx,%eax
   0x0804954f <+31>:    mov    0x4(%eax),%edx
   0x08049552 <+34>:    mov    %edx,-0x3c(%ebp)
   0x08049555 <+37>:    mov    %gs:0x14,%edx
   0x0804955c <+44>:    mov    %edx,-0xc(%ebp)
   0x0804955f <+47>:    xor    %edx,%edx
   0x08049561 <+49>:    movl   $0x65757153,-0x20(%ebp)
   0x08049568 <+56>:    movl   $0x73696d61,-0x1c(%ebp)
   0x0804956f <+63>:    movl   $0x734f2068,-0x18(%ebp)
   0x08049576 <+70>:    movl   $0x72666973,-0x14(%ebp)
   0x0804957d <+77>:    movl   $0x656761,-0x10(%ebp)
   0x08049584 <+84>:    cmpl   $0x3,(%eax)
   0x08049587 <+87>:    je     0x80495b4 <main+132>
   0x08049589 <+89>:    mov    -0x3c(%ebp),%eax
   0x0804958c <+92>:    mov    (%eax),%edx
   0x0804958e <+94>:    mov    -0x10(%ebx),%eax
   0x08049594 <+100>:   mov    (%eax),%eax
   0x08049596 <+102>:   sub    $0x4,%esp
   0x08049599 <+105>:   push   %edx
   0x0804959a <+106>:   lea    -0x1fe2(%ebx),%edx
   0x080495a0 <+112>:   push   %edx
   0x080495a1 <+113>:           push   %eax
   0x080495a2 <+114>:   call   0x80490b0 <fprintf@plt>
   0x080495a7 <+119>:   add    $0x10,%esp
   0x080495aa <+122>:   mov    $0xffffffff,%eax
   0x080495af <+127> :  jmp    0x80496d0 <main+416>
   0x080495b4 <+132>:   sub    $0x4,%esp
   0x080495b7 <+135>:   push   $0xb
   0x080495b9 <+137>:   push   $0x0
   0x080495bb <+139>:   lea    -0x36(%ebp),%eax
   0x080495be <+142>:   push   %eax
   0x080495bf <+143>:   call   0x80490c0 <memset@plt>
   0x080495c4 <+148>:   add    $0x10,%esp
   0x080495c7 <+151>:   mov    -0x3c(%ebp),%eax
   0x080495ca <+154>:   add    $0x4,%eax
   0x080495cd <+157>:   mov    (%eax),%eax
   0x080495cf <+159>:   sub    $0x4,%esp
   0x080495d2 <+162>:   push   $0xa
   0x080495d4 <+164>:   push   %eax
   0x080495d5 <+165>:   lea    -0x36(%ebp),%eax
   0x080495d8 <+168>:   push   %eax
   0x080495d9 <+169>:   call   0x80490d0 <strncpy@plt>
   0x080495de <+174>:   add    $0x10,%esp
   0x080495e1 <+177>:   sub    $0x4,%esp
   0x080495e4 <+180>:   push   $0xb
   0x080495e6 <+182>:   push   $0x0
   0x080495e8 <+184>:   lea    -0x2b(%ebp),%eax
   0x080495eb <+187>:   push   %eax
   0x080495ec <+188>:   call   0x80490c0 <memset@plt>
   0x080495f1 <+193>:           add    $0x10,%esp
   0x080495f4 <+196>:   mov    -0x3c(%ebp),%eax
   0x080495f7 <+199>:   add    $0x8,%eax
   0x080495fa <+202>:   mov    (%eax),%eax
   0x080495fc <+204>:   sub    $0x4,%esp
   0x080495ff <+207>:           push   $0xa
   0x08049601 <+209>:   push   %eax
   0x08049602 <+210>:   lea    -0x2b(%ebp),%eax
   0x08049605 <+213>:   push   %eax
   0x08049606 <+214>:   call   0x80490d0 <strncpy@plt>
   0x0804960b <+219>:   add    $0x10,%esp
   0x0804960e <+222>:   lea    -0x36(%ebp),%eax
   0x08049611 <+225>:   movzbl (%eax),%eax
   0x08049614 <+228>:   test   %al,%al
   0x08049616 <+230>:   jne    0x804963e <main+270>
   0x08049618 <+232>:   mov    -0x10(%ebx),%eax
   0x0804961e <+238>:   mov    (%eax),%eax
   0x08049620 <+240>:   push   %eax
   0x08049621 <+241>:   push   $0x10
   0x08049623 <+243>:   push   $0x1
   0x08049625 <+245>:   lea    -0x1fc7(%ebx),%eax
   0x0804962b <+251>:   push   %eax
   0x0804962c <+252>:   call   0x8049070 <fwrite@plt>
   0x08049631 <+257>:   add    $0x10,%esp
   0x08049634 <+260>:   mov    $0xffffffff,%eax
   0x08049639 <+265>:   jmp    0x80496d0 <main+416>
   0x0804963e <+270>:   call   0x8049226 <frame_dummy+6>
   0x08049643 <+275>:   test   %eax,%eax
   0x08049645 <+277>:   je     0x804966a <main+314>
   0x08049647 <+279>:   mov    -0x10(%ebx),%eax
   0x0804964d <+285>:   mov    (%eax),%eax
   0x0804964f <+287>:   push   %eax
   0x08049650 <+288>:   push   $0x8
   0x08049652 <+290>:   push   $0x1
   0x08049654 <+292>:   lea    -0x1fb6(%ebx),%eax
   0x0804965a <+298>:   push   %eax
   0x0804965b <+299>:   call   0x8049070 <fwrite@plt>
   0x08049660 <+304>:   add    $0x10,%esp
   0x08049663 <+307>:   mov    $0xffffffff,%eax
   0x08049668 <+312>:   jmp    0x80496d0 <main+416>
   0x0804966a <+314>:   sub    $0x8,%esp
   0x0804966d <+317>:   lea    -0x2b(%ebp),%eax
   0x08049670 <+320>:   push   %eax
   0x08049671 <+321>:   lea    -0x36(%ebp),%eax
   0x08049674 <+324>:   push   %eax
   0x08049675 <+325>:   call   0x80493f5 <frame_dummy+469>
   0x0804967a <+330>:   add    $0x10,%esp
   0x0804967d <+333>:   test   %eax,%eax
   0x0804967f <+335>:   jne    0x80496a4 <main+372>
   0x08049681 <+337>:   mov    -0x10(%ebx),%eax
   0x08049687 <+343>:   mov    (%eax),%eax
   0x08049689 <+345>:   push   %eax
   0x0804968a <+346>:   push   $0x16
   0x0804968c <+348>:   push   $0x1
   0x0804968e <+350>:   lea    -0x1fad(%ebx),%eax
   0x08049694 <+356>:   push   %eax
   0x08049695 <+357>:   call   0x8049070 <fwrite@plt>
   0x0804969a <+362>:   add    $0x10,%esp
   0x0804969d <+365>:   mov    $0xffffffff,%eax
   0x080496a2 <+370>:   jmp    0x80496d0 <main+416>
   0x080496a4 <+372>:   mov    0xa8(%ebx),%eax
   0x080496aa <+378>:   call   *%eax
   0x080496ac <+380>:   mov    -0x8(%ebx),%eax
   0x080496b2 <+386>:   mov    (%eax),%eax
   0x080496b4 <+388>:   sub    $0x4,%esp
   0x080496b7 <+391>:   lea    -0x20(%ebp),%edx
   0x080496ba <+394>:   push   %edx
   0x080496bb <+395>:   lea    -0x1f96(%ebx),%edx
   0x080496c1 <+401>:   push   %edx
   0x080496c2 <+402>:   push   %eax
   0x080496c3 <+403>:   call   0x80490b0 <fprintf@plt>
   0x080496c8 <+408>:   add    $0x10,%esp
   0x080496cb <+411>:   mov    $0x0,%eax
   0x080496d0 <+416>:   mov    -0xc(%ebp),%edx
   0x080496d3 <+419>:   sub    %gs:0x14,%edx
   0x080496da <+426>:   je     0x80496e1 <main+433>
   0x080496dc <+428>:   call   0x8049770 <__stack_chk_fail_local>
   0x080496e1 <+433>:   lea    -0x8(%ebp),%esp
   0x080496e4 <+436>:   pop    %ecx
   0x080496e5 <+437>:   pop    %ebx
   0x080496e6 <+438>:   pop    %ebp
   0x080496e7 <+439>:   lea    -0x4(%ecx),%esp
   0x080496ea <+442>:   ret
</code>```


问:
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect jump (jmp rbp) jumps to invalid memory and I don't understand why. Can anyone shed some light on the issue. Since rbp is calculated in the block below, i didn't include any other parts of the binary.

The address that it jumps to is 0x000000014CC3A390; but my base is at 0x140000000 and my driver's size is 0xB64000 bytes.
Other addresses are in the 0x140xxxxxx range but this one seems so weird and I don't know why.

Other notes:

0x1409F4F92 + 0xc242cdf = 0x14CC37C71

```<code>seg007:00000001409F4F84 loc_1409F4F84:                          ; CODE XREF: seg007:00000001406E3AE2↑j
seg007:00000001409F4F84                 mov     rcx, 4B1Fh
seg007:00000001409F4F8B                 lea     rax, cs:14CC37C71h
seg007:00000001409F4F92                 mov     rsi, rax
seg007:00000001409F4F95                 mov     rbp, rsi
seg007:00000001409F4F98                 mov     rbx, rsi
seg007:00000001409F4F9B                 mov     rdx, rax
seg007:00000001409F4F9E                 shl     rbp, 1
seg007:00000001409F4FA1                 xor     rbx, rcx
seg007:00000001409F4FA4                 and     rbx, rsi
seg007:00000001409F4FA7                 and     rdx, rcx
seg007:00000001409F4FAA                 sub     rbp, rsi
seg007:00000001409F4FAD                 xor     rdx, rax
seg007:00000001409F4FB0                 sub     r9, 4
seg007:00000001409F4FB4                 xor     rbx, rbp
seg007:00000001409F4FB7                 mov     rsi, rbx
seg007:00000001409F4FBA                 movsxd  rbx, dword ptr [rsp]
seg007:00000001409F4FBE                 add     rsi, rcx
seg007:00000001409F4FC1                 add     rdx, rsi
seg007:00000001409F4FC4                 mov     rax, rdx
seg007:00000001409F4FC7                 mov     rcx, rsp
seg007:00000001409F4FCA                 mov     rbp, rax
seg007:00000001409F4FCD                 add     rbp, rbx ; last operation that matters
seg007:00000001409F4FD0                 mov     rbx, rsp
seg007:00000001409F4FD3                 sar     rbx, 3Fh
seg007:00000001409F4FD7                 shr     rbx, cl
seg007:00000001409F4FDA                 mov     rdx, rsp
seg007:00000001409F4FDD                 xor     ecx, ecx
seg007:00000001409F4FDF                 cmp     rsp, 40h ; '@'
seg007:00000001409F4FE3                 cmovnb  rbx, rcx
seg007:00000001409F4FE7                 mov     rdi, rdx
seg007:00000001409F4FEA                 mov     rax, 4
seg007:00000001409F4FF1                 mov     rcx, rax
seg007:00000001409F4FF4                 shl     rdi, cl
seg007:00000001409F4FF7                 xor     ecx, ecx
seg007:00000001409F4FF9                 mov     rsi, rdx
seg007:00000001409F4FFC                 cmp     rax, 40h ; '@'
seg007:00000001409F5000                 cmovnb  rdi, rcx
seg007:00000001409F5004                 mov     rcx, rax
seg007:00000001409F5007                 shl     rsi, cl
seg007:00000001409F500A                 xor     ecx, ecx
seg007:00000001409F500C                 sub     rdi, rdx
seg007:00000001409F500F                 cmp     rax, 40h ; '@'
seg007:00000001409F5013                 cmovnb  rsi, rcx
seg007:00000001409F5017                 xor     rsi, rax
seg007:00000001409F501A                 sub     rsi, rdi
seg007:00000001409F501D                 mov     rdx, rsi
seg007:00000001409F5020                 sub     rdx, rbx
seg007:00000001409F5023                 mov     rsp, rdx
seg007:00000001409F5026                 jmp     rbp
</code>```

Title: jump to invalid address when emulating


问:
How to correct decompiled output with `in_stack_` (ppc BE)?
So I have something like:

```<code>                     *************************************************************
                     * SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con  ..
                     *************************************************************
                     undefined  __thiscall  SYS_DRAW_BATCH_RUNS_DATA_Set (void
     undefined         r3:1           <RETURN>
     void *            r3:4 (auto)    this
     matrix4 *         r4:4           param_1
     RECTF *           r5:4           param_2
     SYS_DRAW_QUALI    r6:4           param_3
     SYS_DRAW_RUN *    r7:4           param_4
     uint              r8:4           param_5
     SYS_DRAW_MATER    r9:4           param_6
     uint              r10:4          param_7
     astruct_952       Stack[0x38]:32 param_8                                 XREF[1,7]:   00175b18 (R) ,
                                                                                00175b1c (R) ,
                                                                                00175b20 (R) ,
                                                                                00175b24 (R) ,
                                                                                00175b28 (R) ,
                                                                                00175b2c (R) ,
                                                                                00175b30 (R) ,
                                                                                00175b34 (R)
     uint              Stack[0x58]:4  param_9
     uint              Stack[0x5c]:4  param_10
     SYS_D3D_IB_BAS    Stack[0x60]:4  param_11
     SYS_D3D_VB_BAS    Stack[0x64]:4  param_12
     FuncDef30 *       Stack[0x68]:4  param_13
     void *            Stack[0x6c]:4  param_14
     SYS_DRAW_BUFFE    Stack[0x70]:4  param_15
     undefined4        Stack[0x8]:4   local_res8                              XREF[2]:     00175b10 (W) ,
                                                                                00175b84 (R)
     undefined4        Stack[-0x3c]:4 local_3c                                XREF[2]:     00175aec (W) ,
                                                                                00175b90 (R)
     undefined4        Stack[-0x4c]:4 local_4c                                XREF[1]:     00175b7c (W)
     undefined4        Stack[-0x50]:4 local_50                                XREF[1]:     00175b78 (W)
     undefined4        Stack[-0x54]:4 local_54                                XREF[1]:     00175b74 (W)
     undefined4        Stack[-0x58]:4 local_58                                XREF[1]:     00175b70 (W)
     undefined4        Stack[-0x90]:4 local_90                                XREF[1]:     00175b14 (W)
                     __ZN24SYS_DRAW_BATCH_RUNS_DATA3SetEPK7matrix4P  XREF[4]:     Entry Point (*) ,
                     SYS_DRAW_BATCH_RUNS_DATA_Set                                 DrawRoom_Rooms_FF_TSS:000fed58 (
                                                                                DrawRoom_Meshes_FF_TSS:000ff168
                                                                                SYS_DRAW_CHAR_BATCH_RUNS_DATA_SY
00175ae8 7c  08  02  a6    mfspr      r0,LR
00175aec be  21  ff  c4    stmw       r17 ,local_3c (r1)
00175af0 28  04  00  00    cmplwi     param_1 ,0x0
00175af4 7c  71  1b  78    or         r17 ,this ,this
00175af8 7c  b2  2b  78    or         r18 ,param_2 ,param_2
00175afc 7c  d3  33  78    or         r19 ,param_3 ,param_3
00175b00 7c  f4  3b  78    or         r20 ,param_4 ,param_4
00175b04 7d  15  43  78    or         r21 ,param_5 ,param_5
00175b08 7d  36  4b  78    or         r22 ,param_6 ,param_6
00175b0c 7d  57  53  78    or         r23 ,param_7 ,param_7
00175b10 90  01  00  08    stw        r0,local_res8 (r1)
00175b14 94  21  ff  70    stwu       r1,local_90 (r1)
00175b18 83  01  00  c8    lwz        r24 ,param_8.param_8 (r1)
00175b1c 83  21  00  cc    lwz        r25 ,param_8.param_9 (r1)
00175b20 83  41  00  d0    lwz        r26 ,param_8.param_10 (r1)
00175b24 83  61  00  d4    lwz        r27 ,param_8.param_11 (r1)
00175b28 83  81  00  d8    lwz        r28 ,param_8.param_12 (r1)
00175b2c 83  a1  00  dc    lwz        r29 ,param_8.param_13 (r1)
00175b30 83  c1  00  e0    lwz        r30 ,param_8.param_14 (r1)
00175b34 83  e1  00  e4    lwz        r31 ,param_8.param_15 (r1)
00175b38 41  82  00  0c    beq        LAB_00175b44
00175b3c 38  71  00  40    addi       this ,r17 ,0x40
00175b40 4b  ff  39  39    bl         matrix4_assignment                               undefined matrix4_assignment(voi
                     LAB_00175b44                                    XREF[1]:     00175b38 (j)
00175b44 92  51  00  80    stw        r18 ,0x80 (r17 )
00175b48 7e  23  8b  78    or         this ,r17 ,r17
00175b4c 7e  64  9b  78    or         param_1 ,r19 ,r19
00175b50 7e  c5  b3  78    or         param_2 ,r22 ,r22
00175b54 92  91  00  84    stw        r20 ,0x84 (r17 )
00175b58 7e  e6  bb  78    or         param_3 ,r23 ,r23
00175b5c 7f  07  c3  78    or         param_4 ,r24 ,r24
00175b60 7f  28  cb  78    or         param_5 ,r25 ,r25
00175b64 92  b1  00  88    stw        r21 ,0x88 (r17 )
00175b68 7f  49  d3  78    or         param_6 ,r26 ,r26
00175b6c 7f  6a  db  78    or         param_7 ,r27 ,r27
00175b70 93  81  00  38    stw        r28 ,local_58 (r1)
00175b74 93  a1  00  3c    stw        r29 ,local_54 (r1)
00175b78 93  c1  00  40    stw        r30 ,local_50 (r1)
00175b7c 93  e1  00  44    stw        r31 ,local_4c (r1)
00175b80 48  00  00  19    bl         SYS_DRAW_BATCH_DATA_Set                          undefined SYS_DRAW_BATCH_DATA_Se
00175b84 80  01  00  98    lwz        r0,local_res8 (r1)
00175b88 38  21  00  90    addi       r1,r1,0x90
00175b8c 7c  08  03  a6    mtspr      LR,r0
00175b90 ba  21  ff  c4    lmw        r17 ,local_3c (r1)
00175b94 4e  80  00  20    blr
</code>```

Which decompiles to:

```<code>/* SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF const*, SYS_DRAW_QUALITY, SYS_DRAW_RUN
   const*, unsigned int, SYS_DRAW_MATERIAL_POOL const*, unsigned int, unsigned int, unsigned int,
   unsigned int, SYS_D3D_IB_BASE*, SYS_D3D_VB_BASE*, void (*)(SYS_D3D_DEVICE*, SYS_DRAW_BATCH
   const&, SYS_DRAW_BATCH_RUN const&, void const*, unsigned short*), void*, SYS_DRAW_BUFFER_DEVICE* )
    */

void __thiscall
SYS_DRAW_BATCH_RUNS_DATA_Set
          (void *this,matrix4 *param_1,RECTF *param_2,SYS_DRAW_QUALITY param_3,SYS_DRAW_RUN *param _4
          ,uint param_5,SYS_DRAW_MATERIAL_POOL *param_6,uint param_7,astruct_952 param_8,
          uint param_9,uint param_10,SYS_D3D_IB_BASE *param_11,SYS_D3D_VB_BASE *param_12,
          FuncDef30 *param_13,void *param_14,SYS_DRAW_BUFFER_DEVICE *param_15)

{
  FuncDef31 *in_stack_ffffffb8;
  void *in_stack_ffffffbc;
  SYS_DRAW_BUFFER_DEVICE *in_stack_ffffffc0;

  if (param_1 != (matrix4 *)0x0) {
    matrix4_assignment((void *)((int)this + 0x40),param_1);
  }
  *(RECTF **)((int)this + 0x80) = param_2;
  *(SYS_DRAW_RUN **)((int)this + 0x84) = param_4;
  *(uint *)((int)this + 0x88) = param_5;
  SYS_DRAW_BATCH_DATA_Set
            (this,param_3,param_6,param_7,param_8.param_8,param_8.param_9,param_8.param_10,
             param_8.param_11,SUB3216(param_8,0),in_stack_ffffffb8,in_stack_ffffffbc,
             in_stack_ffffffc0);
  return;
}
</code>```

Now obviously something is wrong here but I don't understand what - first of all SUB321 expands in export to like:

CONCAT284(CONCAT244(CONCAT204(CONCAT164(CONCAT124(CONCAT84(CONCAT44(param_8.param_8, param_5),param_6), param_8.param_9),param_8.param_10), param_8.param_11),param_8.param_12),param_8.param_13)

And second of all those in_stack_ shouldn't be there for sure.

Any ideas what could be the issue and how can I fix it?

I'm running a Mach-O G2 Big Endian Altivec binary.

Thanks in advance.


问:
Analyze/RE device through usb ports

Hi, I disassembled my old smart TV and found the wifi card pretty interesting.
On the internet i found a minimal manaual datasheet...
It was simple to recognise that there is usb pins layout on there and I am trying to see what information I can get from only connecting it to my computer.

If I'm right and pins 1-4 are usb , I have a few questions:

why does it say the vcc (pin 1) is 3.3v? When I connect it to the usb port of my computer it immediately gets 5v from it, no? Should i do something about that?

Would it be bad guess to try only connect pins 1-4 to the computer? I mean - should I also connect pins 6 and 8? (The "none usb" gnd+vcc ports).
More generally, what is a good guess of the 8 pins functioning? (Like what are the usb pins and does the usb-vcc is the only source of voltage)

Thanks in advance!

Title: Analyze/RE device through usb ports


问:
RISC-V assembler with strong Python support?
I'm using the Capstone disassembler for decoding a RISC-V ELF binary but need the ability to reassemble modifications that I'm making to it programmatically to accomplish a reverse-engineering goal. Ideally, this would be an assembler that takes Capstone syntax or represents the assembly data in a similar structure. I know someone has previously (Capstone in reverse mode) asked whether there's a Capstone-like project for assembling code. My question is, are there any Capstone-like assemblers which also have good RISC-V support?</p>


问:
Copy all ASCII in x64db
How i can copy all ASCII or Hex values starting from specific point without scrolling up or keep moving the mouse?

For example from below point till first offset.

Thanks

Title: Copy all ASCII in x64db


问:
How to decrypt cocos2d luac type?
I am new with IDA and cocos2d. Since I have learned how to decrypt cocos2d Lua file, I found xxtea tool with Sign and Key and how to find Sign header in some game in Lua file.

But that method does not work with this game - Six Path Legend：Revenge (size 869.7MB):
Link

The Luac file sign starts with ..C6E@.. header, but cannot find it in IDA.

How can we decrypt it?

Lib file(libcocos2dlua.so, file size 9.45MB):
Download link

Luac file(main.luac, file size 3.63KB):
Download link

Title: How to decrypt cocos2d luac type?


问:
Is there any Android application that can manipulate the http response?
Is there any android app to manipulate http response body without vpn?

for example:

from

```<code>"0|{random_string}|Wrong"
</code>```

Becomes

```<code>"1|{random_string}|True"
</code>```

Thanks in advance


问:
How this data can be referenced in Ghidra?
I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:

```<code>UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,0);
</code>```

it is apparently getting the value of a shared_preferences. the syntax of when getting a shared_preference in unity games is as follows as described in the documentation:

```<code>UnityEngine.PlayerPrefs.GetInt(string key, int defaultValue)
</code>```

so as apparently the *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8) in the reversed code is the corresponding string key. while in general I know where the key is in the reversed code which is at this address

```<code>010e94b8      undefined4      ??       ; ScoreID

</code>```

so what I wanted to learn is that how *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8)  is reffering to that address 010e94b8 holding the string key.

what I tried so far?

referring to this answer, I double clicked the value Class$ItemPref in the decompiled code *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8) and take its memory address 010dd710 and then adding 0x5c yeilds 10DD76C and then adding 8 yeilds 10DD774 so going to this address 10DD774 does not contain the string ScoringID.

also I did this taking memory address of Class$ItemPref which is 010dd710 and then adding 0x5c and the multiply the size of the typecast which is int which is 4 then the result is 4375DB0 then adding 8 equals to 4375DB8 but this is not quite right.

but what I really wanted to learn is that how that string ScoreID is referred in the decompiled code UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,0); please help this as my limited knowledge of reversing and ghidra.

if it helps, the corresponding disassembled view of the code is as follows:

```<code>    003e60f0 5c 00 90 e5              ldr             r0, [r0,#0x5c]
    003e60f4 05 10 a0 e3              mov             r1, #0x5
    003e60f8 00 20 a0 e3              mov             r2, #0x0
    003e60fc 08 00 90 e5              ldr             r0, [r0,#0x8]
    003e6100 10 4c bd e8              ldmia           sp!,{r4 r10 r11 lr}
    003e6104 1a 63 14 ea              b               UnityEngine.PlayerPrefs$$GetInt                                                                        ; undefined UnityEngine.PlayerPrefs$$GetInt()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN

</code>```


问:
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the approachs in this matter!

How to get the WinAPI function's call stack and which DLL libraries that have the function there ? and is there a way to find out all of that statically without the debugger ?


Title: Invalid "Variation" of a base64 encoding


问:
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:

```<code>// Namespace:
public class GameConfig // TypeDefIndex: 6152
{
    // Fields
    public const float durationSlide = 1.2; // 0x0
    public const float durationBlockDame = 0.1; // 0x0
    public const float forceOnBreak = 2000; // 0x0
    public const float durationBombExp = 1.8; // 0x0
    public const float durationUpdateDistance = 0.1; // 0x0
    public const float durationCheckRange = 2; // 0x0

    // Methods
    // RVA: 0x3F5E98 Offset: 0x3F5E98 VA: 0x3F5E98
    public void .ctor() { }
}

</code>```

And then loaded the lib into ghidra and then auto analyze command, while in my understanding those variables could be in that .rodata section but needed help of how can I identify those values like for example 1.8 which equals in hex 0x3fe66666 tried to search those values but not able to get it.
on the .rodata section contained so much data like this:

```<code>                                                  //
                                                  // .rodata
                                                  // SHT_PROGBITS  [0x16d1e10 - 0x18b4417]
                                                  // ram:016d1e10-ram:018b4417
                                                  //
                                                  DAT_016d1e10                                                                                XREF[144]:      01a78090(*), 01a78098(*), 01a780a0(*), 01a780a8(*), 01a780b0(*), 01a780b8(*),
                                                                                01a780c0(*), 01a780c8(*), 01a780d0(*), 01a780d8(*), 01a780e0(*), 01a780e8(*),
                                                                                01a780f0(*), 01a83ef4(*), 01bacdd4(*), 01bace2c(*), 01bace30(*), 01bace40(*),
                                                                                01bace80(*), 01bace84(*), [more]
     016d1e10  6b                          ??                                                    6Bh    k
      016d1e11 01                          ??                                                    01h
      016d1e12  00                          ??                                                    00h
      016d1e13  00                          ??                                                    00h
     016d1e14  00                          ??                                                    00h
      016d1e15  00                          ??                                                    00h
     016d1e16  1c                           ??                                                    1Ch
      016d1e17  00                          ??                                                    00h
                                                  DAT_016d1e18                                                                                XREF[1]:          01a94444(*)
     016d1e18  6b                          ??                                                    6Bh    k
     016d1e19  01                          ??                                                    01h
      016d1e1a  00                          ??                                                    00h
     016d1e1b  00                          ??                                                    00h
      016d1e1c 01                          ??                                                    01h
     016d1e1d  00                          ??                                                    00h
     016d1e1e  1c                           ??                                                    1Ch
      016d1e1f  00                          ??                                                    00h
                                                  DAT_016d1e20                                                                                XREF[1]:          01a946c0(*)
     016d1e20  6b                          ??                                                    6Bh    k
      016d1e21  01                          ??                                                    01h
     016d1e22  00                          ??                                                    00h
     016d1e23  00                          ??                                                    00h
     016d1e24  11                           ??                                                    11h
     016d1e25  00                          ??                                                    00h
     016d1e26  1c                           ??                                                    1Ch
     016d1e27  00                          ??                                                    00h
                                                  DAT_016d1e28                                                                                XREF[1]:          01a950a0(*)
     016d1e28  6b                          ??                                                    6Bh    k
     016d1e29  01                          ??                                                    01h
     016d1e2a  00                          ??                                                    00h
     016d1e2b  00                          ??                                                    00h
     016d1e2c 36                          ??                                                    36h    6
     016d1e2d  00                          ??                                                    00h
     016d1e2e  1c                           ??                                                    1Ch
     016d1e2f  00                          ??                                                    00h
                                                  DAT_016d1e30                                                                                XREF[1]:          01a9514c(*)
     016d1e30  6b                          ??                                                    6Bh    k
      016d1e31  01                          ??                                                    01h
     016d1e32  00                          ??                                                    00h
     016d1e33  00                          ??                                                    00h
     016d1e34  02                          ??                                                    02h
     016d1e35  00                          ??                                                    00h
     016d1e36  1c                           ??                                                    1Ch
     016d1e37  40                          ??                                                    40h    @
                                                  DAT_016d1e38                                                                                XREF[1]:          01a951dc(*)
     016d1e38  6b                          ??                                                    6Bh    k
     016d1e39  01                          ??                                                    01h
     016d1e3a  00                          ??                                                    00h
     016d1e3b  00                          ??                                                    00h
     016d1e3c 03                          ??                                                    03h
     016d1e3d  00                          ??                                                    00h
     016d1e3e  1c                           ??                                                    1Ch
     016d1e3f  00                          ??                                                    00h
                                                  DAT_016d1e40                                                                                XREF[1]:          01a95260(*)
     016d1e40  6b                          ??                                                    6Bh    k
     016d1e41  01                          ??                                                    01h
     016d1e42  00                          ??                                                    00h
     016d1e43  00                          ??                                                    00h
     016d1e44  33                          ??                                                    33h    3
     016d1e45  00                          ??                                                    00h
     016d1e46  1c                           ??                                                    1Ch
     016d1e47  00                          ??                                                    00h
                                                  DAT_016d1e48                                                                                XREF[1]:          01a95518(*)
     016d1e48  6b                          ??                                                    6Bh    k
     016d1e49  01                          ??                                                    01h
     016d1e4a  00                          ??                                                    00h
    016d1e4b  00                          ??                                                    00h
     016d1e4c 21                           ??                                                    21h    !
    016d1e4d  00                          ??                                                    00h
     016d1e4e  1c                           ??                                                    1Ch
     016d1e4f  00                          ??                                                    00h
                                                  DAT_016d1e50                                                                                XREF[1]:          01a95998(*)
     016d1e50  6b                          ??                                                    6Bh    k
      016d1e51  01                          ??                                                    01h
     016d1e52  00                          ??                                                    00h
     016d1e53  00                          ??                                                    00h
     016d1e54  81                          ??                                                    81h
     016d1e55  00                          ??                                                    00h
     016d1e56  1c                           ??                                                    1Ch
     016d1e57  00                          ??                                                    00h
                                                  DAT_016d1e58                                                                                XREF[1]:          01a95a40(*)
     016d1e58  6b                          ??                                                    6Bh    k
     016d1e59  01                          ??                                                    01h
     016d1e5a  00                          ??                                                    00h
     016d1e5b  00                          ??                                                    00h
     016d1e5c 00                          ??                                                    00h
     016d1e5d  00                          ??                                                    00h
     016d1e5e  1c                           ??                                                    1Ch
     016d1e5f  40                          ??                                                    40h    @
                                                  DAT_016d1e60                                                                                XREF[1]:          01a95b0c(*)
     016d1e60  6b                          ??                                                    6Bh    k
     016d1e61  01                          ??                                                    01h
     016d1e62  00                          ??                                                    00h
     016d1e63  00                          ??                                                    00h
     016d1e64  91                          ??                                                    91h
     016d1e65  00                          ??                                                    00h
     016d1e66  1c                           ??                                                    1Ch
     016d1e67  00                          ??                                                    00h
...
</code>```

such data, tried using terminatedCstring option but still didn't do on all of it. because these are so much and don't know easy way to do this.

btw how can I search through and get the value 1.8 in the binary?

Edit : such long days and no answer I had the feeling to share the apk game I was trying to reverse engineer. Hope it helps.


问:
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?

I've found various answers to questions similar to this, but they're answering questions that are far more specific to the OPs use-case. I often see that searching for three (console) or four (GUI) pushes somewhere within the CRT libraries is recommended, but this sometimes is too weak of an indication for me (envp is optional, weird startup wrapping libraries, etc.)

Are there any more solid ways to look for the main(), WinMain or DllMain() functions in Windows PE files?


问:
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:</p>
```<code>*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80666bd1151, The address that the exception occurred at
Arg3: ffff9e8e84a36708, Exception Record Address
Arg4: ffff9e8e84a35f40, Context Record Address

Debugging Details:
------------------

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1656

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 1710

    Key  : Analysis.Init.CPU.mSec
    Value: 608

    Key  : Analysis.Init.Elapsed.mSec
    Value: 5677

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 107

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x7e

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x7e

    Key  : Bugcheck.Code.Register
    Value: 0x7e

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1

FILE_IN_CAB:  MEMORY_20220819.DMP

BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc000001d

BUGCHECK_P2: fffff80666bd1151

BUGCHECK_P3: ffff9e8e84a36708

BUGCHECK_P4: ffff9e8e84a35f40

EXCEPTION_RECORD:  ffff9e8e84a36708 -- (.exr 0xffff9e8e84a36708)
ExceptionAddress: fffff80666bd1151 (nt!strlen+0x0000000000000031)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  ffff9e8e84a35f40 -- (.cxr 0xffff9e8e84a35f40)
rax=ffffa086f1dd9cc8 rbx=ffffa086f1dd9c10 rcx=00005f790e2263f0
rdx=0000000000000000 rsi=ffffa086f1e10078 rdi=0000000000000000
rip=fffff80666bd1151 rsp=ffff9e8e84a36948 rbp=ffff9e8e84a36a29
 r8=7efefefefefefeff  r9=eb636d60672c6b60 r10=ffffffff00000003
r11=8101010101010100 r12=ffff9e8e84a36d98 r13=0000000000000001
r14=ffffa086f1dd9c10 r15=ffffa086efab1028
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
nt!strlen+0x31:
fffff806`66bd1151 488b10          mov     rdx,qword ptr [rax] ds:002b:ffffa086`f1dd9cc8=392c303037313d65
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc000001d - {   ~}       T     O           @     T     O C

EXCEPTION_CODE_STR:  c000001d

EXCEPTION_STR:  0xc000001d

FAILED_INSTRUCTION_ADDRESS:
nt!strlen+31
fffff806`66bd1151 488b10          mov     rdx,qword ptr [rax]

STACK_TEXT:
ffff9e8e`84a36948 fffff807`311fe7b7     : ffffa086`ffe2fd50 00000000`00000000 ffffa086`f1dd9c10 fffff807`311fe347 : nt!strlen+0x31
ffff9e8e`84a36950 fffff807`311fe477     : fffff807`312bb710 00000000`00000000 ffffa086`f61c9470 00000000`f1e10078 : acpis!AgentSetState+0x76e7
ffff9e8e`84a36980 fffff807`311fe0e2     : d3e7328e`00020008 ffffa086`ffe2e440 ffffa086`efab1028 ffff9e8e`84a36b90 : acpis!AgentSetState+0x73a7
ffff9e8e`84a36a90 fffff807`312008ad     : 00000000`ffffffff 00000000`00000000 ffffa087`0a011808 ffffa086`f1dd9c10 : acpis!AgentSetState+0x7012
ffff9e8e`84a36ac0 fffff807`31200fea     : ffffa086`fb2f9228 ffff9e8e`84a36bc0 ffffa086`fb0e94a0 ffffa086`f1dd9c10 : acpis!sd_StrToUnicode+0x1335
ffff9e8e`84a36b00 fffff807`311fc6d0     : ffff9e8e`84a36d98 fffff807`312054b2 ffffa086`f61c9470 ffffa086`f1dd9c10 : acpis!ag_CacheReleaseEx2+0xe
ffff9e8e`84a36b30 fffff807`3113d20e     : ffffa086`fb2f9228 ffffa086`fb0e94a0 ffffa086`fb0e94a0 00000000`00000000 : acpis!AgentSetState+0x5600
ffff9e8e`84a36b60 fffff807`3113ca60     : ffff9e8e`84a36c38 00000000`00000000 ffffa086`f61c9470 ffff9e8e`84a36cf0 : acpis!sd_CommandRegister+0x1956
ffff9e8e`84a36bf0 fffff807`3113db0d     : 00000000`00000001 fffff807`31136327 ffff9e8e`84a36f10 ffff9e8e`84a36ef8 : acpis!sd_CommandRegister+0x11a8
ffff9e8e`84a36d10 fffff807`3113c71a     : 00000000`00000001 00000000`00000000 ffffa086`f61e24e8 ffffa086`f9d6ec68 : acpis!sd_CommandRegister+0x2255
ffff9e8e`84a36d50 fffff807`3113db0d     : 00000000`00000001 fffff807`3113693b ffff9e8e`84a37080 00000000`00020e7d : acpis!sd_CommandRegister+0xe62
ffff9e8e`84a36e70 fffff807`3113cb36     : 00000000`00000000 00000000`00000000 00000000`88963d99 ffffa086`f59ff288 : acpis!sd_CommandRegister+0x2255
ffff9e8e`84a36eb0 fffff807`3113db0d     : ffffa086`f72e2c50 ffffa087`2cc1b340 00000000`00000004 00000000`00000001 : acpis!sd_CommandRegister+0x127e
ffff9e8e`84a36fd0 fffff807`3113da79     : 00000000`00000000 ffffa086`f6153ca8 ffffa087`15025758 fffff807`311fdd16 : acpis!sd_CommandRegister+0x2255
ffff9e8e`84a37010 fffff807`3113bbc8     : 00000000`0000000a fffff807`311fe098 00000000`00020001 ffffa087`15025758 : acpis!sd_CommandRegister+0x21c1
ffff9e8e`84a37050 fffff807`3113bda9     : 00000000`00000000 ffffa086`f61c9208 ffffa086`f6153ca8 ffff9e8e`84a371e0 : acpis!sd_CommandRegister+0x310
ffff9e8e`84a370c0 fffff807`311481fd     : 00000000`00000000 ffffa087`038fc5e0 00000000`00000000 00000000`00000000 : acpis!sd_CommandRegister+0x4f1
ffff9e8e`84a37150 fffff807`311fdc31     : ffffa086`00000001 ffffa086`f3a56308 ffffa086`f3a56308 ffffa086`f3a56338 : acpis!sd_ShouldGenerateEvent+0x2131
ffff9e8e`84a372f0 fffff807`311fe3f5     : ffffa086`0002000f ffffa086`f5ffb030 ffff9e8e`84a373c0 00000000`00000000 : acpis!AgentSetState+0x6b61
ffff9e8e`84a37360 fffff807`31200dca     : ffffa086`f1e10780 fffff807`3114056d 00000000`00000000 00000000`ffffffff : acpis!AgentSetState+0x7325
ffff9e8e`84a373a0 fffff807`31147b92     : ffffa086`f7339b68 00000000`ffffffff 00000000`00000000 ffffa086`f6e0f190 : acpis!ag_CacheHandleIterateByKey+0x22
ffff9e8e`84a373e0 fffff807`31143b35     : ffffa086`f5ffb030 ffffa086`f6e0f190 ffffa087`097d1c30 ffffffff`00000001 : acpis!sd_ShouldGenerateEvent+0x1ac6
ffff9e8e`84a37450 fffff807`31143f8d     : ffffa086`f5ffb030 00000000`00000080 ffffa087`0a02bde8 00000000`000000fa : acpis!sd_PackageLookup+0x799
ffff9e8e`84a37480 fffff807`31143df2     : 00000000`000001f5 fffff807`3131fc78 00000000`00000080 fffff807`3131fc78 : acpis!sd_PackageLookup+0xbf1
ffff9e8e`84a374b0 fffff807`31201af7     : 00000000`00020008 ffffa086`f5fb8040 00000000`00000000 40200000`00020001 : acpis!sd_PackageLookup+0xa56
ffff9e8e`84a374e0 fffff806`66b58235     : ffffa086`00000001 ffffa086`f5fb8040 fffff807`31201a5c fffff807`3131fc78 : acpis!ag_CacheReleaseEx2+0xb1b
ffff9e8e`84a37510 fffff806`66bfff48     : ffffb681`de266180 ffffa086`f5fb8040 fffff806`66b581e0 40200000`00000000 : nt!PspSystemThreadStartup+0x55
ffff9e8e`84a37560 00000000`00000000     : ffff9e8e`84a38000 ffff9e8e`84a31000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME:  acpis!AgentSetState+76e7

MODULE_NAME: acpis

IMAGE_NAME:  acpis.sys

STACK_COMMAND:  .cxr 0xffff9e8e84a35f40 ; kb

BUCKET_ID_FUNC_OFFSET:  76e7

FAILURE_BUCKET_ID:  0x7E_C000001D_BAD_IP_acpis!AgentSetState

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5e9d13b4-b1d6-a821-2e66-355ff6907131}

Followup:     MachineOwner
---------

7: kd> !blackboxpnp
    PnpActivityId      : {00000000-0000-0000-0000-000000000000}
    PnpActivityTime    : 133053779797965442
    PnpEventInformation: 3
    PnpEventInProgress : 0
    PnpProblemCode     : 24
    PnpVetoType        : 0
    DeviceId           : HID\{00001812-0000-1000-8000-00805f9b34fb}_Dev_VID&02046d_PID&b030_REV&0004_d34174814fef&Col02\9&1a638cbc&0&0001
    VetoString         :
</code>```

Title: c000001d (Illegal instruction)


问:
View v0, d0 registers in Cutter (ARM64)
When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0.xb, d0 registers etc and the values they hold?</p>

Title: View v0, d0 registers in Cutter (ARM64)


问:
Tuning motor temperature
I have a DC motor, running in two modes, slow and fast. I will need to run the motor in FAST mode only. The motor is already running for 10 years. The motor experiences variable load.
According to the graph in fig 1, the red line shows the Fast speed with 10 Nm force. The blue line shows a slow speed of 15 Nm. And the top line is the test run in fig 2.

The motor runs for 6 hours at FAST speed. At FAST speed, the motor temperature raises from 25 °C to 90 °C during these 6 hours with a 10 Nm force at 1.4 A current. And stays at 90 °C. With 10 Nm, the motor reaches 90 °C, which is under the temperature limit.

The motor temperature limit is 110°C before it shuts off.

Fig 1

When I increase the load on the motor to 26 Nm, the motor temperature reaches 110°C in 30 minutes, and the motor shuts off.

To solve this issue, I have to run the motor at certain times at fast and slow speeds. I put in a microcontroller to switch between these two modes. For this, I have run a test that kept the motor running for 129 minutes (2 hours and 15 minutes) by switching between fast and slow modes.

Fig 2

My goal is to keep the motor running without stopping.

As shown in Fig 2, starting in the first 25 minutes the datasheet reaches 80°C. Afterwards, I put the motor on slow speed for 40 minutes, and the temperature keeps rising to 89°C. Then I put the motor into the fast mode for 10 minutes, and so on, until the temperature reaches 110 °C and the motor shuts off.

With doing the above switching from fast to slow, the temperature goes down, and the run time increases to 129 minutes.

I can’t put a thermometer on the motor due to limitations. The only thing I can measure is the current and time.

I need to know what to do to keep the motor temperature lower than 110°C by switching between fast and slow. I am not sure for how long I should run the motor at each speed, so the overall temperature doesn’t reach 110°C and the time increases to 6 hours and more.

Title: Tuning motor temperature


问:
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the Lumina server of Hex-Ray or a post to describe this functionnalities for a real case of RE.

So for the price, in case of RE on dll build in VS (MFC Library, Boost, openSSL, tinyXml and some other static library). Lumina can really save lot of my time to identify the "real" content between the embeded static library content ?

Thank you in advance..

Title: IDA Free vs IDA Home (to have Lumina)


问:
Are there sampling profilers for stripped binaries?
I have a stripped binary in which I need to find the code for a particular function. I can run the binary on input which will make it spend a significant percentage of CPU time in that function. Maybe 5%-10% and the app is multi threaded.

So I can probably just run it under GDB (it's on Linux), break it a few times with C-c and have a good chance of hitting the function.

This approach is a bit like a sampling profiler, just done manually. Which brings me to the question: is there a tool which I could use to do this automatically?


问:
Is it possible for different dynamic memory addresses to share the same offset value?
I am currently using cheat engine to hack a game. I used the pointer scanner to find some pointers to the pistol ammo memory location. I then went to look for pointers to the shotgun ammo memory location, which obviously is at a different address. Looking at the offset for the shotgun memory location it says is the same offset as the pistol ammo. How can I do a pointer scan for a memory location that has the same offset as another location in memory? I tried running a pointer scan to the shotgun ammo memory location using the same offset as the pistol ammo and it found nothing.</p>


问:
How to disassemble Renesas RX210 MCU firmware?
I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?</p>


问:
differences in ASLR on Linux and Windows
Reflecting on some RE I've done recently I'm curious about how differently ASLR works across Windows and Linux :-

Is it enough to compile shared libraries on Linux with the fPIC flag so that they can take advantage of the ASLR system wide setting?

On Windows are there any compile time settings other than ASCOMPAT that I should enable in order to take advantage of ASLR?

Are there any ways in which the ASLR implementation is better in one platform that the other?


问:
How to find the fifth function argument on stack in windbg?
I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value for other use. So I guess I need to access the fifth argument through offset of rsp in prolog. I guess space is allocated for stack-based arguments and homing space in the following instruction.

sub     rsp,60h

My assumption is that the fifth argument is below the homing space if all 4 registers are passed to homing space. However, as you can see, only r8 and RCX are pushed on stack. I can understand that since that's how x64 works. But this makes me confused because I don't know which one is the fifth argument. I think the command should look like

dt typename @rsp+offset

I don't want to brute force by the way since it may be difficult for functions with many arguments and unknown types.

```<code>0: kd> uf tcpip!IppFindPath
tcpip!IppFindPath:
fffff806`b9b38494 48895c2420      mov     qword ptr [rsp+20h],rbx
fffff806`b9b38499 4c89442418      mov     qword ptr [rsp+18h],r8
fffff806`b9b3849e 48894c2408      mov     qword ptr [rsp+8],rcx
fffff806`b9b384a3 55              push    rbp
fffff806`b9b384a4 56              push    rsi
fffff806`b9b384a5 57              push    rdi
fffff806`b9b384a6 4154            push    r12
fffff806`b9b384a8 4155            push    r13
fffff806`b9b384aa 4156            push    r14
fffff806`b9b384ac 4157            push    r15
fffff806`b9b384ae 4883ec60        sub     rsp,60h
fffff806`b9b384b2 488b4128        mov     rax,qword ptr [rcx+28h]
fffff806`b9b384b6 4d8bd0          mov     r10,r8
fffff806`b9b384b9 418bd9          mov     ebx,r9d
fffff806`b9b384bc 4c8bea          mov     r13,rdx
fffff806`b9b384bf 4c8bf1          mov     r14,rcx
fffff806`b9b384c2 498bd2          mov     rdx,r10
fffff806`b9b384c5 8b0d61cc1f00    mov     ecx,dword ptr [tcpip!g_37HashSeed (fffff806`b9d3512c)]
fffff806`b9b384cb 4c8b4810        mov     r9,qword ptr [rax+10h]
fffff806`b9b384cf 410fb76906      movzx   ebp,word ptr [r9+6]
fffff806`b9b384d4 448bc5          mov     r8d,ebp
fffff806`b9b384d7 48ff1502832100  call    qword ptr [tcpip!_imp_RtlCompute37Hash (fffff806`b9d507e0)]
fffff806`b9b384de 0f1f440000      nop     dword ptr [rax+rax]
fffff806`b9b384e3 b102            mov     cl,2
fffff806`b9b384e5 498db600030000  lea     rsi,[r14+300h]
fffff806`b9b384ec 448be0          mov     r12d,eax
fffff806`b9b384ef 410fbaec1f      bts     r12d,1Fh
</code>```


问:
Auto-loaded type information and relationship between .til and .sig: how to find links and how to change them (config)?
NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm.

Let's say I load a PE file, which happens to be a 64-bit Windows driver. I may then see in the Output pane (redacted for brevity):

```<code>IDA is analysing the input file...
You may start to explore the input file right now.
...
Using FLIRT signature: Windows Driver Kit 7/10 64bit
Propagating type information...
</code>```

Now "Windows Driver Kit 7/10 64bit" corresponds to $IDADIR/sig/pc/ms64wdk.sig (found with dumpsig). Fair enough. I also know that $IDADIR/sig/pc/autoload.cfg governs what type information library (.til) file gets loaded based on the loading of a signature.

Alas, there is no entry that maps the aforementioned $IDADIR/sig/pc/ms64wdk.sig to ntddk64_win7 and ntapi64_win7. Yet, when I use Produce file -> Dump database to IDC file... the resulting .idc file has the following calls among its first actions (again redacted for brevity):

```<code>#define UNLOADED_FILE   1
#include <idc.idc>

static main(void) {
    // ...
    GenInfo();            // various settings
    // ...
}

static GenInfo(void) {

    // ...
    add_default_til("ntddk64_win7");
    add_default_til("ntapi64_win7");
}
</code>```

Questions:

How does IDA make the connection between the FLIRT (.sig) and the .til here? (Apparently $IDADIR/sig/pc/autoload.cfg has no bearing.)

Given there are also other .til files like ntddk64_win10.til, ntapi64_win10.til:

How can I configure IDA to load those instead of the somehow implicit ntddk64_win7 and ntapi64_win7 respectively?

Assuming I can't override the behavior or have an existing IDB which had the implicit ntddk64_win7 and ntapi64_win7 applied: If I now use add_default_til("ntddk64_win10") and add_default_til("ntapi64_win10") (no matter whether IDC or IDAPython) will this adversely affect existing usage of type information (e.g. enums which were imported from standard enums)? How does it affect existing usage?

What is the relation between the ntddk64.til and, say, ntddk64_vista.til, ntddk64_win7.til, ntddk64_win8.til, ntddk64_win81.til and ntddk64_win10.til? Is ntddk64.til the superset? Some subset?

PS: Pointers to official documentation very much welcome.


问:
how to hide all export functions in a elf so library?
I have this game I want to patch, the game server executable loads a elf so library with functions. I want to add new functions into this library so I patched the game server executable with elfpatch and now it loads a duplicated of the elf library.

with the identical 2 libraries loaded the game is crashing on start, and I want to remove the export property of all the functions in the duplicated elf library so I can start the game with no errors.

I duplicated because my intention is to rename some of the funcions with new names so the game server can use them. They are all game skills.


问:
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even with ASLR, API calls in one process should always point to the same address as in any other process, as loading a section view at a different address will cause relocation fuckery. Can someone point me to a resource confirming this? I am using a very obtuse library injection technique and want to make sure I don’t need to resolve imports to use standard api calls.</p>


问:
Changing Offset Value with frida
So I found this offset in ghidra, and I want to change that offsets value in Frida

with this picture I have deduced that the offset is 0x6ae210

What I want to do with this is change game.brawlstarsgame.com to something else

Im using Frida on iOS in "code_signing": "required" mode which means that it will run on non jailbreak (the only drawback is that I cannot use Interceptor)

I've tried using this code, but it failed:

```<code>var base = Module.findBaseAddress("Brawl Stars");
var connector = base.add(0x6ae210).writeUtf8String("my_ip");
</code>```

this has however failed

I have also tried just changing the value in a hex editor, but the ipa does not install: Sideloadly gives me an error and Altstore refuses to install it

Sideloadly error: ERROR: Guru Meditation e78e76@447:14dd8f ('expected 55, found 54', SwitchError('no default case defined'))

is there some way to replace the value of game.brawlstarsgame.com without using interceptor, or could someone explain the process of changing strings in a macho binary with hex patching?

Title: Changing Offset Value with frida


问:
Reverse-engineering the Sony Camset (Camera Settings) file format

Context

Newer Sony cameras have functionality that allows them to:

save the current camera settings (shooting mode, auto-focus mode, etc.) to a file

load the camera settings from a file into the system

These files are called Camset (Camera Settings) files. They usually are named like: CAMSET01.DAT

(Other camera manufacturers have this too, but the format seems to be manufacturer-specific.)

Question

I'm looking for help on how to figure out the specific format of these Camset files. (If you're interested, go to the link at the bottom where I have sample Camset files)

I have not been able to find anywhere where the Sony Camset format is documented. Canon also uses Camset files, but their files are .txt and not binary formatted from what I can tell (I don't have a Canon camera and I haven't been able to find any Canon Camset files online, but I've seen the .txt suffix used on them in manuals).

What I know

The files are binary format. There are ASCII strings present in the first several bytes, that indicate the manufacturer, camera model, date created, and the file/preset name.

Snippet from hexdump of first few bytes

```<code>00000000  53 4f 4e 59 21 49 4c 43  45 2d 37 52 4d 34 00 00  |SONY!ILCE-7RM4..|
00000010  00 00 00 00 00 32 30 32  32 30 39 30 36 5f 31 33  |.....20220906_13|
00000020  32 33 31 00 14 00 01 00  43 41 4d 53 45 54 30 31  |231.....CAMSET01|
00000030  2e 44 41 54 01 06 00 00  a8 0b 00 00 b8 05 00 00  |.DAT............|
</code>```

The length of the file is identical, but only across models. For Sony A7R4 cameras, the file length is exactly 9216 bytes, and for Sony A9 cameras, it's 9696 bytes.

The image filename prefix (e.g. 'DSC' or 'A7R') is stored at byte 2860 (for Sony A7R4) and is 3 bytes long

--

That's basically all I know so far.

What I've tried so far

I have tried creating a camset file, then changing one setting only, then creating another camset file, and then comparing the two camset files -- I expected to see maybe a handful of bytes differences (which would tell me where the setting was stored), but that wasn't the case, the files seem to differ heavily even when the settings do not differ much.

Tools

I made a very rudimentary C++ tool that lets me extract the name, date, camera model, and image name prefix from Camset files:

https://github.com/raleighlittles/Sony-Camset-File-Parser

This is what I've been using to test with, as this repository also has a few sample Camset files in the camset-files directory.