问:
Means of generating file hashes
I'm working with a relatively well secured program. In addition to memory validation checks during run time, the actual file integrity is checked at start. Both checks are synced with the server and I've gotten past the run time.

I could just automatically write to the process once it's open, but just for fun I'd like to be able to actually hex edit the file. I'm not really sure where to start. I can provide that the program was written in C++ with a somewhat older version of Visual Studio. I'm sure many of the people on here have dealt with something similar, so could I have a general pointer as to where to start (e.g. how it's likely getting the data, if needed, or some windows function)?

ContentLicense: CC BY-SA 3.0

Title: Means of generating file hashes


问:
IDA Plugin to diff functions within the same binary
Sometimes by reversing I find several functions within the same binary file which look suspiciously similar. Is there a plugin/script to quickly compare them and see their differences?

P.S. I'm aware of the myriad of tools for doing binary diffing between two different binaries, for example for doing patch diffing . This is not what I am looking for.


问:
Converting Duden dictionaries for Stardict/Goldendict
I’ve a bunch of first-class German dictionaries by Duden (the main German dictionary publisher) which, sadly, use a closed proprietary data format and their dedicated Duden-Bibliothek application (Information in German).

I’m usually using Goldendict on my tablet. Is there any possibility to convert my dictionaries to Stardict/Goldendict format so I can use them on my Android devices ?

I’ve looked into stardict-tools but can’t convert.


问:
How to modify arm .so?
I want to modify android app writen on c++.

It stores its code mostly in .so file. The code is compiled for arm architecture.

When  I open it in IDA it says that it can only read but modify.

But I need to inject one arm command. How can I do this?

Title: How to modify arm .so?


问:
Resources for API Hooking and DLL Injection
What are great resources and essential skills needed to become a proficient reverse engineer regarding API Hooking and DLL Injection? I would like to use a comprehensive book instead of scattered white-papers across the web. </p>


问:
Reverse Engineer firmware for Jffs2 filesystem in Qemu
I am looking at the firmware for my router C1000A/C1000A-D and I am having some difficulties in mounting and otherwise emulating this. From what I have read, the general process for reverse engineering firmware is to extract the firmware and run it in Qemu or mount it to your filesystem.

I have managed to extract what I believe to be the filesystem from the following

```<code>$> binwalk -e --dd="lzma:7z:7zip -d %e" CAC002-31.30L.76.img
</code>```

I see that there is a tool that will try to mount this runs called unjffs2 when I run this it fails with a seemingly unsolvable issue of a driver not being loaded. However oddly enough, a file system mounts and there is just a bunch of empty folders.

```<code>$> ./unjffs2 4000.jffs2
Converting image to little endian...
Wrong bitmask  at  0x00033fe8, 0x0000
Wrong bitmask  at  0x00033fec, 0x0000
Wrong bitmask  at  0x00033ff0, 0x0000
Wrong bitmask  at  0x00033ff4, 0x0000
Wrong bitmask  at  0x00033ff8, 0x0000
Wrong bitmask  at  0x00033ffc, 0x0000
Wrong bitmask  at  0x00063f68, 0x0000
Wrong bitmask  at  0x00063f6c, 0x0000
Wrong bitmask  at  0x00063f70, 0x0000
Wrong bitmask  at  0x00063f74, 0x0000
Wrong bitmask  at  0x00063f78, 0x0000
Wrong bitmask  at  0x00063f7c, 0x0000
Wrong bitmask  at  0x00063f80, 0x0000
Wrong bitmask  at  0x00063f84, 0x0000
Wrong bitmask  at  0x00063f88, 0x0000
Wrong bitmask  at  0x00063f8c, 0x0000
Wrong bitmask  at  0x00063f90, 0x0000
Wrong bitmask  at  0x00063f94, 0x0000
Wrong bitmask  at  0x00063f98, 0x0000
Wrong bitmask  at  0x00063f9c, 0x0000
Wrong bitmask  at  0x00063fa0, 0x0000
Wrong bitmask  at  0x00063fa4, 0x0000
Wrong bitmask  at  0x00063fa8, 0x0000
...
Wrong bitmask  at  0x000f3ff0, 0x0000
Wrong bitmask  at  0x000f3ff4, 0x0000
Wrong bitmask  at  0x000f3ff8, 0x0000
Wrong bitmask  at  0x000f3ffc, 0x0000
modprobe: FATAL: Module mtdchar not found.
2033+1 records in
2033+1 records out
1041200 bytes (1.0 MB) copied, 0.00570635 s, 182 MB/s
JFFS2 image mounted to jffs2-root
</code>```

At this point,  since I don't see any mtdchar driver in my system (Ubuntu based).

I think the best method would be to run in Qemu. How can I do this ?


问:
Extracting Firmware problem with Binwalk
I'm in the process of trying to reverse engineer a firmware from unknown vendor. Here's what I got so far

I have the firmware image (.mg file). AFAIK it's no common image, I couldn't find any information about it from googling
Here's the binwalk output:

```
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2149          0x865           HTML document header
2685          0xA7D           HTML document footer
2685          0xA7D           HTML document header
3052          0xBEC           HTML document footer
3052          0xBEC           HTML document header
3483          0xD9B           HTML document footer
3483          0xD9B           HTML document header
3747          0xEA3           HTML document footer
3747          0xEA3           HTML document header
5542          0x15A6          HTML document footer
8071          0x1F87          HTML document header
10462         0x28DE          HTML document footer
10463         0x28DF          HTML document header
10962         0x2AD2          HTML document footer
43377         0xA971          HTML document header
43752         0xAAE8          HTML document footer
43753         0xAAE9          HTML document header
47269         0xB8A5          HTML document footer
47269         0xB8A5          HTML document header
50689         0xC601          HTML document footer
50690         0xC602          HTML document header
52285         0xCC3D          HTML document footer
52289         0xCC41          HTML document header
54387         0xD473          HTML document footer
54389         0xD475          HTML document header
66620         0x1043C         HTML document footer
66621         0x1043D         HTML document header
70158         0x1120E         HTML document footer
70159         0x1120F         HTML document header
89096         0x15C08         HTML document footer
89329         0x15CF1         Copyright string: " © 2008.  All rights reserved."
96973         0x17ACD         GIF image data, version "89a", 9 x 9
97819         0x17E1B         GIF image data, version "89a", 1600 x 3
98790         0x181E6         GIF image data, version "89a", 780 x 10
99797         0x185D5         GIF image data, version "89a", 780 x 10
100806        0x189C6         HTML document header
126955        0x1EFEB         HTML document footer
126957        0x1EFED         HTML document header
133790        0x20A9E         HTML document footer
133792        0x20AA0         HTML document header
149863        0x24967         HTML document footer
149865        0x24969         HTML document header
157824        0x26880         HTML document footer
157826        0x26882         HTML document header
173039        0x2A3EF         HTML document footer
173041        0x2A3F1         HTML document header
201137        0x311B1         HTML document footer
201139        0x311B3         HTML document header
207772        0x32B9C         HTML document footer
207773        0x32B9D         HTML document header
219240        0x35868         HTML document footer
219241        0x35869         HTML document header
220859        0x35EBB         HTML document footer
220860        0x35EBC         HTML document header
229141        0x37F15         HTML document footer
229142        0x37F16         HTML document header
237943        0x3A177         HTML document footer
237943        0x3A177         HTML document header
243109        0x3B5A5         HTML document footer
243110        0x3B5A6         HTML document header
248986        0x3CC9A         HTML document footer
248987        0x3CC9B         HTML document header
256674        0x3EAA2         HTML document footer
256675        0x3EAA3         HTML document header
264418        0x408E2         HTML document footer
264419        0x408E3         HTML document header
267737        0x415D9         HTML document footer
267791        0x4160F         HTML document header
278611        0x44053         HTML document footer
278612        0x44054         HTML document header
302510        0x49DAE         HTML document footer
302511        0x49DAF         HTML document header
340467        0x531F3         HTML document footer
340468        0x531F4         HTML document header
350590        0x5597E         HTML document footer
350591        0x5597F         HTML document header
353983        0x566BF         HTML document footer
353984        0x566C0         HTML document header
400086        0x61AD6         HTML document footer
400087        0x61AD7         HTML document header
402883        0x625C3         HTML document footer
936805        0xE4B65         Zlib compressed data, default compression
949237        0xE7BF5         Zlib compressed data, compressed
959131        0xEA29B         Zlib compressed data, compressed
992718        0xF25CE         Zlib compressed data, best compression
999966        0xF421E         Zlib compressed data, default compression
1014782       0xF7BFE         Zlib compressed data, default compression
1018489       0xF8A79         Zlib compressed data, default compression
1032857       0xFC299         Zlib compressed data, default compression
1042869       0xFE9B5         Zlib compressed data, compressed
1044292       0xFEF44         Zlib compressed data, best compression
1052372       0x100ED4        Zlib compressed data, compressed
1055182       0x1019CE        Zlib compressed data, default compression
1071400       0x105928        Zlib compressed data, default compression
1076050       0x106B52        Zlib compressed data, best compression
1096297       0x10BA69        Zlib compressed data, compressed
1137920       0x115D00        Zlib compressed data, compressed
1170902       0x11DDD6        Zlib compressed data, compressed
1186555       0x121AFB        Zlib compressed data, compressed
1188821       0x1223D5        Zlib compressed data, default compression
1195821       0x123F2D        Zlib compressed data, default compression
1201862       0x1256C6        Zlib compressed data, compressed
1236300       0x12DD4C        Zlib compressed data, compressed
1279273       0x138529        Zlib compressed data, compressed
1280971       0x138BCB        Zlib compressed data, compressed
1302926       0x13E18E        Zlib compressed data, best compression
1303266       0x13E2E2        Zlib compressed data, compressed
1312923       0x14089B        Zlib compressed data, default compression
1332979       0x1456F3        Zlib compressed data, default compression
1340608       0x1474C0        Zlib compressed data, best compression
1378862       0x150A2E        Zlib compressed data, compressed
1398072       0x155538        Zlib compressed data, default compression
1415562       0x15998A        Zlib compressed data, compressed
1464907       0x165A4B        Zlib compressed data, default compression
1500357       0x16E4C5        Zlib compressed data, best compression
1500644       0x16E5E4        Zlib compressed data, default compression
1527997       0x1750BD        compress'd data, 16 bits
1544522       0x17914A        Zlib compressed data, best compression
1552354       0x17AFE2        Zlib compressed data, best compression
1571408       0x17FA50        Zlib compressed data, compressed
1581827       0x182303        Zlib compressed data, best compression
1591785       0x1849E9        Zlib compressed data, compressed
1605018       0x187D9A        Zlib compressed data, default compression
1620883       0x18BB93        Zlib compressed data, compressed
1657385       0x194A29        Zlib compressed data, compressed
1660472       0x195638        Zlib compressed data, compressed
1676765       0x1995DD        Zlib compressed data, default compression
1677967       0x199A8F        Zlib compressed data, best compression
1716067       0x1A2F63        Zlib compressed data, best compression
1805822       0x1B8DFE        Zlib compressed data, compressed
1816311       0x1BB6F7        Zlib compressed data, compressed
1828850       0x1BE7F2        Zlib compressed data, compressed
1847543       0x1C30F7        Zlib compressed data, compressed
1884695       0x1CC217        Zlib compressed data, compressed
1897488       0x1CF410        Zlib compressed data, best compression
1897690       0x1CF4DA        Zlib compressed data, compressed
1942524       0x1DA3FC        Zlib compressed data, best compression
1963605       0x1DF655        Zlib compressed data, compressed
1975034       0x1E22FA        Zlib compressed data, compressed
1977041       0x1E2AD1        Zlib compressed data, compressed
1997374       0x1E7A3E        Zlib compressed data, compressed
2036964       0x1F14E4        Zlib compressed data, default compression
2037783       0x1F1817        Zlib compressed data, compressed
2041756       0x1F279C        Zlib compressed data, compressed
2051259       0x1F4CBB        Zlib compressed data, compressed
2063154       0x1F7B32        Zlib compressed data, best compression
2072756       0x1FA0B4        Zlib compressed data, default compression
2076724       0x1FB034        Zlib compressed data, compressed
2082453       0x1FC695        Zlib compressed data, default compression
2093131       0x1FF04B        Zlib compressed data, compressed
2107066       0x2026BA        Zlib compressed data, compressed
2107321       0x2027B9        Zlib compressed data, default compression
2121073       0x205D71        Zlib compressed data, compressed
2125853       0x20701D        Zlib compressed data, best compression
2126493       0x20729D        Zlib compressed data, best compression
2154155       0x20DEAB        Zlib compressed data, compressed
2177138       0x213872        Zlib compressed data, compressed
2195782       0x218146        Zlib compressed data, best compression
2199697       0x219091        Zlib compressed data, compressed
2211810       0x21BFE2        Zlib compressed data, default compression
2237221       0x222325        Zlib compressed data, default compression
2245919       0x22451F        Zlib compressed data, best compression
2257118       0x2270DE        Zlib compressed data, compressed
2265100       0x22900C        Zlib compressed data, compressed
2276225       0x22BB81        Zlib compressed data, compressed
2285428       0x22DF74        Zlib compressed data, best compression
2286328       0x22E2F8        Zlib compressed data, best compression
2300068       0x2318A4        Zlib compressed data, compressed
2306513       0x2331D1        Zlib compressed data, default compression
2324445       0x2377DD        Zlib compressed data, default compression
2339864       0x23B418        Zlib compressed data, best compression
2349252       0x23D8C4        Zlib compressed data, compressed
2358483       0x23FCD3        Zlib compressed data, compressed
2375872       0x2440C0        Zlib compressed data, compressed
2383190       0x245D56        Zlib compressed data, default compression
2474107       0x25C07B        Zlib compressed data, default compression
2505436       0x263ADC        Zlib compressed data, compressed
2505514       0x263B2A        Zlib compressed data, compressed
2507416       0x264298        Zlib compressed data, best compression
2515542       0x266256        Zlib compressed data, compressed
2517896       0x266B88        Zlib compressed data, best compression
2520742       0x2676A6        Zlib compressed data, compressed
2526861       0x268E8D        Zlib compressed data, best compression
2534916       0x26AE04        Zlib compressed data, default compression
2561503       0x2715DF        Zlib compressed data, default compression
2569730       0x273602        Zlib compressed data, compressed
2583767       0x276CD7        Zlib compressed data, default compression
2602237       0x27B4FD        Zlib compressed data, default compression
2611477       0x27D915        Zlib compressed data, default compression
2626957       0x28158D        Zlib compressed data, compressed
2639089       0x2844F1        Zlib compressed data, compressed
2647278       0x2864EE        Zlib compressed data, default compression
2652206       0x28782E        Zlib compressed data, best compression
2664654       0x28A8CE        Zlib compressed data, best compression
2721674       0x29878A        Zlib compressed data, best compression
2722212       0x2989A4        Zlib compressed data, compressed
2729622       0x29A696        Zlib compressed data, default compression
2746239       0x29E77F        Zlib compressed data, compressed
2747460       0x29EC44        Zlib compressed data, best compression
2773475       0x2A51E3        Zlib compressed data, compressed
2912430       0x2C70AE        Zlib compressed data, compressed
2915559       0x2C7CE7        Zlib compressed data, best compression
2919137       0x2C8AE1        Zlib compressed data, compressed
2919398       0x2C8BE6        Zlib compressed data, default compression
2925208       0x2CA298        Zlib compressed data, default compression
2970697       0x2D5449        Zlib compressed data, compressed
2975629       0x2D678D        Zlib compressed data, compressed
3007894       0x2DE596        Zlib compressed data, compressed
3085804       0x2F15EC        Zlib compressed data, compressed
3092200       0x2F2EE8        Zlib compressed data, compressed
3109095       0x2F70E7        Zlib compressed data, default compression
3137073       0x2FDE31        Zlib compressed data, default compression
3159460       0x3035A4        Zlib compressed data, best compression
3169969       0x305EB1        Zlib compressed data, compressed
3174676       0x307114        Zlib compressed data, best compression
3190315       0x30AE2B        Zlib compressed data, default compression
3190481       0x30AED1        Zlib compressed data, compressed
3199853       0x30D36D        Zlib compressed data, best compression
3209970       0x30FAF2        Zlib compressed data, default compression
3233371       0x31565B        Zlib compressed data, compressed
3262017       0x31C641        Zlib compressed data, compressed
3294698       0x3245EA        Zlib compressed data, compressed
3294814       0x32465E        Zlib compressed data, best compression
3300772       0x325DA4        Zlib compressed data, compressed
3314325       0x329295        Zlib compressed data, default compression
3325430       0x32BDF6        Zlib compressed data, best compression
3347539       0x331453        Zlib compressed data, default compression
3381973       0x339AD5        Zlib compressed data, compressed
3384096       0x33A320        Zlib compressed data, compressed
3426731       0x3449AB        Zlib compressed data, best compression
3436707       0x3470A3        Zlib compressed data, best compression
3439327       0x347ADF        Zlib compressed data, best compression
3483067       0x3525BB        Zlib compressed data, default compression
3488551       0x353B27        Zlib compressed data, default compression
3493009       0x354C91        Zlib compressed data, default compression
3494362       0x3551DA        Zlib compressed data, default compression
3499219       0x3564D3        Zlib compressed data, best compression
3538245       0x35FD45        Zlib compressed data, compressed
3579428       0x369E24        Zlib compressed data, compressed
3588400       0x36C130        Zlib compressed data, compressed
3597734       0x36E5A6        Zlib compressed data, default compression
3609086       0x3711FE        Zlib compressed data, compressed
3617545       0x373309        Zlib compressed data, default compression
3622662       0x374706        Zlib compressed data, compressed
3626922       0x3757AA        Zlib compressed data, best compression
3634992       0x377730        Zlib compressed data, best compression
3638148       0x378384        Zlib compressed data, default compression
3638417       0x378491        Zlib compressed data, best compression
3688902       0x3849C6        Zlib compressed data, compressed
3698631       0x386FC7        Zlib compressed data, best compression
3713175       0x38A897        Zlib compressed data, best compression
3781687       0x39B437        Zlib compressed data, default compression
3786285       0x39C62D        Zlib compressed data, default compression
3794941       0x39E7FD        Zlib compressed data, default compression
3816840       0x3A3D88        Zlib compressed data, best compression
3817656       0x3A40B8        Zlib compressed data, default compression
3829859       0x3A7063        Zlib compressed data, compressed
3859678       0x3AE4DE        Zlib compressed data, best compression
3887499       0x3B518B        Zlib compressed data, best compression
3902283       0x3B8B4B        Zlib compressed data, default compression
3923673       0x3BDED9        Zlib compressed data, best compression
3927277       0x3BECED        Zlib compressed data, best compression
3974662       0x3CA606        Zlib compressed data, compressed
3995965       0x3CF93D        Zlib compressed data, default compression
4004880       0x3D1C10        Zlib compressed data, compressed
4024426       0x3D686A        Zlib compressed data, default compression
4076111       0x3E324F        Zlib compressed data, compressed
4097672       0x3E8688        Zlib compressed data, best compression
4115526       0x3ECC46        Zlib compressed data, best compression
4115649       0x3ECCC1        Zlib compressed data, best compression
4122032       0x3EE5B0        Zlib compressed data, best compression
4124189       0x3EEE1D        Zlib compressed data, best compression
4129024       0x3F0100        Zlib compressed data, compressed
4181033       0x3FCC29        Zlib compressed data, default compression
4218129       0x405D11        Zlib compressed data, compressed
4219339       0x4061CB        Zlib compressed data, best compression
4221408       0x4069E0        Zlib compressed data, best compression
4239114       0x40AF0A        Zlib compressed data, compressed
4245809       0x40C931        Zlib compressed data, best compression
4277644       0x41458C        Zlib compressed data, compressed
4289972       0x4175B4        Zlib compressed data, compressed
4300292       0x419E04        Zlib compressed data, best compression
4319935       0x41EABF        Zlib compressed data, compressed
4319988       0x41EAF4        Zlib compressed data, compressed
4320041       0x41EB29        Zlib compressed data, compressed
4320089       0x41EB59        Zlib compressed data, compressed
4350321       0x426171        Zlib compressed data, compressed
4375063       0x42C217        Zlib compressed data, compressed
4414926       0x435DCE        Zlib compressed data, compressed
4417582       0x43682E        Zlib compressed data, compressed
4430754       0x439BA2        Zlib compressed data, best compression
4430955       0x439C6B        Zlib compressed data, best compression
4433422       0x43A60E        Zlib compressed data, compressed
4440964       0x43C384        Zlib compressed data, default compression
4459836       0x440D3C        Zlib compressed data, best compression
4465037       0x44218D        Zlib compressed data, compressed
4491474       0x4488D2        Zlib compressed data, compressed
4525321       0x450D09        Zlib compressed data, compressed
4536020       0x4536D4        Zlib compressed data, default compression
4539019       0x45428B        Zlib compressed data, best compression
4547686       0x456466        Zlib compressed data, compressed
4594046       0x46197E        Zlib compressed data, compressed
4595742       0x46201E        Zlib compressed data, compressed
4611527       0x465DC7        Zlib compressed data, compressed
4621480       0x4684A8        Zlib compressed data, best compression
4622546       0x4688D2        Zlib compressed data, best compression
4658238       0x47143E        Zlib compressed data, compressed
4666730       0x47356A        Zlib compressed data, best compression
4682920       0x4774A8        Zlib compressed data, best compression
4687391       0x47861F        Zlib compressed data, compressed
4725536       0x481B20        Zlib compressed data, compressed
4729111       0x482917        Zlib compressed data, default compression
4739376       0x485130        Zlib compressed data, best compression
4747013       0x486F05        Zlib compressed data, compressed
4764107       0x48B1CB        Zlib compressed data, compressed
4774983       0x48DC47        Zlib compressed data, default compression
4775153       0x48DCF1        Zlib compressed data, best compression
4828104       0x49ABC8        Zlib compressed data, best compression
4866122       0x4A404A        Zlib compressed data, compressed
4895722       0x4AB3EA        Zlib compressed data, compressed
4934732       0x4B4C4C        Zlib compressed data, default compression
4940722       0x4B63B2        Zlib compressed data, default compression
4949644       0x4B868C        Zlib compressed data, compressed
4983247       0x4C09CF        Zlib compressed data, compressed
4992046       0x4C2C2E        Zlib compressed data, best compression
5023817       0x4CA849        Zlib compressed data, compressed
5037667       0x4CDE63        Zlib compressed data, compressed
5046276       0x4D0004        Zlib compressed data, best compression
5048862       0x4D0A1E        Zlib compressed data, compressed
5050674       0x4D1132        Zlib compressed data, compressed
5073060       0x4D68A4        Zlib compressed data, default compression
5092725       0x4DB575        Zlib compressed data, default compression
5122481       0x4E29B1        Zlib compressed data, compressed
5122600       0x4E2A28        Zlib compressed data, compressed
5140098       0x4E6E82        Zlib compressed data, compressed
5140130       0x4E6EA2        Zlib compressed data, compressed

```

<p>It all seems like a false positive because when I run  binwalk -e I get these files as output:</p>

```
100ED4.zlib 15998A.zlib 1CF410.zlib 20AA0.html  263ADC.zlib 29E77F.zlib 311B3.html  369E24.zlib 3B5A6.html  40C931.zlib 45428B.zlib 4B63B2.zlib B8A5.html
1019CE.zlib 165A4B.zlib 1CF4DA.zlib 20DEAB.zlib 263B2A.zlib 29EC44.zlib 31565B.zlib 36C130.zlib 3B8B4B.zlib 41458C.zlib 456466.zlib 4B868C.zlib BEC.html
1043D.html  16E4C5.zlib 1DA3FC.zlib 213872.zlib 264298.zlib 2A3F1.html  31C641.zlib 36E5A6.zlib 3BDED9.zlib 4160F.html  46197E.zlib 4C09CF.zlib C602.html
105928.zlib 16E5E4.zlib 1DF655.zlib 218146.zlib 266256.zlib 2A51E3.zlib 3245EA.zlib 3711FE.zlib 3BECED.zlib 4175B4.zlib 46201E.zlib 4C2C2E.zlib CC41.html
106B52.zlib 1750BD.Z    1E22FA.zlib 219091.zlib 266B88.zlib 2C70AE.zlib 32465E.zlib 373309.zlib 3CA606.zlib 419E04.zlib 465DC7.zlib 4CA849.zlib D475.html
10BA69.zlib 17914A.zlib 1E2AD1.zlib 21BFE2.zlib 2676A6.zlib 2C7CE7.zlib 325DA4.zlib 374706.zlib 3CC9B.html  41EABF.zlib 4684A8.zlib 4CDE63.zlib D9B.html
1120F.html  17AFE2.zlib 1E7A3E.zlib 222325.zlib 26882.html  2C8AE1.zlib 329295.zlib 3757AA.zlib 3CF93D.zlib 41EAF4.zlib 4688D2.zlib 4D0004.zlib E4B65.zlib
115D00.zlib 17FA50.zlib 1EFED.html  22451F.zlib 268E8D.zlib 2C8BE6.zlib 32B9D.html  377730.zlib 3D1C10.zlib 41EB29.zlib 47143E.zlib 4D0A1E.zlib E7BF5.zlib
11DDD6.zlib 182303.zlib 1F14E4.zlib 2270DE.zlib 26AE04.zlib 2CA298.zlib 32BDF6.zlib 378384.zlib 3D686A.zlib 41EB59.zlib 47356A.zlib 4D1132.zlib EA29B.zlib
121AFB.zlib 1849E9.zlib 1F1817.zlib 22900C.zlib 2715DF.zlib 2D5449.zlib 331453.zlib 378491.zlib 3E324F.zlib 426171.zlib 4774A8.zlib 4D68A4.zlib EA3.html
1223D5.zlib 187D9A.zlib 1F279C.zlib 22BB81.zlib 273602.zlib 2D678D.zlib 339AD5.zlib 37F16.html  3E8688.zlib 42C217.zlib 47861F.zlib 4DB575.zlib F25CE.zlib
123F2D.zlib 189C6.html  1F4CBB.zlib 22DF74.zlib 276CD7.zlib 2DE596.zlib 33A320.zlib 3849C6.zlib 3EAA3.html  435DCE.zlib 481B20.zlib 4E29B1.zlib F421E.zlib
1256C6.zlib 18BB93.zlib 1F7B32.zlib 22E2F8.zlib 27B4FD.zlib 2F15EC.zlib 3449AB.zlib 386FC7.zlib 3ECC46.zlib 43682E.zlib 482917.zlib 4E2A28.zlib F7BFE.zlib
12DD4C.zlib 194A29.zlib 1F87.html   2318A4.zlib 27D915.zlib 2F2EE8.zlib 3470A3.zlib 38A897.zlib 3ECCC1.zlib 439BA2.zlib 485130.zlib 4E6E82.zlib F8A79.zlib
138529.zlib 195638.zlib 1FA0B4.zlib 2331D1.zlib 28158D.zlib 2F70E7.zlib 347ADF.zlib 39B437.zlib 3EE5B0.zlib 439C6B.zlib 486F05.zlib 4E6EA2.zlib FC299.zlib
138BCB.zlib 1995DD.zlib 1FB034.zlib 2377DD.zlib 2844F1.zlib 2FDE31.zlib 3525BB.zlib 39C62D.zlib 3EEE1D.zlib 43A60E.zlib 48B1CB.zlib 531F4.html  FE9B5.zlib
13E18E.zlib 199A8F.zlib 1FC695.zlib 23B418.zlib 2864EE.zlib 3035A4.zlib 353B27.zlib 39E7FD.zlib 3F0100.zlib 43C384.zlib 48DC47.zlib 5597F.html  FEF44.zlib
13E2E2.zlib 1A2F63.zlib 1FF04B.zlib 23D8C4.zlib 28782E.zlib 305EB1.zlib 354C91.zlib 3A177.html  3FCC29.zlib 44054.html  48DCF1.zlib 566C0.html
14089B.zlib 1B8DFE.zlib 2026BA.zlib 23FCD3.zlib 28A8CE.zlib 307114.zlib 3551DA.zlib 3A3D88.zlib 405D11.zlib 440D3C.zlib 49ABC8.zlib 61AD7.html
1456F3.zlib 1BB6F7.zlib 2027B9.zlib 2440C0.zlib 28DF.html   30AE2B.zlib 3564D3.zlib 3A40B8.zlib 4061CB.zlib 44218D.zlib 49DAF.html  865.html
1474C0.zlib 1BE7F2.zlib 205D71.zlib 245D56.zlib 29878A.zlib 30AED1.zlib 35869.html  3A7063.zlib 4069E0.zlib 4488D2.zlib 4A404A.zlib A7D.html
150A2E.zlib 1C30F7.zlib 20701D.zlib 24969.html  2989A4.zlib 30D36D.zlib 35EBC.html  3AE4DE.zlib 408E3.html  450D09.zlib 4AB3EA.zlib A971.html
155538.zlib 1CC217.zlib 20729D.zlib 25C07B.zlib 29A696.zlib 30FAF2.zlib 35FD45.zlib 3B518B.zlib 40AF0A.zlib 4536D4.zlib 4B4C4C.zlib AAE9.html

```

The zlib files give me error during extraction. ( I can't unzip the zlib files)

From hexdump output and strings command I see quite a lot of ascii which I guess indicates it's not encrypted.

When I open the HTML files I see some binaries which apparently got combined with HTML files.

My question is: Where do I go from here?


问:
How to get a shell on a remote server?
Hello guys, I explain my problem, i recently learn about socket programming and i want to do a simple "exploit" maybe the easiest shellcode exercise. In order to be precise i'll put below the source code of the vulnerable program running on the remote server, on a specific port.

```<code>#include <unistd.h>
#include <stdio.h>

typedef void (*func)(void);

int main(void)
{
    char input[4096];
    char* output = "My favorite shell is /bin/sh";

    puts(output);
    printf("[DEBUG] foobar: execve=%p input=%p output=%p\n",
        execve, input, output);

    read(0, input, 4096);
    ((func)&input)();

    return 0;
}
</code>```

It's a school's ctf exercise the goal is to get a flag. As i'm new in that kind of exercise, first i tried to exploit the program locally. I succeeded with a techniques i just learned (port binding 1337). Here are the steps:

```<code># ./shellcode.sh | ./program
My favorite shell is /bin/sh
[DEBUG] foobar: execve=0x80483c0 input=0xff8aed4c output=0x80485d0
</code>```

on a different shell i can then do:

```<code># nc localhost 1337
id
uid=0(root) gid=0(root) groups=0(root)
</code>```

I got a shell, yeah that's cool but there is no flag here ! Now i to get a shell on the server.

If i understood well the source code, the vulnerable program executed what you put as input. I disassembled the main:

```<code>(gdb) disas main
Dump of assembler code for function main:
   0x080484bc <+0>: push   %ebp
   0x080484bd <+1>: mov    %esp,%ebp
   0x080484bf <+3>: and    $0xfffffff0,%esp
   0x080484c2 <+6>: sub    $0x1020,%esp
   0x080484c8 <+12>:    movl   $0x80485d0,0x101c(%esp)
   0x080484d3 <+23>:    mov    0x101c(%esp),%eax
   0x080484da <+30>:    mov    %eax,(%esp)
   0x080484dd <+33>:    call   0x8048390 <puts@plt>
   0x080484e2 <+38>:    mov    0x101c(%esp),%eax
   0x080484e9 <+45>:    mov    %eax,0xc(%esp)
   0x080484ed <+49>:    lea    0x1c(%esp),%eax
   0x080484f1 <+53>:    mov    %eax,0x8(%esp)
   0x080484f5 <+57>:    movl   $0x80483c0,0x4(%esp)
   0x080484fd <+65>:    movl   $0x80485f0,(%esp)
   0x08048504 <+72>:    call   0x8048380 <printf@plt>
   0x08048509 <+77>:    movl   $0x1000,0x8(%esp)
   0x08048511 <+85>:    lea    0x1c(%esp),%eax
   0x08048515 <+89>:    mov    %eax,0x4(%esp)
   0x08048519 <+93>:    movl   $0x0,(%esp)
   0x08048520 <+100>:   call   0x8048370 <read@plt>
   0x08048525 <+105>:   lea    0x1c(%esp),%eax
   0x08048529 <+109>:   call   *%eax
   0x0804852b <+111>:   mov    $0x0,%eax
   0x08048530 <+116>:   leave
   0x08048531 <+117>:   ret
</code>```

For the instruction call *%eax, eax points to the input. Am i right to guess if you just put a shellcode as input, it will execute it ?

But the port binding shellcode seems to not work with the remote server ( maybe it is secured ?)

Then i used simples shellcodes (execve(bin/sh)) already written by people that way:

```<code># echo -ne "shellcode" | nc server port
</code>```

No one worked that way so i thought that my whole logic is wrong. What is wrong in the process ? To get a shell on a remote server, what are the way ? If someone can help me i would be grateful. Thank you all.

Title: How to get a shell on a remote server?


问:
Encrypting and packing at functional boundaries for obfuscation
I am interested in software obfuscation techniques. I found your excellent summary of obfuscation in order to avoid (as possible) reverse engineering.

One of the proposed technique you quoted:

Packing and encrypting code segment

I will group encryption and packing into the same category. They both serve the same purpose and they both have the same issues. In order to execute the code, the CPU needs to see the plain text. So you have to provide the key in the binary. The only remotely effective way of encrypting and packing code segments is if you encrypt and decrypt them at functional boundaries and only if the decryption happens upon function entry and then re-encryption happens when leaving the function. This will provide a small barrier against dumping your binary as it is running but is must be coupled with strong obfuscation.

Crypting the code segment is very common for malware writers. I am very intrested on how to encrypt/pack each function separatly: decryption upon function entry and then re-encryption when leaving the function. (These are you words)

Where I can find documention for this technique ?

I find this an excellent idea.

Anyway, thanks !


问:
dlmalloc free pointers
I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What is the blob of code responsible for doing that? Where and when are those pointers inserted?</p>

Title: dlmalloc free pointers


问:
How to access and modify data segment when doing hardware breakpoint crashes the application?
I want to modify the data segment in the x64_DBG, however, I don't know how to access it.

```<code>lea r8,qword ptr ds:[7FEF0CA6AD8]
</code>```

In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I want to access the content of 7FEF0CA6AD8 memory address and modify it. The problem is each time I modify the address and test in the program something writes to 7FEF0CA6AD8 memory address. How can make it read only or find a the thing which writes to this address and try to modify that in the same way? My purpose is changing the value of this data segment register or find the logic behind the method which writes to it.

Hardware breakpoint might be a solution but when I do so the program crashes immediately


问:
Trying to obtain embedded flash memory on MCP5554 microcontroller
I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. </p>

<p>Do I need the circuit board that is hosting the microcontroller to be intact for this? Can I pull the microcontroller off and go directly through the jtag pins on the controller? I am new to this and google searching hasnt turned up much, any help or a push in the right direction would be tremendous. </p>


问:
Reading contents of TIB/PEB
Does anyone know of a program that will display the TIB/PEB contents of a PE. I wrote a program that will read and display the TEB/PEB but I think some of the returned data is wrong.</p>

Title: Reading contents of TIB/PEB


问:
How should I approach decrypting packet protocols?
I'm able to see the packets before they're encrypted by setting a breakpoint before the encryption subroutine. My problem is that this subroutine is really complicated and goes really deep. Which steps should I follow in order to obtain this encryption function? Or rather to be able to decrypt this packet protocol?</p>


问:
Why dependency walker indentifies an app as Borland Delphi 4 while IDR says Delphi 2011
I opened an app in Dependency Walker and noticed that the app was made in Borland Delphi 4 to improve my reversing techniques I fired up DeDe, it's sticks and respond after hours with error "out of memory"

Then I used Interactive Delphi Reconstructor to see if Delphi is really hard to Reverse but I notced that it was in Delphi XE1

How can an app be made in two different versions (Delphi 4 and Delphi 2011)?
Or  the Dependency walker lied?


问:
OllyDbg can't run program (breakpoint error, access violation)
So this is from some "Reversing with Lena" tutorial series on how to start out with reverse engineering and OllyDbg. (Found here https://tuts4you.com/download.php?view.124) It's a bit old but should still work fine I believe.

Part 1 and 2 worked just fine, but when I try to load the Binary of Part 3 into OllyDbg it complains about a corrupt breakpoint and the assembly shown doesn't look like the assembly in the tutorial at all.

When I choose "Select module => RegisterMe" in the context menu it looks like it should. However it still doesn't really run (even when I do "New origin here" it only runs a view lines before the same thing happens.
It kind of just does nothing anymore, OllyDbg says "Running", the assembly either goes blank (when I didn't change origin) or shows some RtlAllocateHeap function.

Also there are Access violation errors and exceptions I have to tell it to pass to the program.

The log: http://pastebin.com/mCV7Pkxh My only idea is that maybe BitDefender has something to do with it. But it didn't block anything and tried to turn it off too.


问:
A debugger has been found running in your system
For education reasons I just came into reverse engineering, so I found an app that I want to reverse. Basically it has a basic auth system (login and pass). I sniffed traffic with Wireshark and found the packets are encrypted. So i started to reverse engineer it. I tried Ollydbg and IDApro with stealth plugins but still can't run it with debugger. Here is a message when I try to run it with debugger:

```<code>A debugger has been found running in you system
Please unload it from memory and restart your computer
</code>```

I suppose it is a some lib to prevent debugging because it a pretty standard message because when I try to google it, it appears not only in this program.

So I dive into code. At this moment i found only this 2 functions:

```<code>.vmp1:013F9BDC loc_13F9BDC:                            ; CODE XREF: sub_1427AA5+4j
.vmp1:013F9BDC                 not     dl
.vmp1:013F9BDE                 bt      ebx, 1Eh
.vmp1:013F9BE2                 rol     dl, 3
.vmp1:013F9BE5                 call    loc_144B5CD
.vmp1:013F9BEA                 and     al, 14h
.vmp1:013F9BEC                 xor     al, 0C3h
.vmp1:013F9BEE                 lodsb
.vmp1:013F9BEF                 cmp     al, 0EAh
.vmp1:013F9BF1                 imul    ebx
.vmp1:013F9BF3                 add     [eax-36h], edx
.vmp1:013F9BF6                 mov     dh, 0DFh
.vmp1:013F9BF8                 sub     ch, [eax]
.vmp1:013F9BFA                 test    al, dh
.vmp1:013F9BFC                 wait
.vmp1:013F9BFD                 adc     esi, 28h
.vmp1:013F9C00                 int     3               ; Trap to Debugger
.vmp1:013F9C01                 sub     ah, bh
.vmp1:013F9C03                 shr     byte ptr [ecx], 1
.vmp1:013F9C05                 jmp     far ptr 0F03Dh:0AE62FB1Fh

    loc_1402816:                            ; CODE XREF: sub_15E0009-1DD80Ej
.vmp1:01402816                 pop     ebp
.vmp1:01402817                 arpl    [ebx], cx
.vmp1:0140281A                 adc     al, 0C8h
.vmp1:0140281C                 int     3               ; Trap to Debugger
.vmp1:0140281D                 sbb     al, 0B2h
.vmp1:0140281F                 loopne  loc_140285A
.vmp1:01402821                 or      al, 0CFh
.vmp1:01402823                 fisttp  qword ptr [edi]
.vmp1:01402825                 xchg    eax, edx
.vmp1:01402826                 sbb     ah, 7Fh
.vmp1:01402829                 retf
.vmp1:01402829 ; END OF FUNCTION CHUNK FOR sub_15E0009
.vmp1:01402829 ; -----------------------------------------------------------------
.vmp1:0140282A                 dw 0BB70h
.vmp1:0140282C                 dd 2FEC5FA0h, 1C84B195h, 0E7C1879Fh, 0F4D8BCF8h
.vmp1:0140283C ; -----------------------------------------------------------------
.vmp1:0140283C                 push    ds
.vmp1:0140283D ; START OF FUNCTION CHUNK FOR sub_15E0009
</code>```

I also tried to undefine those or define as nop. I'm pretty new to reversing and I know only basic of Assembler but have background with C or C++ and some other languages. How can I avoid this anti-debugging ? Maybe some specific settings of a plugin ? Or maybe using another debugger ? Right now I'm trying to use Windbg and win 32 debugger. Or please tell me where to dig. here is DIA output.


问:
Converting data to space?
I made a mistake when trying to import some additional binary data into one of my long-time IDA databases. I unintentionally overwrote some empty RAM space, so I tried reverting it back to "space" by undefining or converting the imported code to data. But no such luck - the regions are now filled with thousands of ".byte 0" lines instead.

The database has a ton of comments and renamed variables/functions and I would rather not start over from scratch just to fix this, so is there any other way I can undo this silly mistake? I'm still pretty new to IDA so I hope a potentially dumb question is forgiven here.

I use IDA 6.1 if that changes anything.

Thanks!

Title: Converting data to space?


问:
Identity of a programmer from a reversed VB.NET application (Visual Studio)
I have reversed a program I found running on my computer, written in VB.NET using Microsoft Visual Studio.

I'm pretty sure it is a keylogger. Now since I'm a very careful user, I'm 100% sure I did not download that. I believe it was planted by someone who had access to my computer.

Is there a way I can identify who wrote it? (Computer name maybe, VS username, etc?)
Advanced methods would be appreciated as well in case whoever wrote it found a way around the obvious ones.


问:
Increase IDA's 256 xref limit
I am writing a plugin which relies on going through all xrefs to printf-like function (you can imagine how many xrefs there are). After setting number of shown xrefs to 300 IDA has rounded to 256 what seems to be the maximum. I thought it is just GUI limitiation so I tried iterating over XrefsTo() programmatically which as well yielded only 256 xrefs. After quicky skimming through config I found nothing.

Does anyone have any idea how to fix it ?

Title: Increase IDA's 256 xref limit


问:
Anti-dumping techniques
After handing on some crackmes using packed codes, I am now curious about anti-dumping techniques. For the crackmes I have encoutered, my method is as follows: after the program unpacks itself, I take a memory snapshot (using IDA), then analysis the unpacked code (this approach has been proposed also by Igor in the answer of this question).

Since these crackmes are not sophisticated enough, this method works. But I am quite sure that there are more sophisticated techniques can bypass this method. The most detail document I can find is this article, however the discussed techiques are all about inserting (e.g. Nanomites) special codes into original ones or changing them completely (e.g. VMProtect, Code Virtualizer); or some other tricks to fool debuggers/disassemblers.

So my question is: are there existing techniques that prevent us from understanding the program by taking memory snapshot, while they do not change the original codes?

NB1. I have found a very close question and answer here

Title: Anti-dumping techniques


问:
Debugging digitally signed executable
I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (invalid pe?)!" message.

I think this might have to do with the fact that said executable is digitally signed. I did some quick research and this SO question came up, where I learned that digital signatures in windows executables are referenced in the file's PE header, which I think might be what x64dbg was complaining about.

The executable I'm talking about is the Mumble windows client version 1.2.10.
It is the only executable signed with two different digital signatures, which further reinforces my hypothesis.
Sadly, even after stripping the digital signatures using the delcert.exe linked in the SO question above, the problem remains which brings me to a dead end.

Is it possible digital signatures are messing these debuggers up? Is it possible that the signature stripping tool doesn't produce a valid pe file for the debuggers I tried? What else could I be doing wrong?

As a footnote: I know mumble is free software and I could just compile my own version, but this is Reverse Engineering, right?

Update: Following Jason comment, I'm posting the ollydbg log, which doesn't really say anything, unfortunately:

```<code>Log data
Address    Message
OllyDbg v1.10
Bookmarks sample plugin v1.06 (plugin demo)
  Copyright (C) 2001, 2002 Oleh Yuschuk
Command line plugin v1.10
  Written by Oleh Yuschuk
File 'C:\Program Files (x86)\Mumble\mumble.exe'
</code>```

Title: Debugging digitally signed executable


问:
Debugging a position independent executable ELF
I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:

```<code>(gdb) info files
...
Entry point: 0xcf8
...
</code>```

So I set a breakpoint at the entry point and run the program:

```<code>(gdb) break *0xcf8
Breakpoint 1 at 0xcf8
(gdb) run
Starting program: /home/tathanhdinh/CTFs/hackercalc
Error in re-setting breakpoint 1: Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8

Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xcf8
</code>```

That seems this breakpoint does not work. I do not understand why it says Cannot access memory at address 0xcf8 but I guess that there was some code which runs before has made some interference (so the program cannot reach this entry point), as far as I know, this code must be the elf interpreter of the program.

So, I look into segments of the program to check this interpreter, all seems to be normal (except that readelf says the program is a shared object file, but I think that is not important):

```<code>readelf --segments hackercalc

Elf file type is DYN (Shared object file)
Entry point 0xcf8
There are 8 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x00000034 0x00000034 0x00100 0x00100 R E 0x4
  INTERP         0x000154 0x00000154 0x00000154 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x00000000 0x00000000 0x16b4a 0x16b4a R E 0x1000
  LOAD           0x016eac 0x00017eac 0x00017eac 0x001e4 0x001ec RW  0x1000
</code>```

Now, I try to get again information about this process:

```<code>(gdb) info files
Symbols from "/home/tathanhdinh/CTFs/hackercalc".
Native process:
        Using the running image of child process 10545.
        While running this, GDB does not access memory from...
Local exec file:
        `/home/tathanhdinh/CTFs/hackercalc', file type elf32-i386.
        Entry point: 0x56555cf8
</code>```

And I am totally lost here, why the elf interpreter (which is ld-linux.so.2) can create a new process in this case?

I try another approach by loading the challenge into IDA, set a breakpoint at the entry point, then run but IDA simply hangs up!!!

So my question is: how can this happen? Am I totally wrong about the code executed before the entry point? Does the challenge use some special tricks to bypass debugging?

NB1. Thanks to @Igor, I finally find out how to debug this challenge. In summary, I disable ALSR to get a stable address of the entry point. Then I load it into gdbserver, use IDA to attach this debug session, set a breakpoint at the entry point (whose address is stable by disabling ALSR).


问:
lm command on Windbg is not showing all modules
I'm trying to reverse-enginering a Win7 32bit legacy driver.

If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name show a real object).

But I can't see the driver name in the module list with lm command. Is there an explanation for this?

Because of this I am also unable to break when this module is loaded with sxe ld name but I think that the driver is loaded just after the loading of umbus (because at this time the corresponding DRIVER_OBJECT is created).

Searching on internet I found that this is the "User mode bus enumerator" but I don't understand because it is a kernel mode driver (.sys file).


问:
ZyXEL old devices firmware compression method
I have bumped into a compression format which binwalk doesn't seem able to identify. It is used in at least ZyXEL P-724 firmware images. Running file doesn't show anything.

Comparing the files I have, I found there seems to be a fixed-size header of around 20 bytes (checked with two files drastically different in both size and contents -- namely, HTPCode and RasCode). Poking around BootExt I can see decompression-related string, but nothing that would give away the exact algorithm.

The suspected header bytes are (bytes that differ marked out):

08 00 xx xx 71 A8 1A xx 17 2A 7C 60 xx C2 02 0C 20 83 10 00

A sample containing the original image, extracted ROM object, and the compressed data itself: https://yadi.sk/d/lBRqhldYjRMPf


问:
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:

Being executed

Decrypt a lot of data from memory and obtain a new PE (from memory)

Create a child process in suspended state

Dump the new data obtained into the Created child process

SetThreadContext

ResumeThread

Now one issue i was thinking about, is the fact i dont know what the EntryPoint is so i dont know what part of the memory bytes i would change to EB FE (JMP < ToSelf >) To be able to debug the process from the start

Once the new process is created and im attaching a debugger to it - OLLYDbg for that case (And the process is on Pause state) Pressing F8 - step over causing the application to have a huge delay of like 10 seconds untill the Opcode is finished - which makes no sense.
Also if i watch the newly created process on Sysinternals - ProcessExplorer I can see that after i press F8 the CPU usage of that process is very high 50-90 for all that time, until the opcode is finished. Which also results in all of the computer to run very slowly

What could cause that? and how would i be able to bypass that?

It does not happen if i dont debug the process.


问:
IDA Pro user-defined offsets (again)
I'm disassembling a simple Z80 program and can't for the life of me work out how to - successfully - specify a user-defined offset.

I have a line of code as:

```<code>ld de, #0x6058
</code>```

and FTR, this address lies outside the address range of defined segments, however my 'suspiciousness' range is set to $0000-$FFFF.

Now I want to display this as the offset from an address label, ie.

```<code>ld de, #screen2-15424
</code>```

where, FWIW, screen2 is the named address 0x9C98.

So I try to change the operand to a user-defined offset, TYPE=OFF16, BASE=screen2 and DELTA=0 (target automatically calculated). However the result is the same (original) line but with 0x6058 in RED.

Nothing I try seems to produce what I want, other than a MANUAL operand type which works but is prone to human error because there is no automatic check. What am I missing here? I would think that this is basic functionality that most people would want? The only examples I can find are complex C-code decompilations on Intel/ARM architecture.

TIA

Title: IDA Pro user-defined offsets (again)


问:
Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7
I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show up in the menu. I have gone to File > script and run MyNav.py, but all that happens is the myexport.pyc and mybrowser.pyc files get generated where I have the source files.

I tried copying those into the plugins directory and restarting, but nothing shows up. The install documentation on the google code page is non-existent. Has anyone had any success installing this plugin package?

I am using Python 2.7 with IdaPython 1.5.2, but have also tried with Python 2.6


问:
Dump a MX25L12845E with a bus pirate and flashrom
I just received my buspirate, I now want to dump a flash (MX25L12845E).
I tried the following command:

```<code>flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c MX25L12835F/MX25L12845E/MX25L12865E
</code>```

And get the following output:

```<code>flashrom v0.9.8-r1888 on Darwin 15.0.0 (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

flashrom was built with LLVM Clang 7.0.0 (clang-700.0.72), little endian
Command line (7 args): flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c MX25L12835F/MX25L12845E/MX25L12865E
Calibrating delay loop... OS timer resolution is 1 usecs, 2849M loops per second, 10 myus = 10 us, 100 myus = 149 us, 1000 myus = 1019 us, 10000 myus = 9791 us, 4 myus = 14 us, OK.
Initializing buspirate_spi programmer
serialport_config: Some requested options did not stick.
Error: Programmer initialization failed.
</code>```

I check the Internet but it look like nobody already had this problem.

I tried to look at the pinout once again, still nothing.

Then I change some connection to see if I can have a different error, but no.

Did someone already had this problem?

EDIT: This error message come from this part of code:

```<code>wanted.c_cflag &= ~(PARENB | CSTOPB | CSIZE | CRTSCTS);
wanted.c_cflag |= (CS8 | CLOCAL | CREAD);
wanted.c_lflag &= ~(ICANON | ECHO | ECHOE | ISIG);
wanted.c_iflag &= ~(IXON | IXOFF | IXANY | ICRNL | IGNCR | INLCR);
wanted.c_oflag &= ~OPOST;
if (tcsetattr(fd, TCSANOW, &wanted) != 0) {
    msg_perr_strerror("Could not change serial port configuration: ");
    return 1;
}
if (tcgetattr(fd, &observed) != 0) {
    msg_perr_strerror("Could not fetch new serial port configuration: ");
    return 1;
}
if (observed.c_cflag != wanted.c_cflag ||
    observed.c_lflag != wanted.c_lflag ||
    observed.c_iflag != wanted.c_iflag ||
    observed.c_oflag != wanted.c_oflag ||
    cfgetispeed(&observed) != cfgetispeed(&wanted)) {
    msg_perr("%s: Some requested options did not stick.\n", __func__);
    return 1;
}
</code>```

The PARENB | CSTOPB | CSIZE | CRTSCTS and so on part look like it's a problem due to terminal.

BTW I use iTerm and Terminal and it's not working on both. But works on Linux with default terminal.


问:
Tools and techniques for analyzing NaCL binaries?
Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly and code/data disambiguation. But looking at them in a disassembler, it's hard to make sense of what's going on because most of the interesting stuff is done by calls into the NaCL runtime, and I can't seem to find good documentation on what functions are available there or how to resolve the calls in a disassembly.

There's a lot of code like (sample from hotword-x86-64.nexe):

```<code>   21d70:       81 c4 b8 00 00 00       add    esp,0xb8
   21d76:       4c 01 fc                add    rsp,r15
   21d79:       41 5b                   pop    r11
   21d7b:       0f 1f 44 00 00          nop    DWORD PTR [rax+rax*1+0x0]
   21d80:       41 83 e3 e0             and    r11d,0xffffffe0
   21d84:       4d 01 fb                add    r11,r15
   21d87:       41 ff e3                jmp    r11
</code>```

And this makes it pretty hard to follow control flow.

These binaries are of some interest because they're in some ways Google's answer to ActiveX, and they've been used to ship controversial features like OK Google (aka hotwords).

One resource I have found is a technical description of the SFI mechanism:

NaCl SFI model on x86-64 systems

Which gives some helpful hints on (e.g.) what R15 does, it's mostly about the what restrictions NaCL assembly code has to comply with, rather than how things work.


问:
Jar reversing: Can't open as zip file nor open it with common decompilers
I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.

So after running JD-Gui, Krakatau, procyon decompiler and other well known and I always receive the same response: "Not a valid zip file".

My first thought it was this JAR being obfuscated, however when I extract the strings with "strings target.jar" I can successfully see lots of hardcoded strings including class names, SQL queries, contact details (email address and such), and others. Which makes me doubt if this Jar file is actually obfuscated or not.

On a side note, something that bring my attention was that every library within this JNLP application contains the file: NameOfClient.RSA within the META-INF folder. So I'm guessing this Jar files are signed somehow with a private signature but I'm not sure if this has anything to do with what I'm struggling right now.

My questions:
If I can read strings in plain text this means the JAR is not obfuscated?
How would you proceed on this case?

Thanks


问:
Help on 7zip PW cracker / Reverse engineering question
So a couple weekends ago I attended a cyber Security workshop where I met a prospective employer who gave me a business card. On one side it read "There are two individual challenges that lead to a third) and the other was this.

https://i.imgur.com/lLVBSNW.jpg

So far I have figured out the following: The first two lines of white text are ascii data and reveal: '[0-9a-z .]* XOR random 32bht key' that the following text is encoded using the above. once brute forced using a ruby script provided by a friend it said:

now its time to find what is hidden at 13.56 mhz

the red characters on the card read out e280-[bunch of chars], e280 being the utf encoding for read right to left. This gave HERENFC, which further confirmed my suspicions of a NFC chip inside the card he gave me. Scanned it and got a big bunch of data.

base64->7zip (elf password is the location hinted to by img): N3q8ryccAAO51A6KBgIAAAAAAAAiAAAAAAAAAD5mzWIAJOCkAAf+balKKKORaarWyJiLJeTWHRJVHIEgJz/czH7tYJXny/HfNnNRkRlOIjzLMtjdLBDregzoh1+tXUBBuw4cpJ33zcf4L+POxPdkzJJ49ESxLT7MY0/Ksq7aqgqk/SDuHpYV+6YHaAolL0KOgUQG4p/xx1GiEoUrRqMqe+hitJk37v2fZXrKMEllLnYyREZdS62Pa69rjOhJyYxNEHd5vlFhN2jt5LWOYL1OLzNtw6DPPfC+dNYVgewO5/PttAitk5yK4z4Eme32yB6jeBcRli3cwTfPAAsOC7U4Pr1IODxVlQ7cIJnXKORVk5iblQeksZMYXNGB8/4P7amcWXdBE9o3NaAlBW6WAcWGP2nTEEan7G2Zty8mm7F45xGv6iCzUbulCKfOHi8YlQWMPQxXj5fQI1kxj3oPyu1E5Zy3OJ6jFz7ld5wKFiUjxn1iXxO0U5uQ/wudHqosOpnq1fHTqhOQFe99dz5zJE7KegYH1eY0T4/2jpIqbhwv/EKBjqILccTblk5AAACBMweuMZ7dMFw/KDXD5SrD2xIUL0tMwVZq35QApnkHFcpn63JExNCjbiv5H9OLqbVtkgehxuu9HDnuibc1CGWVO7Nh5WcSTqRlaYgfHkcgVKAH2SRsgnoktPvpjWVdiATfwfGVXnbS7diXCMCHQcwLcoUw3pUH4aAAABcGgYoBCXwABwsBAAEjAwEBBV0AEAAADICDCgFtjZ9MAAA=

I then decoded in linux using base64 --decode and then zipped that file. When you open it there are two files, 1 is a file with no extension which when opened with paint is a low res football (i think) and the other is a pw protected ELF.

so now my problem comes, i've tried Johntheripper (incl. jumbo suite) but it cannot create a PW hash from a 7zip, fcrackzip wasn't compatible, and rarcrack won't allow me to pass wordlists into it.

So it's either that or someone help me see what i'm missing in the password hint. All help appreciated, hoping to get a placement at a very cool company out of this before my final year of uni.


问:
Audio file compression identification
I've been working on reversing file formats from the game of star wars episode 1: the phantom menace.

I have managed to extract the audio files from the .lab file in which they were contained. I cannot however play the audio files.

The files are provided at the end of the question.

I managed to find some of the decompressed files in the game's cache (which do play) and so I have a selection of audio files in both compressed and uncompressed form.

The compression ratio is about 66%; i.e. the compressed file is 1/3 of the size of the uncompressed size.

This is an example of the uncompressed and compressed form of the data. (From BDm8906.wav and BDM8906.wv)

The first 32 bytes of the uncompressed file (Magic is riff) BDm8906.wav

```<code>52 49 46 46 DA 77 00 00 57 41 56 45 66 6D 74 20
10 00 00 00 01 00 01 00 22 56 00 00 44 AC 00 00
</code>```

The first 32 bytes of the compressed file (Magic is INDYWV) BDM8906.wv

```<code>49 4E 44 59 57 56 22 56 00 00 10 00 00 00 01 00
00 00 F1 2B 00 00 00 00 00 00 B6 77 00 00 00 00
</code>```

From looking a few of the compressed files I have found that:

The first 16 bytes are always the same.
The next 4 bytes are the size of the compressed file.
The next 6 bytes are always zero.

Here's a more detailed look at the hexdump of the compressed file:

http://imgur.com/ittjYFW

(SE will not let me upload it).

From byte 25 (start counting at 0) to the end of the file is always different. The number of bytes from here to the end of the file is the size of the compressed file indicated earlier.

Attempts to decompress:

1) Thorough googleing. One other guy on the lucas forums and on the xentax forums attempts to decompress it without success. It is not wavepack.

2) Trying common compression algorithms on the uncompressed files. Compress, lzma, gzip do not even come close to the compression ratio reported.

3) Binwalk on the binary:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Microsoft executable, portable (PE)
715764        0xAEBF4         YAFFS filesystem
721564        0xB029C         YAFFS filesystem
746196        0xB62D4         LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 16777216 bytes
</code>```

When I run binwalk on windows I get that it includes DMC (https://en.wikipedia.org/wiki/Dynamic_Markov_compression)

4) Dissembling the Binary and trying to find the location of the decompression code - this is quite difficult

A sample (two files, one encrypted one unencrypted) can be found here:

https://www.dropbox.com/sh/jvljza0v76mvl56/AAC41MenYP57dVHgAXY-DkSsa?dl=0

How can I figure out what it is using?

Thanks

Edit
According to reaper, decompressed file:

22.05 sample rate
16 bits per sample
15323 samples
694 ms

whatever the game does has decoded it into 15323 16 bit integers

Title: Audio file compression identification


问:
How can I further identify a file which the file command lists as 'data'
I have file named 'out'. If I issue the file command I see :

```<code>:~/Desktop# file out
out: data
</code>```

How can I further identify what type of file this is? Interestingly, if I execute the file, I see a 'syntax error near unexpected token' error, suggesting it might be an executable, rather than data. Above command issued on linux.

The file in question was outputted by outguess and is part of a steganography puzzle


问:
Deducing register contents through IDA scripting
In some of my IDA scripts, it would be useful to be able to reason about which variables were stored in which registers at a given place in the program. One example is the following:

mov     rdx, [rbp+client]
mov     rax, [rbp+channel]
mov     rsi, rdx
mov     rdi, rax
call    sub_41002D

It would be useful if I could deduce that, at the time when sub_41002D is called, rdi contains the variable called "channel" and rsi contains the variable "client".

Is there any IDA scripting feature which allows me to do this, or will I need to roll my own solution? If so, is there a name for what I'm trying to do? Do algorithms for this already exist? Any pointers would be appreciated.


问:
find CRC algorithm, having some input and output data pairs
I'm trying to discover the algorithm of a lost software, there is an  equipment that requiest some data, and validates the data using the "KEY", if you change any parameter of the data then you need a valid KEY.

The data is composed of 4 int values and the KEY is a HEX of 6-digits.

```<code>param1  param2      param3  param4  KEY
5669    30/06/2014  187769  960     0xA34108
5812    31/01/2015  233789  960     0xFAE094
5812    31/01/2015  233859  960     0x176471
6437    30/06/2015  368923  10000   0x35E6C2
6468    31/07/2015  398013  10000   0x404818
6161    30/09/2015  312581  960     0x9A59BC
6161    30/09/2015  311298  960     0xEC454C
6655    31/12/2016  448758  960     0x??????
</code>```

I suspect the the algorithm is a type of CRC, because in the software you was able to enter something like a seed of 4-digits HEX in a field called CRC:

By the  KEYs length I think it should be a CRC-24, but the software was using 4-lenght so is not the xor-in nor xor-out of the CRC-24.

I have tested on Python[crcmod] by bruteforce, all parameters combinations to use as input data and all combinations[0x000000-0xFFFFFF] of possible seed and xor-out for the CRC-24.
I also tried to find the equation by curve-fitting but no luck, the relation seams unpredictable.

I know there are many CRC versions: polynomials, hash-tables, etc. Anyone have idea of the the CRC version or algorithm that could be used here?


问:
Implementing call into compiled, undocumented, C DLL; divining exported function prototype
I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer for a while, but I've never had need to do any reverse engineering like this, so apologies if I'm being profoundly dumb.

So far I have managed the following:

Found the names and addresses of the exported functions that relate
to what I want to do inside NVCPL.dll.

Found the only exe that seems to load in a copy of that DLL (nvcplui.exe).

Using API monitor, I found an instance of one of the DLL's functions
being called at what seems to be the right time.

Put break points in the assembly of nvcpl.dll whilst attached to
nvcplui.exe via x64_dbg

Where I'm stuck:

When I was using API monitor, I couldn't seem to catch any direct calls to the function I was looking at (NvCplApiDisableSpan), I only ever found it in the stack before a wndproc call. Also, the break points that I placed in and around that function never get triggered.

My current thoughts are that I'll need to "see" the assembly of the function being called so I can get to the next step of figuring out how to shape my calls to that function correctly.

I thought perhaps that the function was being called by a different process, having being triggered to do so by nvcplui.exe, but according to procexp that's not the case; nvcplui.exe is the only process using that dll.

Any advise you have for me would be greatly appreciated; I'm not averse to doing my homework, but I can't see a way forward without maybe getting hold of a copy of IDA, however, that's a little outside my budget.


问:
IDA Pro monitor applications function calls
is there a function in IDA Pro to monitor all function calls of an application?
So for example if I import an application into IDA it gives me functions like "sub_45E5C6", right?
And now my question is if IDA can log function calls while the application is running (maybe with the debugger?). So I can minimize the window and see which was the last executed funtion.

Any help would be great!


问:
Reversing apps with statically linked libraries
another newbie question from me.

Assuming I know that the application I'm reversing uses certain third party libraries that are publicly available, but it links them statically, is there any easy way to make the debugger recognize the respective function calls in the app? What I want to avoid is to waste a lot of time on analyzing library functions which I know from the start I'm not interested in (such as MFC libraries).

If this is possible, an instruction how to do it in Ollydbg would be great though I'm grateful for any tips.


问:
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:

Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would write parts of the assembly or the entire thing and IDA would try to generate the C code for it. I don't have the binary, just pictures of various small programs (all linux x86). Also don't have any code segments etc (only the picture to guide me).

Right now I only know how to generate C code if I have the compiled binary.

I am using IDA Pro + Decompiler.

ContentLicense: CC BY-SA 4.0


问:
Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?
I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to its symbol table.

I came across the old rsymtab tool that claims to be able to match object code from non-stripped libraries to code in your executable. It would then generate a symbol table file when it finds matches. Unfortunately, rsymtab is more than ten years old and build against a library that doesn't exist on modern Linux systems (libbfd). Is there any modern equivalent to this tool?

(Is this even the right approach when reversing a static/stripped binary? Should the object code be expected to match exactly between the binary and the right version of the third-party lib?)


问:
What is array of applicable components?
I have been digging around and I found a bunch of code that always repeat instructions and my friend suggested that it's calculation of text and he said delphi parameters use eax,edx and ecx.
I would like to know what is array of Applicable components according to its use in the following code?

Can someone tell me what's happening in this code, is it really calculation of text?

Why  005A6D9D push dword ptr [ebx+esi*4+0C]  puts 00000018 on the stack  instead of 00000011?

Here is the piece of the code

```<code> 005A6D66 mov ebx,dword ptr [ebx+esi*4+1DC]
 005A6D6D push ebx
 005A6D6E imul ebx,edx,2E2B
 005A6D74 imul edi,eax,91B7C
 005A6D7A lea edi,[edi*8+5FD208]; gvar_005FD208:array[101] of TApplicableComponents
 005A6D81 push dword ptr [edi+ebx*4+4]
 005A6D85 imul ebx,edx,2E2B
 005A6D8B imul edi,eax,91B7C
 005A6D91 lea edi,[edi*8+5FD208]; gvar_005FD208:array[101] of TApplicableComponents
 005A6D98 lea ebx,[edi+ebx*4]
 005A6D9B push ebx
 005A6D9C pop ebx
 005A6D9D push dword ptr [ebx+esi*4+0C]
 005A6DA1 imul edx,edx,2E2B
 005A6DA7 imul eax,eax,91B7C
 005A6DAD lea eax,[eax*8+5FD208]; gvar_005FD208:array[101] of TApplicableComponents
 005A6DB4 lea eax,[eax+edx*4]
 005A6DB7 mov ecx,dword ptr [eax+esi*4+10]
 005A6DBB pop edx
 005A6DBC pop eax
 005A6DBD call 005A3FA8
</code>```

Thanks in advance

Title: What is array of applicable components?


问:
DirectX calls not appearing
I'm trying to do some reverse-engineering to a DirectX 9 game. I've used PIX to see all the DirectX calls of the game, and that part worked correctly.

After that, I wanted to know where in the code those functions were called from. Therefore, I tried to use API Monitor, but there I got the first surprise: no calls were being found to Graphics and Gaming/DirectX Graphics and Gaming (where all the Direct3D functions are).

As that didn't work, I used IDA instead; In the Imports window, only these were being shown:

And in the Functions window, none of the DirectX functions was found.

So, is this the proper way (if it's possible at all) of doing this? Also, how is that API Monitor doesn't register any DirectX calls, although PIX does?

Title: DirectX calls not appearing


Title: Puzzling 16bit checksum/CRC reverse engineering problem

Body:
We're having a hard time figuring out how the checksum/CRC is calculated for this serial communication protocol we're required to reverse engineer. This is a communication protocol used back in the 1990 (at least). It is used by embedded code for communication between display units. So far, we have noticed some things, but nothing of any relevance to understanding the CRC. Here are a couple of message we collected:

Some messages are quite short. We think it is some sort of acknowledgement. 2 versions exists:

7F 25 64 12 78 21 44 7F 7F

7F 25 64 12 79 31 65 7F 7F

These are some timing messages, as far as we can tell. Notice how byte number 27 changes by an increment of 5:

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 10 38 17 30 00 3D 79 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 15 38 17 30 00 1E 2E 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 1A 38 17 30 00 7B 57 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 1F 38 17 30 00 58 00 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 24 38 17 30 00 38 11 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 29 38 17 30 00 19 6B 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 2E 38 17 30 00 7E 3F 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 33 38 17 30 00 5B 1F 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 38 38 17 30 00 37 60 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 3D 38 17 30 00 14 37 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 42 38 17 30 00 6C 48 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 47 38 17 30 00 4F 1F 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 4C 38 17 30 00 23 60 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 51 38 17 30 00 06 40 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 56 38 17 30 00 61 14 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 5B 38 17 30 00 40 6E 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 60 38 17 30 00 20 7F 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 65 38 17 30 00 03 28 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 6A 38 17 30 00 66 51 7F 7F

Some of these messages change by only one bit (except for the checksum at the end):

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 71 38 17 30 00 2C 24 7F 7F

7F 25 4E 62 01 00 00 67 50 04 10 28 73 7A 2D 31 77 2F 03 21 33 00 27 13 7C 7F 73 38 17 30 00 4B 70 7F 7F

So, what we managed to figure out:

Obviously, 7F25 is the start of the message, 7F7F is the end (this is constant over all messages).

bytes number N-2 and N-3 act as some sort of checksum/CRC.

No byte is higher than 7F anywhere. Never.

Looking at some messages, it appears that a single bit change untroduce large variations of the checksum bytes. This pointed us in the dirrection of a CRC algorithm.

We've been told that the company that created the protocol likely used some variation of CRC16-CCITT. We have been unable to confirm/verify that.

We are at lost. Any help in solving this riddle would be greatly appreciated.

Thanks.

EDIT 1

I tried a lot of different CRC variations, with lots of different parts of the messages. Nothing came up interesting. Except this...

If you look at the 2 very short messages, you can see that after removing the start message bytes and the end message bytes, we are left with a message of only 3 bytes + 2 checksum bytes. Only one of the message bytes changes, the last one. The difference between the 2 messages (0x78 becomes a 0x79 on last position) results in only the last bit of the message changing. This results in a change in the 2 checksum bytes (0x21 becomes 0x31 and 0x44 becomes 0x65). Translating this information in bit, 01111000 becomes 01111001 (a change of only the last bit -> 00000001) which results in 00100001 becoming 00110001 for the first checksum byte (a change of 00010000) and 01000100 becoming 01100101 for the first checksum byte (a change of 00100001). (By a change, I mean a XOR operation)

Now, the interesting part, if I apply variations of the CRC16-CCITT (XModem, Kermit, 0xFFFF, etc.), the result (the XOR operation I have to apply to the checksum bytes to go from the 0x78 terminated message to the 0x79 terminated message) is the same!! The result is not (the checksum bytes are not what is expected) but the impact changing the single last byte has on the checksum is indeed the same. This points me in the direction of the CCITT CRC, only with a starting value different than the obvious. I did try all the possibilities of the message (only the last byte, then the last 2, etc.). There is a very limited amount of possibilities with only 3 bytes!

All this might only be a (very intreging) coincidence, but I think there is a much more simple/elegent (aka mathematical) explanation. I just lack the mathematical skills to see the obvious...

EDIT 2

The "No byte is higher than 7F" part is of course very easy to explain: there is only 7 bits of data for this protocol over serial communication. Dah! But it implies that if the check is a crc, it will yield larger than 7F checksum, which will then have to be "mod 7F" to be transmitted over the serial communication.

Trying not to "left any stone unturned".


问:
Found function in ida pro, but address keeps changing
I am trying to learn reverse engeneering, so I wrote a little hackme (Very basic console application, asks for a password, and outputs 'right' or 'wrong'). The first thing I wanted to do was finding the address of the '_' function, which basically outputs the given string in the console. After some searching, I found my function, but when placing a breakpoint and debugging or restarting the application, sometimes the function address changes.

My questions:

Why is the address changing

How could I dynamically find the function if I can't prevent it from changing?


问:
An anti debug method on Linux
I have found this question (linux) How to debug a "debugger"?
It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process.
I would like to know how efficient this technique is: is there a way to bypass this method and to attach a debugger to the child? (for example - if possible - by detaching it first) I met this method reading about Apriorit, but they also use nanomites.

EDIT: There are some advices at (linux) How to debug a "debugger"? but I would like to see some real examples.

EDIT2: If somebody can show how easy or hard is to bypass it that would also show how effective is it.

Title: An anti debug method on Linux


问:
Dump router firmware over U-BOOT
I connected ttl cable to my router board, and Im trying to dump firmware in order to flash second device over web interface with my backup so I have few questions:

What binary file for ex. upgrade.bin contains ? Kernel image, files, user settings ? Im asking that because Im not sure which partition do I need to dump there is few

```<code>dev:    size   erasesize  name
mtd0: 00800000 00010000 "Whole_Flash"
mtd1: 00020000 00010000 "Bootloader"
mtd2: 00010000 00010000 "defcfg"
mtd3: 00020000 00010000 "curcfg"
mtd4: 00010000 00010000 "log"
mtd5: 00180000 00010000 "kernel1"
</code>```

And here is table from U-BOOT

```<code>AMAZON_S # bdinfo
boot_params = 0x81DDEFB0
memstart    = 0x80000000
memsize     = 0x02000000
flashstart  = 0xB0000000
flashsize   = 0x00800000
flashoffset = 0x00000000
</code>```

I did tried with dd but on board busybox does not contain one so I need to do it over U-BOOT but I cant "initialize" SPI device

```<code>AMAZON_S # help sf
sf probe [bus:]cs [hz] [mode]   - init flash device on given SPI bus
                                  and chip select
sf read addr offset len         - read `len' bytes starting at
                                  `offset' to memory at `addr'
sf write addr offset len        - write `len' bytes from memory
                                  at `addr' to flash at `offset'
sf erase offset len             - erase `len' bytes from `offset'

AMAZON_S # sf probe 0
Failed to initialize SPI flash at 0:0
</code>```

And last how could I determine how long is "Whole_Flash" or "kernel1"
 in order to dump correct amount of memory ?

```<code>AMAZON_S # printenv
bootcmd=run flash_flash
bootdelay=3
baudrate=115200
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
serverip=192.168.1.55
netdev=eth0
baudrate=115200
rootpath=/opt/nfs
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
ramargs=setenv bootargs root=/dev/ram rw
addip=smem=2M
vpe1_load_aotargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
mem=32M
vpe0mem=30M
vpe1mem=2M
vpe1_load_addr=0x81e00000
addmisc=setenv bootargs $(bootargs) console=ttyS1,$(baudrate) ethaddr=$(ethaddr) phym=$(mem) mem=$(vpe0mem) panic=1 vpe1_load_addr=$(vpe1_load_addr) vpe1_mem=$(vpe1mem) vpe1_wired_tlb_entries=1
flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)
ramdisk_addr=B0100000
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
img_uboot=u-boot.ifx
net_nfs=tftp 80500000 $(img_kernel);run nfsargs addip addmisc;bootm
net_ram=tftp 80500000 $(img_kernel);run ramargs addip addmisc;bootm
load=tftp 80500000 $(img_uboot)
flash_flash=run addip addmisc; bootm $(kernel_addr)
f_ubootconfig_addr=0xB001A000
f_ubootconfig_size=0x1000
ethaddr=20:89:86:06:B4:00
ipaddr=192.168.1.1
netmask=255.255.255.0
stdin=serial
stdout=serial
stderr=serial
ethact=amazon_s Switch

Environment size: 1252/4092 bytes
</code>```

Title: Dump router firmware over U-BOOT


问:
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.

I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect the hydrometer uses a serial communication.

First I connected my laptop with the help of a Bluetooth manager and tried to communicate with it with a serial terminal. Through trial and error I've managed to receive some information when sending the character "0x44" in hexadecimal. Alas what I receive isn't human readable, here is an example:

```<code>\0x11\0x1a\0x19D0L\0xda\0xae\0x9b \0xcc\0x01\0xa2q\0x13\0x00\0x13p:\0xcb(\0x8a\0x0c\0xf6\0xeb`#\0xbdv
</code>```

I've then used BluetoothSerial a phonegap plugin for serial communication over Bluetooth, and built a small test application for android, and by sending the same character (0x44), I received a string of strange characters:

```<code>D0Lڮ� ���A��p���wn��
��� )
</code>```

With this 2 experiments I'm lead to believe the information could be encoded or encrypted.

Reading the PDF of a different hydrometer of the same company I've sent the following (in hex):

```<code>10 7B FD 78 16
</code>```

And what I got was the following, in hexadecimal:

```<code>11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 31 13 00 13 70 66 76 0e 26 8b b9 8c 0c 47 b7 3c 09 0b 00 74 0f 00 00 ca 09
11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 41 13 00 13 70 03 ba f2 77 6e 82 81 0d 08 ba c8 09 0b 00 7a 1f 00 00 6c 0a
11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 51 13 00 13 70 14 95 bb dc 4f 51 58 d6 11 b8 49 0a 03 00 6a 2f 00 00 e5 0a
11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 01 13 00 13 70 5f 07 d4 db e9 cd e6 61 6c b0 50 0b 0b 00 57 60 00 00 12 0c
11 1a 19 44 30 4c da ae 9b 20 cc 01 a2 11 13 00 13 70 48 28 9d 70 c8 1e 3f ba 75 b2 b5 09 0a 00 de 71 00 00 0e 0b
</code>```

Just by reading the appendix 2 of the PDF and the M-BUS PDF I can't make any meaning out of this response. I know that when using an already existing android app for this device I get the following information for the device it finds, example:

C10SA202842

current: 500 m3

stored: 500 m3

date: 23/11/15/15 20:14

I've also got the following response:

```<code>11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 31 1c 00 13 9f 8d ba 81 19 d6 e2 a3 ad f0 53 30 0b 0e 00 a2 0c 00 00 ec 0b
11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 41 1c 00 13 9f e8 76 7d 48 33 d9 ae ac bf 5e ba 0a 0d 00 55 1d 00 00 39 0b
11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 51 1c 00 13 9f ff 59 34 e3 12 0a 77 77 a6 5c 9f 09 0d 00 e2 2c 00 00 ba 0a
11 1a 19 44 30 4c 07 f3 d7 20 98 01 a2 61 1c 00 13 9f c6 28 ee 1e 70 7e 1d 1a 8d 5b 3b 09 10 00 df 3d 00 00 67 0a
</code>```

For a different water measuring unit it detected. The android app got the following result in readable format at the same date and (more or less) time:

C14FA152455

current: 0.027 m3

stored: 0.027 m3

date: 23/11/15/15 18:32

How could I find a proper way of decoding that information in readable format, if what I received is indeed what I expected?

OwnerDisplayName: Rui Lima


问:
Locate compressed section of executable
I am playing with Philips DICOM Viewer - download version R3.0 SP3. This viewer can display DICOM information (press F9). Since the displayed strings are not stored in the DICOM file itself, I suspect they are stored somewhere in the binary (standalone binary, no extra DLL loaded):

However I could not find it using strings and or:

```<code>$ binwalk -M -X -e PmsDView.exe
</code>```

Followed by:

```<code>$ grep -r Manufacturer _PmsDView.exe.extracted
</code>```

and

```<code>$ find _PmsDView.exe.extracted/ -exec strings -n 12 -e l {} \; | grep Manufacturer
</code>```

I picked Manufacturer since this is one of the longer string. Also I only used -e s and -e l as they make the more sense (eg: strings -e l PmsDView.exe and strings -e s PmsDView.exe). I've run -e b, -e B and -e L but they did not return anything.

Title: Locate compressed section of executable


问:
Show IDAPython prompt
Subj hides itself on a mere Escape pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA.

It's IDA 6.1 x32 & IDAPython v1.5.2.

Title: Show IDAPython prompt


问:
Getting writes on address 0x00000000 while in OllyDbg
I am trying to analyze a game with OllyDbg.
 However, when I click the main menu item it tries to write on address 0x00000000 which is a violation. When I try to skip this instruction by filling with NOPs, I soon encounter another instruction that happens to attempt the same dumb write.
Without being debugged by OllyDbg the game runs smoothly. What I am missing? Why does it fail like that in OllyDbg?

I am running Win7 x64, the game is in x86.

Here is the first instruction that does it and the registers.

```<code>0048B65C   . F3:A5          REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]

EAX 00002000
ECX 00000800
EDX 00002000
EBX 02A700CC
ESP 0018F878
EBP 00002000
ESI 05A72034
EDI 00000000
EIP 0048B65C heroes4.0048B65C
C 0  ES 002B 32bit 0(FFFFFFFF)
P 1  CS 0023 32bit 0(FFFFFFFF)
A 1  SS 002B 32bit 0(FFFFFFFF)
Z 0  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFDD000(FFF)
T 1  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00210316 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty -??? FFFF 00000000 00000000
ST1 empty -NAN FFFF FFFFFFFF FFFFFFFF
ST2 empty -??? FFFF 07E007E0 07E007E0
ST3 empty -1.0000000000000000000
ST4 empty 48000.000000000000000
ST5 empty 0.7071067690849304199
ST6 empty 0.2113374471664428711
ST7 empty 0.0
               3 2 1 0      E S P U O Z D I
FST 0130  Cond 0 0 0 1  Err 0 0 1 1 0 0 0 0  (LT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
</code>```


问:
Reverse engineering TPMS sensor data
I'm trying to reverse engineer data received from TPMS (car tyre pressure) sensors. I used rtl_433 tool to capture the data from sensor at 433 MHz. Tool was able to detect data is using FSK modulation and Manchester encoding.

Using reveng I confirmed that end of data consists of 8 bit CRC. At the beginning is 32-bit sensor id, then there should be tyre pressure, temperature data and at least few status bits (together 5 bytes of unknown data). I'm not sure if these data are 8/10/16 bits each, nor their endianess or int/float. I have made a simple PHP script to try several combinations, but didn't get meaningful values with any of them.

The sensor IDs are: 1c/1d/1e/1f e0 ed a5.

Output from reveng -a 4 -w 8 -s:

```<code>width=8  poly=0x07  init=0xd3  refin=false  refout=false  xorout=0x00  check=0xd4  name=(none)
</code>```

Tyre pressures as shown on car display were from 211 kPa in the beginning to 220 kPa at the end after few minutes of driving. Outside temperature was about 5 degC, so final tyre temp could be maybe 15-20 degC at the end, so the question is how to decode the data get these values?

Here is data from 4 sensors:

```<code>00 00 1f e0 ed a5 42 d5 66 c7 f1 10 80
00 00 1f e0 ed a5 42 d4 66 c7 f1 06 80
00 00 1f e0 ed a5 44 d6 66 c7 e4 0a 80
00 00 1f e0 ed a5 44 d4 66 c7 e4 26 80
00 00 1f e0 ed a5 55 d4 68 c8 da 23 80
00 00 1e e0 ed a5 42 d5 66 c7 db bf 80
00 00 1e e0 ed a5 41 d6 65 c8 cb 2d 80
00 00 1e e0 ed a5 41 d5 65 c8 cb 17 80
00 00 1e e0 ed a5 55 d5 68 c8 f7 8f 80
00 00 1e e0 ed a5 55 d4 68 c8 f7 99 80
00 00 1d e0 ed a5 44 d6 66 c7 f7 81 80
00 00 1d e0 ed a5 41 d5 64 c8 eb 17 80
00 00 1d e0 ed a5 55 d5 68 c8 da c7 80
00 00 1d e0 ed a5 42 d5 65 c7 c8 f0 80
00 00 1d e0 ed a5 42 d4 65 c7 c8 e6 80
00 00 1c e0 ed a5 44 d5 65 c8 d9 76 80
00 00 1c e0 ed a5 41 d4 64 c8 d3 d0 80
00 00 1c e0 ed a5 55 d6 67 c8 df d8 80
00 00 1c e0 ed a5 55 d5 67 c8 df e2 80
00 00 1c e0 ed a5 55 d4 67 c8 df f4 80
00 00 1c e0 ed a5 42 d6 65 c7 ef 46 80
00 00 1c e0 ed a5 42 d5 65 c7 ef 7c 80
00 00 1c e0 ed a5 42 d4 65 c7 ef 6a 80
00 00 1f e0 ed a5 44 d6 65 c7 f3 d2 80
00 00 1f e0 ed a5 44 d4 65 c7 f3 fe 80
00 00 1f e0 ed a5 41 d5 64 c8 f6 b6 80
00 00 1f e0 ed a5 41 d4 64 c8 f6 a0 80
00 00 1f e0 ed a5 42 d6 65 c7 f9 af 80
00 00 1f e0 ed a5 42 d4 65 c7 f9 83 80
00 00 1e e0 ed a5 42 d6 64 c7 f7 97 80
00 00 1e e0 ed a5 42 d5 64 c7 f7 ad 80
00 00 1e e0 ed a5 42 d4 64 c7 f7 bb 80
00 00 1f e0 ed a5 55 d6 67 c8 f5 85 80
00 00 1f e0 ed a5 55 d5 67 c8 f5 bf 80
00 00 1d e0 ed a5 42 d5 64 c7 f3 3a 80
00 00 1d e0 ed a5 42 d4 64 c7 f3 2c 80
00 00 1e e0 ed a5 44 d6 64 c7 f4 d5 80
00 00 1e e0 ed a5 44 d5 64 c7 f4 ef 80
00 00 1e e0 ed a5 44 d4 64 c7 f4 f9 80
00 00 1e e0 ed a5 41 d4 64 c8 f6 d9 80
00 00 1e e0 ed a5 55 d6 67 c8 f7 f2 80
00 00 1c e0 ed a5 42 d5 64 c7 f3 43 80
00 00 1d e0 ed a5 44 d6 64 c7 f4 5e 80
00 00 1d e0 ed a5 44 d5 64 c7 f4 64 80
00 00 1d e0 ed a5 55 d6 68 c8 f5 30 80
00 00 1d e0 ed a5 55 d5 68 c8 f5 0a 80
00 00 1d e0 ed a5 55 d4 68 c8 f5 1c 80
00 00 1f e0 ed a5 42 d5 65 c7 f4 b6 80
00 00 1c e0 ed a5 44 d6 65 c7 f5 4b 80
00 00 1c e0 ed a5 44 d4 65 c7 f5 67 80
00 00 1c e0 ed a5 41 d6 64 c8 f2 1b 80
00 00 1c e0 ed a5 41 d5 64 c8 f2 21 80
00 00 1c e0 ed a5 41 d4 64 c8 f2 37 80
00 00 1c e0 ed a5 55 d6 67 c8 ed 46 80
00 00 1c e0 ed a5 55 d5 67 c8 ed 7c 80
00 00 1e e0 ed a5 42 d5 64 c7 f3 b1 80
00 00 1e e0 ed a5 42 d4 64 c7 f3 a7 80
00 00 1f e0 ed a5 44 d6 64 c7 f3 b9 80
00 00 1f e0 ed a5 44 d5 64 c7 f3 83 80
00 00 1f e0 ed a5 44 d4 64 c7 f3 95 80
00 00 1f e0 ed a5 41 d5 64 c8 ed f7 80
00 00 1f e0 ed a5 41 d4 64 c8 ed e1 80
00 00 1f e0 ed a5 55 d4 67 c8 ea f4 80
00 00 1d e0 ed a5 42 d6 64 c7 dc cd 80
00 00 1d e0 ed a5 42 d4 64 c7 dc e1 80
00 00 1e e0 ed a5 44 d6 64 c7 da 1f 80
00 00 1e e0 ed a5 44 d5 64 c7 da 25 80
00 00 1e e0 ed a5 44 d4 64 c7 da 33 80
00 00 1e e0 ed a5 41 d4 64 c7 f4 14 80
00 00 1e e0 ed a5 55 d6 67 c8 f2 e9 80
00 00 1e e0 ed a5 55 d5 67 c8 f2 d3 80
00 00 1c e0 ed a5 42 d6 63 c7 c3 ff 80
00 00 1c e0 ed a5 42 d5 63 c7 c3 c5 80
00 00 1c e0 ed a5 42 d4 63 c7 c3 d3 80
00 00 1d e0 ed a5 41 d6 63 c7 dd 7a 80
00 00 1d e0 ed a5 41 d4 63 c7 dd 56 80
00 00 1d e0 ed a5 55 d6 67 c8 e0 1c 80
00 00 1d e0 ed a5 55 d5 67 c8 e0 26 80
00 00 1f e0 ed a5 42 d6 64 c6 d6 1c 80
00 00 1c e0 ed a5 44 d6 63 c7 d9 f2 80
00 00 1c e0 ed a5 44 d4 63 c7 d9 de 80
00 00 1c e0 ed a5 41 d6 63 c8 d4 ff 80
00 00 1c e0 ed a5 41 d5 63 c8 d4 c5 80
00 00 1c e0 ed a5 55 d4 67 c8 d6 cb 80
00 00 1f e0 ed a5 44 d6 64 c7 d3 59 80
00 00 1e e0 ed a5 42 d5 64 c6 d4 51 80
00 00 1f e0 ed a5 41 d6 63 c7 e9 04 80
00 00 1f e0 ed a5 41 d4 63 c7 e9 28 80
00 00 1f e0 ed a5 55 d6 67 c8 eb df 80
00 00 1f e0 ed a5 55 d4 67 c8 eb f3 80
00 00 1e e0 ed a5 44 d6 63 c7 9d db 80
00 00 1e e0 ed a5 44 d5 63 c7 9d e1 80
00 00 1d e0 ed a5 42 d4 63 c6 9a 37 80
00 00 1e e0 ed a5 41 d6 63 c7 d6 c0 80
00 00 1e e0 ed a5 41 d5 63 c7 d6 fa 80
00 00 1e e0 ed a5 55 d6 66 c8 cf 31 80
00 00 1e e0 ed a5 55 d5 66 c8 cf 0b 80
00 00 1d e0 ed a5 44 d6 62 c7 f4 23 80
00 00 1d e0 ed a5 44 d5 62 c7 f4 19 80
00 00 1c e0 ed a5 42 d6 63 c6 f5 68 80
00 00 1c e0 ed a5 42 d5 63 c6 f5 52 80
00 00 1c e0 ed a5 42 d4 63 c6 f5 44 80
00 00 1d e0 ed a5 41 d6 63 c7 df 74 80
00 00 1c e0 ed a5 55 d4 66 c8 f7 47 80
00 00 1c e0 ed a5 41 d5 63 c7 f5 e1 80
00 00 1c e0 ed a5 44 d6 64 c6 e4 42 80
00 00 1f e0 ed a5 42 d6 5f c6 d4 1f 80
00 00 1f e0 ed a5 42 d5 5f c6 d4 25 80
00 00 1f e0 ed a5 42 d4 5f c6 d4 33 80
00 00 1f e0 ed a5 55 d6 67 c8 eb df 80
00 00 1f e0 ed a5 41 d6 61 c7 dd 5e 80
00 00 1f e0 ed a5 41 d5 61 c7 dd 64 80
00 00 1f e0 ed a5 41 d4 61 c7 dd 72 80
00 00 1e e0 ed a5 42 d4 62 c6 f2 c8 80
00 00 1e e0 ed a5 55 d6 66 c8 e4 e0 80
00 00 1e e0 ed a5 55 d5 66 c8 e4 da 80
00 00 1e e0 ed a5 55 d4 66 c8 e4 cc 80
00 00 1e e0 ed a5 41 d4 62 c7 e2 0b 80
00 00 1e e0 ed a5 44 d6 63 c6 f5 d1 80
00 00 1e e0 ed a5 44 d4 63 c6 f5 fd 80
00 00 1d e0 ed a5 42 d6 60 c6 e4 db 80
00 00 1d e0 ed a5 42 d5 60 c6 e4 e1 80
00 00 1d e0 ed a5 42 d4 60 c6 e4 f7 80
00 00 1d e0 ed a5 41 d6 62 c6 f4 db 80
00 00 1d e0 ed a5 41 d5 62 c6 f4 e1 80
00 00 1d e0 ed a5 41 d4 62 c6 f4 f7 80
00 00 1d e0 ed a5 44 d5 63 c6 f3 72 80
00 00 1d e0 ed a5 44 d4 63 c6 f3 64 80
00 00 1c e0 ed a5 42 d6 61 c5 ef c7 80
00 00 1c e0 ed a5 44 d5 62 c6 c6 eb 80
00 00 1f e0 ed a5 42 d5 61 c5 dd e8 80
00 00 1f e0 ed a5 42 d4 61 c5 dd fe 80
00 00 1f e0 ed a5 41 d6 62 c7 f1 27 80
00 00 1f e0 ed a5 41 d5 62 c7 f1 1d 80
00 00 1f e0 ed a5 41 d4 62 c7 f1 0b 80
00 00 1f e0 ed a5 44 d6 62 c5 d6 15 80
00 00 1f e0 ed a5 44 d4 62 c5 d6 39 80
00 00 1e e0 ed a5 42 d5 61 c5 9f 58 80
00 00 1e e0 ed a5 42 d4 61 c5 9f 4e 80
00 00 1c e0 ed a5 55 d5 65 c7 85 76 80
00 00 1e e0 ed a5 41 d6 62 c6 ca ea 80
00 00 1e e0 ed a5 41 d4 62 c6 ca c6 80
00 00 1e e0 ed a5 44 d5 61 c6 f3 2f 80
00 00 1d e0 ed a5 42 d6 60 c5 f0 88 80
00 00 1d e0 ed a5 42 d5 60 c5 f0 b2 80
00 00 1d e0 ed a5 42 d4 60 c5 f0 a4 80
00 00 1f e0 ed a5 55 d5 65 c7 e8 f9 80
00 00 1d e0 ed a5 41 d6 61 c6 ec 2e 80
00 00 1d e0 ed a5 41 d5 61 c6 ec 14 80
00 00 1d e0 ed a5 41 d4 61 c6 ec 02 80
00 00 1d e0 ed a5 44 d5 62 c5 ea 69 80
00 00 1d e0 ed a5 44 d4 62 c5 ea 7f 80
00 00 1c e0 ed a5 42 d6 5c c4 ea b9 80
00 00 1c e0 ed a5 42 d4 5c c4 ea 95 80
00 00 1e e0 ed a5 55 d5 65 c7 e2 b6 80
00 00 1c e0 ed a5 41 d6 61 c6 e4 6f 80
00 00 1c e0 ed a5 41 d4 61 c6 e4 43 80
00 00 1c e0 ed a5 44 d6 61 c5 e6 b3 80
00 00 1c e0 ed a5 44 d5 61 c5 e6 89 80
00 00 1c e0 ed a5 44 d4 61 c5 e6 9f 80
00 00 1f e0 ed a5 42 d6 61 c4 dd c7 80
00 00 1f e0 ed a5 42 d4 61 c4 dd eb 80
00 00 1d e0 ed a5 55 d5 65 c7 d3 aa 80
00 00 1d e0 ed a5 55 d4 65 c7 d3 bc 80
00 00 1f e0 ed a5 41 d6 61 c6 da 5e 80
00 00 1f e0 ed a5 41 d5 61 c6 da 64 80
00 00 1f e0 ed a5 44 d5 61 c5 ec 34 80
00 00 1e e0 ed a5 42 d6 60 c4 e9 59 80
00 00 1e e0 ed a5 42 d4 60 c4 e9 75 80
00 00 1e e0 ed a5 41 d6 62 c6 d6 be 80
00 00 1e e0 ed a5 41 d5 62 c6 d6 84 80
00 00 1e e0 ed a5 44 d6 61 c5 d9 fc 80
00 00 1e e0 ed a5 44 d4 61 c5 d9 d0 80
00 00 1d e0 ed a5 42 d6 60 c3 de 3c 80
00 00 1d e0 ed a5 42 d5 60 c3 de 06 80
00 00 1d e0 ed a5 42 d4 60 c3 de 10 80
00 00 1d e0 ed a5 41 d6 61 c6 e2 04 80
00 00 1d e0 ed a5 44 d5 61 c5 df 5f 80
00 00 1d e0 ed a5 44 d4 61 c5 df 49 80
00 00 1c e0 ed a5 42 d6 5f c4 d8 9a 80
00 00 1c e0 ed a5 42 d5 5f c4 d8 a0 80
00 00 1c e0 ed a5 42 d4 5f c4 d8 b6 80
00 00 1f e0 ed a5 55 d6 65 c7 d8 53 80
00 00 1f e0 ed a5 55 d4 65 c7 d8 7f 80
00 00 1c e0 ed a5 41 d6 61 c6 dc c7 80
00 00 1c e0 ed a5 41 d5 61 c6 dc fd 80
00 00 1c e0 ed a5 41 d4 61 c6 dc eb 80
00 00 1c e0 ed a5 44 d6 61 c5 df 1c 80
00 00 1c e0 ed a5 44 d5 61 c5 df 26 80
00 00 1c e0 ed a5 44 d4 61 c5 df 30 80
00 00 1f e0 ed a5 42 d5 60 c3 e6 5c 80
00 00 1f e0 ed a5 42 d4 60 c3 e6 4a 80
00 00 1e e0 ed a5 55 d5 65 c7 e6 aa 80
00 00 1f e0 ed a5 41 de 61 c6 f7 2d 80
00 00 1f e0 ed a5 41 dd 61 c6 f7 17 80
00 00 1f e0 ed a5 41 dc 61 c6 f7 01 80
</code>```

EDIT: The question is how to decode temperature & pressure from the received data.

Title: Reverse engineering TPMS sensor data