问:
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. What is the right way to go about it?

My subject is a simple recursive descent parser for expressions and it accepts inputs of the form 1+(2*3) etc.

What I have tried so far:

Wrote a program that constructs an initial state with string arguments, executed it through stepping one at a time, and at the end, collect constraints.

```<code>import sys
import angr

class Program:
    def __init__(self, exe):
        self.exe = exe
        self.project = angr.Project(exe, load_options={'auto_load_libs': False})

    def set_input(self, arg):
        self.arg1 = arg

        self.initial_state = self.project.factory.entry_state(
                args=[self.exe, self.arg1],
                # does not seem to startup the unicorn engine
                add_options=angr.options.unicorn,
                )

    def run(self):
        state = self.initial_state
        while True:
            succ = state.step()
            if len(succ.successors) > 1:
                raise Exception('more successors %d' % len(succ.successors))
            if not succ.successors: return state
            state, = succ.successors

def main(exe, arg):
    prog = Program(exe)
    prog.set_input(arg)
    res = prog.run()
    print("constraints: %d" % len(res.solver.constraints))
    for i in res.solver.constraints:
        print(i)
    print('done')

if __name__ == '__main__':
    assert len(sys.argv) >= 3
    main(sys.argv[1], sys.argv[2])
</code>```

When I execute this, I get zero constraints.

Using constrained symbolic arguments

I got the idea that I should make the arguments symbolic, and add constraints to each characters in the input, using state.add_constraints, and look for the constraints produced at the end.

```<code>import sys
import angr
import claripy

class Program:
    ARG_PREFIX = 'sym_arg'
    def __init__(self, exe):
        self.exe = exe
        self.project = angr.Project(exe, load_options={'auto_load_libs': False})

    def set_input(self, arg):
        # generate arg1 from individual characters.
        self.arg1 = self.make_symbolic_char_args(arg)

        self.initial_state = self.project.factory.entry_state(
                args=[self.exe, self.arg1],
                add_options=angr.options.unicorn,
                # does not seem to affect the number of constraints created
                # remove_options=angr.options.simplification
                )
        self.constrain_input_chars(self.initial_state, self.arg1a, arg)
        self.string_terminate(self.initial_state, self.arg1a, arg)

    def string_terminate(self, state, symarg, inarg):
        state.add_constraints(symarg[len(inarg)] == 0)

    def constrain_input_chars(self, state, symarg, sarg):
        constraints = []
        for i,a in enumerate(sarg):
            state.add_constraints(symarg[i] == a)

    def run(self):
        state = self.initial_state
        while True:
            succ = state.step()
            if len(succ.successors) > 1:
                raise Exception('more successors %d' % len(succ.successors))
            if not succ.successors: return state
            state, = succ.successors

    def make_symbolic_char_args(self, instr, symbolic=True):
        if not symbolic: return instr
        input_len = len(instr)
        largs = range(0, input_len+1)
        arg1k = ['%s_%d' % (Program.ARG_PREFIX, i) for i in largs]
        self.arg1h = {k:claripy.BVS(k, 8) for k in arg1k}
        self.arg1a = [self.arg1h[k] for k in arg1k]
        return reduce(lambda x,y: x.concat(y), self.arg1a)

def main(exe, arg):
    prog = Program(exe)
    prog.set_input(arg)
    res = prog.run()
    print("constraints: %d" % len(res.solver.constraints))
    for i in res.solver.constraints:
        print(i)
    print('done')

if __name__ == '__main__':
    assert len(sys.argv) >= 3
    main(sys.argv[1], sys.argv[2])
</code>```

While this results in a large number of constraints at the end, I am at a loss how to interpret these constraints to what I want -- comparisons to input characters. The constraints are fairly complex, but there are lots duplicated portions in each item. Any advice on translating these constraints that look like below to actual character comparisons would be greatly appreciated.

```<code>...
<Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_5_64>
<Bool 0x1 <= strlen_5_64>
<Bool ((0#56 .. 0#7 .. __invert__((if ((sym_arg_0_0_8 == 40) && (sym_arg_0_0_8[7:7] == 0)) then 1 else 0))) & 0xff) != 0x0>
<Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_6_64>
<Bool 0x1 <= strlen_6_64>
<Bool ((0#56 .. 0#7 .. (if ((sym_arg_0_0_8 == 49) && (sym_arg_0_0_8[7:7] == 0)) then 1 else 0)) & 0xff) != 0x0>
<Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_7_64>
<Bool 0x2 <= strlen_7_64>
<Bool ((0#56 .. 0#7 .. (if ((sym_arg_1_1_8 == 49) && (sym_arg_1_1_8[7:7] == 0)) then 1 else 0)) & 0xff) == 0x0>
<Bool (((if (sym_arg_0_0_8 == 0) then 0x0 else (if (sym_arg_1_1_8 == 0) then 0x1 else (if (sym_arg_2_2_8 == 0) then 0x2 else (if (sym_arg_3_3_8 == 0) then 0x3 else 0x4)))) + 0x7fffffffffeffd4) - 0x7fffffffffeffd4) == strlen_8_64>
<Bool 0x2 <= strlen_8_64>
...
</code>```

Problem: too slow

The above approach also takes too long to execute even for inputs a few characters long. I tried executing the above on simple recursive descent parser for expressions with input of a few characters: (1+4/1+4/(1+4)). It took more than 30 minutes to parse!, while the running the parser directly comes out in less than a second. I would be OK with that time if there was no other way out, but this being concolic, I cant shake the feeling that there must be a better way.

Using unconstrained symbolic arguments, but exploring my own

The idea is that I start with the input constraints such that each symbolic character equal to corresponding input. Then I provide my own path of execution such that only the paths that satisfy the input constraints are chosen for further execution. My idea was that since I do not start the original character constraints in the initial state, I can inspect the final state to determine other constraints that accumulated on each character.

```<code>import claripy
import sys
import angr

class Program:
    ARG_PREFIX = 'sym_arg'
    def __init__(self, exe):
        self.exe = exe
        self.project = angr.Project(exe, load_options={'auto_load_libs': False})

    def set_input(self, arg):
        # generate arg1 from individual characters.
        self.arg1 = self.make_symbolic_char_args(arg)
        self._constraints = []
        self.constrain_input_chars(self.arg1a, arg)
        self.string_terminate(self.arg1a, arg)
        self.constraints = claripy.And(*self._constraints)
        self.initial_state = self.project.factory.entry_state(
                args=[self.exe, self.arg1],
                add_options=angr.options.unicorn,
                )

    def string_terminate(self, symarg, inarg):
        self._constraints.append(symarg[len(inarg)] == 0)

    def constrain_input_chars(self, symarg, sarg):
        for i,a in enumerate(sarg):
            self._constraints.append(symarg[i] == a)

    def get_satisfying_state(self, state):
        succ = state.step()
        if not succ.successors: return None
        result = [i.satisfiable(extra_constraints=(self.constraints,)) for i in succ.successors]
        assert len(result) == 1
        return result[0]

    def run(self):
        state = self.initial_state
        while True:
            newstate = self.get_satisfying_state(state)
            if not newstate: return state

    def make_symbolic_char_args(self, instr, symbolic=True):
        if not symbolic: return instr
        input_len = len(instr)
        largs = range(0, input_len+1)
        arg1k = ['%s_%d' % (Program.ARG_PREFIX, i) for i in largs]
        self.arg1h = {k:claripy.BVS(k, 8) for k in arg1k}
        self.arg1a = [self.arg1h[k] for k in arg1k]
        return reduce(lambda x,y: x.concat(y), self.arg1a)

def main(exe, arg):
    prog = Program(exe)
    prog.set_input(arg)
    res = prog.run()
    print("constraints: %d" % len(res.solver.constraints))
    for i in res.solver.constraints:
        print(i)
    print('done')

if __name__ == '__main__':
    assert len(sys.argv) >= 3
    main(sys.argv[1], sys.argv[2])
</code>```

This again did not work, as it takes extremely long time to parse even a few characters.

Other options I have considered

Writing a memory hook that monitors when the input string memory is read from.
But this wont work for me because the characters may be copied before compared.

I have read the angr docs multiple times now and can't figure out what to do. I cant shake the feeling that it should be simpler as angr is a symbolic execution engine that supports concolic execution, and what I am doing is pretty much plain vanila concolic execution. What can I do next?

Any help would be greatly appreciated!.


ContentLicense: CC BY-SA 4.0

Title: Naruto Uzumaki Chronicles 2 .RAW Files [PS2]

Body:
I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a signature scan using binwalk does not return any results. Here is the entropy scan of one of the files:

Moreover, a hex dump of the first few bytes in the file do not reveal any obvious header structure:

```<code>$ hexdump -C -n 256 000001a6_5835296_6.raw
00000000  00 05 00 ff cd 14 20 58  80 03 02 04 04 b8 20 20  |...... X......  |
00000010  00 90 c0 99 02 18 20 10  a0 00 84 01 13 00 76 0a  |...... .......v.|
00000020  70 c0 40 80 01 20 a0 3e  08 10 08 e2 a7 00 07 10  |p.@.. .>........|
00000030  04 18 00 b0 ec 80 00 c0  c3 bc 0a 70 40 41 80 7a  |...........p@A.z|
00000040  4c 02 04 80 61 3c 56 80  03 16 02 0c b0 81 26 42  |L...a<V.......&B|
00000050  8f 00 41 23 4c 00 e2 f8  43 80 25 42 20 78 de 12  |..A#L...C.%B x..|
00000060  20 20 9c 01 07 90 c0 86  f0 25 40 fa 00 4f 9c 38  |  .......%@..O.8|
00000070  21 2f e1 4b 00 10 30 4d  04 88 a4 a1 50 80 50 65  |!/.K..0M....P.Pe|
00000080  2b 04 38 82 2a c0 10 2c  05 06 08 28 40 e0 80 13  |+.8.*..,...(@...|
00000090  24 00 ff 04 08 e1 db b7  13 23 b6 9d 28 f0 ff 3f  |$........#..(..?|
000000a0  40 00 d4 8b 02 0c 60 14  20 00 c8 a0 3b 02 04 0d  |@.....`. ...;...|
000000b0  3a c2 2e 01 58 20 9a ef  08 00 25 4a 00 80 c1 3a  |:...X ....%J...:|
000000c0  0d 80 40 00 6c d0 11 80  83 3e 01 00 0b 48 f3 05  |..@.l....>...H..|
000000d0  40 5e 0d 00 f4 6a 00 e8  a0 23 80 07 7d 22 12 4c  |@^...j...#..}".L|
000000e0  f3 05 20 96 05 08 00 66  d9 00 f0 41 47 00 10 ba  |.. ....f...AG...|
000000f0  23 80 2f 40 cd 17 80 be  16 20 00 68 6b 03 40 0c  |#./@..... .hk.@.|
00000100
</code>```

Raw Files
https://drive.google.com/file/d/1_LD5uCWewHncJLRlHR-X0_Zh0h7qTvFl/view

I would like to identify the compression algorithm used to compress these files so that they can be decompressed and analyzed.


问:
Recognizing instructions containing low-level control flows
There are some x86 instructions which containing a low-level** control flow in its semantics, for example div because its semantics is roughly as:

```<code>if (source == 0)
   throw exception...
else
   return rdx:rax / source
</code>```

or instructions with rep prefix, etc. While a mov or a xor doesn't contain any control flow.

I am trying to classify instructions of x86 ISA depending on this criteria, my starting point now is looking into Xed's API to know if there exists some function which can give such an information, but it doesn't seem having any.

Concretely for div, I've checked xed_decoded_inst_conditionally_writes_registers, xed_operand_conditional_read/write, but all of them return false.

** I'm sorry for this word, I don't know the precise terminology for this case.

Edit: many thanks for comments but I've badly expressed my question. I update in the following some discussion to make the context more clear.

Xed's API would not give full instruction semantics, but some. For example, with some xed API (which I described above) we can get:

```<code>mov rax, r8

operands:                       2
uses rflag:                     no
has conditional read operand:   no
has conditional write operand:  no
conditionally write register:   no
</code>```

and

```<code>cmovb rax, r8

operands:                       3
uses rflag:                     yes
has conditional read operand:   no
has conditional write operand:  yes
conditionally write register:   yes
</code>```

so at least I know that cmovb should have some conditional control flow in its semantics, while mov has not.

I tried to apply this logic for other instructions: it works for some (e.g. rep movsb, etc.), but not all:

for div*** (or mov), it would be "acceptable"* to say that there is no
conditional control flow, IMHO. We consider that an exception is side
effect: the instruction is not executed (or only partially executed)
if the exception is thrown

for other cases of, e.g. minps, this logic simply doesn't work

*** I have initially thought that div contains conditional data-flow, but changed later :)


问:
How to find first/next instruction in IDA trace via IDC
Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns 0xFFFFFFFF. Also I've tried to save the trace to file, but it's in IDA proprietary format, and there's no API to manipulate the trace data, but load_trace_file/save_trace_file in SDK neither. Then I tried to export trace log into text file and parse it. But it's totally useless. Ida for some reason saves not the RVA, and not the virtual address of the traced instruction, but demangled name of the function + offset like this:

```<code>.text:dllmain_dispatch(HINSTANCE__ * const,ulong,void * const)+3D
</code>```

So even if you're able to extract "dllmain_dispatch(HINSTANCE__ * const,ulong,void * const)" you need to mangle it back to use it in get_name_ea(). Seems like IDA tracing information is not supposed to be used anywhere, but displaying the instructions within trace window...


问:
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt something. The time savings here are fantastic, what with not having to redo what I did to get to a certain point.

The issue is that I would like to achieve the same sort of thing, but with games that utilize DirectX 10+. You can't do that with VMs due to a lack of support, graphically. (You can technically do it with VMWare, but you also need to buy a hardware GPU unit of theirs, which is thousands of dollars.)

Bearing that in mind, are there any applications that can help achieve this? Short of that, is there any theoretical (possibly even practical) way that, on a host, one could pause an application, then capture the state of execution such that it could be resumed later on said host? Something like a memory dump plus gathering context of threads, register states, and whatever else might be needed--as well as what steps might be to restore that full state?

I know this is probably a bit of an outlandish question, but I appreciate any insight on the matter. Thank you!


问:
Can I see Stack and Heap value/addresses from this simple C# program process?
I am studying reading dumped memory image and analyzing it with volatility.

I wrote this c# program and I was hoping to see the analyzed data from Volatiliy

```<code>namespace CSharpEx1
{
    class Program
    {
        static void Main(string[] args)
        {
            int numberA = 12345;
            string textA = "This is Message";
            var someClassA = new SomeClassA();
            Console.WriteLine("Something printed here");
            Console.ReadKey();
        }

        class SomeClassA
        {
            private int _numberB;
            private string _textB;

            public SomeClassA()
            {
                _numberB = 67890;
                _textB = "Another Message";
            }
        }

    }
}
</code>```

I would like to be able to see: numberA, textA, numberB and textB

I hope I was clear, thanks for any direction


问:
Firmware analysis, can't find file system
I'm TV repair tech and I've found that corrupted firmware is responsible for  the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the firmware, I could probably write a  script which could analyze a fw image and determine if it's corrupted or not. The current method involves buying a preprogrammed eeprom, at a cost of $15, and at least half the time it ends up being a waste of money.

I've done some testing with UART and found that I get the same messages at boot whether the fw is corrupted or not, basically saying everything is OK. That leads me to believe that the problem is with the file system. And that's pretty much where I'm stuck. I've tried binwalk, and after some time I have been able to extract and decompress about 3mb of LZMA compressed data and a JPG which is the splash screen, but I can't find the file system.

Running binwalk on the original binary, I get this:

```<code>101602        0x18CE2         MySQL MISAM index file Version 4
145536        0x23880         LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: 3126792 bytes
2246688       0x224820        JPEG image data, JFIF standard 1.02
</code>```

For whatever reason, I can't seem to extract the MISAM part.

Running binwalk on the decompressed LZMA part I get this:

```<code>1484791       0x16A7F7        PARity archive data - file number 24064
1715704       0x1A2DF8        MySQL MISAM index file Version 4
1764734       0x1AED7E        Boot section Start 0x0 End 0x100
</code>```

I've tried extracting the PARchive and boot sections with dd, but I can't open them. I think it's because of trailing garbage. I've used hexdump and searched for magic bytes, but can't find any. Any suggestions would be greatly appreciated. I can also provide a copy of the fw if anyone cares to take a stab at it.


问:
Joysmade USB/WiFi microscope
Short intro: I am building an electronics workbench, and I needed a microscope. This Joysmade USB/WiFi microscope was $45, and it would work with exception to the below issues.

My "dumb" TV was set above the workbench so that I could use it as the display for a microscope. The Joysmade USB/WiFi microscope has an app for Android and iOS as well as one for Windows. I don't have room for a real computer, so I have a Raspberry Pi Zero W hooked into the TV. I finally got the USB portion to work with Raspbian, but the speed is about 9 FPS.

I have decompiled the Android APK, but might be too inept to understand how to trace through to determine how it is working. There are a few ARM binary libraries in there, one I am specifically interested in, but I can't find a decent tool to decompile that.

I have used Wireshark to capture some UDP traffic, and I can't determine what to make of that one, either. This is probably some ineptitude here as well.

I know that the WiFi module is an SSV7241 based on the link within the WiFi status page on the microscope itself, but can't figure out how to connect to the microscope using a regular media player like VLC. This is the ultimate goal, as Raspbian has VLC and the goal is to have it displayed wirelessly to the "dumb" TV through the Raspberry Pi. Also of note is that there is a TCP port open on 8081. I can't really figure out what to do to probe that port any further, though.

This thing can't be taken apart without breaking the casing. I've tried. Not much more can be figured out about the circuitry without sacrificing the unit.

Can anyone give me a bit more of a shove in the right direction or offer up some guidance in getting this thing to bend to my will? I'm too cheap and cramped for space to get a real microscope.

Once again, I am trying to figure out how to connect to the WiFi stream on the microscope through VLC, MPlayer, or some other video player on the Raspberry Pi so that I can view it in HD glory on a 46" television hanging above my bench. I think this will take some decoding of the UDP stream, but I'm not experienced enough to do this, and can't find a lot of help through a Google search.

Title: Joysmade USB/WiFi microscope


问:
IDAPython: Get the operand string without any substitutions
I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset string). Is there an easy way to achieve this from IDAPython?

Cheers,
Thomas


问:
Is Dynamic Binary Instrumentation legal in UK/EU for malware analysis?
I am doing a university project about performing malware analysis on binary files. The end goal would be to analyze real world executables(Microsoft Office installation file for example). If I use DBI, am I in breach of any Europeans law?</p>


问:
How to get index register from the instruction in IDA?
I have the instruction:

```<code>add     edx, ds:dword_7BFC7A50[eax*4]
</code>```

i.e.

```<code>add     edx, [eax*4+7BFC7A50h]
</code>```

And I decode it via decode_insn(). Then I try to get the information about the second operand. I can get 7BFC7A50 from insn_t.addr, but I can't get any information about  [eax*4]. I mean I expect register number to be in insn_t.ops[1].phrase, but there's an invalid value. And for some reason insn_t.ops[1].type is o_mem, not o_displ.


问:
How to step to specific function call?
I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However, I used rohitab's API Monitor to see the function call, but I'm having a hard time identifying it in a debugger. I'd like to use x64dbg since that's what I'm trying to learn, but IDA/Olly/Win all work. Any help is much appreciated!

I included an image that shows the function call and the call stack. The one highlighted in blue is the one I'm trying to step to. Once I can step to it and have the debugger pause the process, I can issue a memory dump.

Title: How to step to specific function call?


问:
EEPROM data bytes verification
I'm investigating a tool. I have an section of an eeprom memory dump that this tool uses, shown in the figure below. By my inquiries, the two bytes highlighted in red are based on the bytes highlighted in green, because when the tool I am investigating changes any of the bytes in the green section, the tool changes the two bytes in red. When I manually change the data in green the tool does not recognize the file.
There is a redundant section just below, which I did not highlighted. However, the same applies to it. When I make redundant modifications to these sections, the tool does not recognize the file too.
The remainder of the file, outside the highlighted sections and its redundant portion, can be reset and the tool continues to recognize the file.

I tried CRC-16, CRC-16 CCITT, xor operations every 2 bytes, for example: 0x2017 ^ 0x28B3 ^ 0x10DB ^ 0xB858 ...
But I did not find the values highlighted in red. Anyone have any tips?

[EDITED]

I will put the numbers of the region in green here, maybe it can be more useful for those who want to help

20 17 28 B3 10 DB B8 58 00 00 00 00 00 00 00 00
54 48 AA 00 54 48 AA 00 00 00 00 00 00 00 00 00
4A 7E 5E 0C 00 00 00 00 00 00 00 00 00 00 00 00
00 7D 5E 6C 00 00 00 00 00 00 00 00 00 00 00 00
CD 7E 85 5B 7A B4 A2 CC A0 5C 81 D2 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 CD 7E
85 5B 7A B4 02 00 00 00 F9 E5 02 99 A6 1B 02 02
00 00 01 00 00 80 6B 00 0D 4E 04 00 00 00

Title: EEPROM data bytes verification


问:
Deobfuscate PHP that contains - goto
I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www.php-obfuscator.com/ and no deobfuscate tool that I know can convert php goto/labels to loops so I strongly think this is not a duplicate question. Can goto/labels be converted to while/foreach loops?</p>

Title: Deobfuscate PHP that contains - goto


问:
Need help understanding IDA Pro pseudocode
I am new into IDA and have some questions about the pseudocode in C.
Could someone please explain to me the meaning of the following two lines:

(*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, *(_DWORD *)(*v1 + 200));

What does (*v1 + 196) mean?

if ( *(_BYTE *)(dword_9AEC7FB0 + 170) & 1 && !*(_DWORD *)(dword_9AEC7FB0 + 92) )

What is dword_9AEC7FB0? A global variable?


问:
How to dump firmware from R5F71424 MCU
I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware.

It has a limited boot mode that only allows writing to the MCU.

Any pointers or ideas would be helpful.

Title: How to dump firmware from R5F71424 MCU


问:
Recovering data from mystery signal
I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following audio. (Wav file)

So I started investigating and here are my findings:

What I know:

According to my local FCC equivalent the license documents list it as coming from an electrical switch yard.

There is are two different frequencies for Tx and Rx.

The signal runs continuously.

What I assume:

That this is a 2-fsk/BFSK signal, due to the two tones it uses.

That it is broadcast in NFM. That mode does sound the best however, and lines up with licensing documents.

That it is actually data, not just some tone control system or random noise.

What I have done

In SDR Console V3 I created an IQ recording. (Large File)

I then created a flow graph in GNURadio to record a file using a sink file. (Large File)

I created a GNURadio flow graph using that file as an input to low pass filters and a FM Demod.

The Demodulated file was then opened in Inspectrum which produced the following image.

What I think I need to do next

I think I need to recover the clock of the signal somehow. I have had a look for a preamble but can't see anything that might match.

I thought it might be Manchester encoded but I can see long runs of 0's or 1's so I don't think it is.

I thought it might be clocked to the frequency of the local power supply given that it is in a switch yard, but it doesn't line up completely with rise or falls of the signal.

Am I on the right path with this?

Is there a way to determine the start of the message? The receiving radio has to be able to lock on to the start of the message somehow, right?

I did find a program in Linux called minimodem. I used the following command to get a somewhat readable output.

minimodem  -r -i -5 -M 1615 -S 1680 12 -f file_mono1.wav
It gave me the following output:

```<code>TTTGB?/2991"05"/"ZWLOQB?/29.1?)5"/"WWLOPZBOWWOMQBLTZXZLWZTGB?/OOMBLTZXZQWLOBB?/29.1?)5"/"YWLOHB?/29.1")6"LZ_OYB?/29.1")5"/""5"5^""?9/29.1?)5"/"B59&??/29.1?)5)6"WBTOGB?/29.1?)5"/"TGLOQB?/2991")5"/"LGLOPB?/29.1?)5"/"WGLOGB?/29.1?)5"/"BLTOZBBOXWOMQBLTZXZHGLOXB?/29.1?)5"/"TLTTHB?/29.1?)5"/"ZLTTOB?/;59.?)
</code>```

But since I know nothing about the signal it may not be ASCII, it could be anything. It may not be 5 bit, it could be 8 bit for all I know. Can anyone shed any light on where to go next in investigating this?

Title: Recovering data from mystery signal


问:
How can you use modprobe nandsim for two chips?
I have a board that uses two nand chips with data that appears to be interleaved byte-by-byte. I have manually desoldered the chips and dumped them with their respective spare areas to two files. I am trying to pull off data without having to worry about bad blocks or the order they occur on the chips. I am thinking I can do that using modprobe nandsim passing in the chip IDs and writing the images to them, but I can't figure out how (or if it is possible) to use nandsim with two chips that appear as one device.


问:
Legal Reverse Engineering for Security Review in US for Korean Provided Module
My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on the latest release of FreeBSD.

They will not give us the algorithm for encrypting or decrypting the data sent to/received from their service. They probably have a secret key embedded in the compiled file.

The example website code they provide indicates that this stand-alone executable only does encryption and decryption of the data sent over the wire.

As part of our security review, we would like to find out does the compiled file only do the encryption/decryption or does it send information to another site/service.

Are there any US precedents or laws governing reverse engineering of foreign company obtained code for security reviews?


问:
C# Hidden Method through transparent proxy object?
I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined.

For example, all functions in this Central API class go something like this:

```<code>    public string SomeFunction(string name)
    {
        IServiceInterface interface = base.\u0001();
        try
        {
            if (interface != null)
            {
                return interface.SomeFunction(name);
            }
        }
        catch (Exception ex)
        {
            ...
        }
        finally
        {
            ServiceInterface.Close(interface);
        }
        return string.Empty;
    }
</code>```

base.\u0001 does this:

```<code>    internal IServiceInterface \u0001()
    {
        IServiceInterface result = null;
        try
        {
            result = this.ChannelFactoryClient.CreateChannel();
        }
        catch (Exception ex)
        {
            ...
        }
        return result;
    }
</code>```

base.\u0001() returns an object with the type "System.Runtime.Remoting.Proxies.__TransparentProxy" (found while debugging), but  when I viewed the value while debugging, there was no member function "SomeFunction" or any other functions. The object includes various information, but nothing that seems to hint to the true location of "SomeFunction".

Does anyone know the next steps I should take to find "SomeFunction"'s true location (maybe what to look for in the object)? For reference, some modules of this project were obfuscated with SmartAssembly, and even after de4dot "successfully" cleaned them, nothing changed.


问:
Unable to install ltrace on Kali
I am kind of stuck with the installation of ltrace on my Kali VM.

My /etc/apt/sources.list file is updated with following entry:

deb http://http.kali.org/kali kali-rolling main non-free contrib

I am trying to install ltrace via apt-get install ltrace.
However, getting an error stating
unable to locate package ltrace.

Could anyone help me out here?

Edit: It got resolved. Thank you all.

Title: Unable to install ltrace on Kali


问:
getting %localappdata% in asm
I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer allows this and I am forced to execute my app with admin permission so it can create those files within its folder in Program Files (x86).

Now I was wondering if I can patch it by changing the directory of instead creating the files in the current directory it will instead create it at %localappdata%\MyApp\.

I know the address of the code that creates the files and I know it uses the freopen function with r+ or wb modes.

I have tried editing the path directly with a hex editor from Data\Display\OptionData.opf to %localappdata%\MyApp\od.opf but that didn't work.

What are my options? I am new to assembly and reverse engineering but I really want to fix this without injecting a DLL and detouring the function. (my issue with detours is it sometimes gets false positive as virus by some AV)

I'm now thinking of doing a codecave. But like I said I need to change the directory to the localappdata directory. How do I do this? (and supporting as far back as winxp upto latest win10)

I understand in code (c++) this will work:

```<code>char* appdata = getenv("APPDATA"); // wont work with winxp
</code>```

or even:

```<code>LPTSTR GetSpecialFolder(int CSIDL) {
    TCHAR szPath[MAX_PATH];

    if (SUCCEEDED(SHGetFolderPath(NULL, CSIDL | CSIDL_FLAG_CREATE, NULL, 0, szPath)))
    {
        PathAppend(szPath, TEXT("\\MyApp\\"));
        CreateDirectory(szPath, NULL);

        return szPath;
    }
    else {
        return TEXT("");
    }
}
</code>```

Title: getting %localappdata% in asm


问:
What is this RS-485 communication protocol/
I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a samsung heat pump.

Here are some hex commands I was able to sniff. Every message starts with 0x32 and ends with 0x34. Does someone recognise this protocol?

```<code>32 00 1A 80 FF 00 10 00 00 C0 11 ED 01 06 0C 00 00 00 00 00 00 00 00 00 00 B7 C8 34
32 00 17 10 00 00 80 FF 00 C0 15 ED 01 06 0C 82 02 48 5A 16 04 23 13 8C 34
32 00 11 80 FF 00 10 00 00 C0 11 EE 01 86 01 00 0D 2E 34
32 00 11 80 FF 00 10 00 00 C0 11 EF 01 86 0A 00 7B 85 34
</code>```


问:
What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?
OllyDbg has this nice feature to find the OEP called SFX:

IDA has the universal PE Unpacker plugin but it works a little bit different.

What is the OllyDbg SFX Feature equivalent in IDA Pro to find the OEP?


问:
Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)
In the core my question is about how to reverse engineer undocumented functions.
I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some information for this, but now I am a bit stuck.

The call hierarchy is as follows:
NtUserSendInput -> xxxSendInput -> xxxMouseEventDirect.

The function looks like this:

```<code>NTSTATUS __fastcall* xxxMouseEventDirect (ULONG dx, ULONG dy, ULONG mouseData, ULONG dwFlags, ULONGLONG time, ULONGLONG extraInfo, ULONGLONG, ULONG);
</code>```

I am relatively sure that I call the function parameters correctly, but there is still a blue screen when I call the function.

The bluescreen occurs like this:

```<code>mov rax, qword ptr [win32kfull!_imp_gptiCurrent (fffffbe9`4c720ec0)]
mov r14, qword ptr [rax]
cmp qword ptr [r14+1B0h], rcx ; <--- Bluescreen because r14 == 0
</code>```

When I call NtUserSendInput, rax points to a pointer which is then used via [r14+1B0h].
When I call xxxMouseEventDirect directly, rax points to 0, causing [r14+1B0h] to cause a blue screen.
I now wonder what is stored in win32kfull!_imp_gptiCurrent and why it is not there when I call xxxMouseEventDirect directly.

I am relatively new in the field of reverse engineering and would like to know how to deal with such a problem in general. Concrete tips are of course also very welcome.

Thank you


问:
Has anyone reversed Wyze cameras?
Has anyone looked at the hardware to see what processor they're using or disassembled the firmware?

Wyze claims to have opensourced their firmware but their github repository seems to be mostly binary files with a few scripts tossed in. Further, they admit to not being fully open in the readme file.

At $20 for a 1080p IP camera, the offer seems to be too good not to have some string attached. HIK Vision cameras were all the rage a few years back until they were caught phoning home.

Title: Has anyone reversed Wyze cameras?


问:
Passing input to program in Remote Debugging with IDA Pro
I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it uses the read() function to read the input. This buffer is then copied to another memory region using memcpy() which results in a crash.

Now, I want to automatically pass the input to program so that I don't have to pass these values in interactive mode.

Usually, I would do something like:

./linux_server binary < data

where data contains the input to be supplied to program. This takes care of the first getchar() function and it reads the input from data file. However, the next read() function, doesn't read anything from stdin because I think, the input was already processed by getchar() function.

How can I automatically pass multiple inputs to a program without interacting manually?

Thanks.


问:
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;

```<code>v7 = sub_804AD60((std::string *)&v16);
char *v5;
</code>```

So clearly IDA has some handling of string types, and it's able to infer that one of these is a C++ string and the other a pointer to a C string. What I can't figure out is how to get that string? I've been searching for a locals window or something in the debugger with no luck, and hovering over v16 gets an int v16 with a memory address value. Surely there's some way to just get the actual string value of v16 or v5 in plain old ASCII or UTF-8 without having to dig it out of the hex view?


问:
Blackmagic Pocket Firmware Modifikation
I'm trying to modify the FPGA firmware for the Blackmagic Pocket Camera. The camera's 60fps function is disabled. The sensor can handle 100fps. Blackmagic only provides Max. 30fps. So there is more to it than offered by Blackmagic.

The *.bin files can be found in the Blackmagic Camera Setup and only there. In all other versions the *.bin files are not to be found. It concerns the following files:

https://drive.google.com/file/d/1VBD7E-E-8eVjextm0Z2AjaX7u3NKRPEF/view

The FPGA chip is Spartan 6 from Xilinx

Is it possible to extract the firmware, then modify it and pack it back as firmware?

I hope for some tips.

Title: Blackmagic Pocket Firmware Modifikation


问:
Intercept traffic from exe to my Java server
In Windows 10, I can easily intercept traffic of an application using Proxifier and route it to Charles proxy, so that I can inspect and edit the data.

```<code> exe -> Proxifier (Socks proxy to localhost:8889) -> Charles (socks listen localhost:8889)
</code>```

I now would like to replace Charles with my own Java server.

```<code>public void StartListener(int port) throws Exception {
    HttpServer server = HttpServer.create(new InetSocketAddress(8889), 0);
    server.createContext("/MyHandler", new MyHandler());
    server.setExecutor(null);
    server.start();
}
</code>```

While this works fine if I turn off Proxifier (or even if it's on) open Chrome and navigate to localhost:8889/MyHandler it does not when the exe tries to connect to ExeWebsite.com:80/MyHandler.

I tried settings up Proxifier either as Socks or Http proxy but nothing.

I also tried to edit the Java server like this, as per specs:

```<code>HttpServer.create(new InetSocketAddress("ExeWebsite.com", 80), 0);
</code>```

The result I see in Proxifier log is:

exe.exe *64 - ExeWebsite.com:80 error :
  Could not connect through proxy 127.0.0.1:8882 - Proxy server cannot
  establish a connection with the target, status code 400

Which tool should I use to quickly and painlessly redirect all the traffic to my local server?


问:
Understanding ESIL
I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of the instruction is:
movk x4, 0x40, lsl 16

The ESIL-string is: -4294901761,x4,&,4194304,|,x4,=

Has anybody an idea, why it looks like that? Shouldn't it be a << to "shift left"?

The R2 commands I run are:

```<code>aa
e asm.syntax = att
e asm.emu = true
pdfj
</code>```

(But i did this in R2pipe)

I am curious about the solution and thank you in advance! :)

Title: Understanding ESIL


问:
Reverse engineering key fob checksum
I am trying to reverse engineer the key fob of my Ford Fiesta 2014 but I am stuck at finding the used checksum algorithm. I've successfully demodulates the key fob signal (using on-off keying + manchester encoding) and identified different type of bytes (see below).

```<code>|---b1---|---b2---|---b3---|---b4---|---b5---|---b6---|---b7---|---b8---|---b9---|---b10--|
|preamble|-------------------------rolling code-------------------------|counter*|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|

*counter: this byte is also used for the commando, the last 4 bits are different for OPEN,
CLOSE, TRUNK while the first 4 bits is a counter.
</code>```

As the preamble is the same for all packets I assume it is not used in calculating the checksum. I am pretty sure it is not a CRC as I tried finding the CRC polynomial by bruteforcing (+bruteforcing the final XOR) but found no matching model (using https://github.com/nitram2342/bruteforce-crc).

I have tried some other standard checksum methods (XOR, 2s complement, modulo 256, ...) but without success. I have read other stackexchange posts about finding the checksum algorithm but couldn't apply them to my packets. I am stuck with this problem for a few days now and it seems that I am not making any progress.

These 3 packets might be helpful as they only differ in the first 3 bits of the 7th byte (b7) and the first 4 bits of the counter (b9).

```<code>|---b1---|---b2---|---b3---|---b4---|---b5---|---b6---|---b7---|---b8---|---b9---|---b10--|
|preamble|-------------------------rolling code-------------------------|counter-|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|
|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|
|01010101|10110100|01010110|11101111|00011011|11011001|10100111|11111001|01101011|01001101|
</code>```

Here are some more packets:

```<code>|preamble|-------------------------rolling code-------------------------|counter-|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|
|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|
|01010101|00010111|11110101|01001100|10111000|01111010|01011010|10100001|01101001|10100000|
|01010101|00010110|11110100|01001101|10111001|01111011|01011011|10100000|01101010|10100101|
|01010101|10110100|01010110|11101111|00011011|11011001|10100111|11111001|01101011|01001101|
|01010101|00010001|11110011|01001010|10111110|01001100|01011100|00001000|10110100|01010011|
|01010101|00011001|11111011|01000010|10110110|01000100|00001001|01010100|10110101|00011000|
|01010101|10011001|01111011|11000010|00110110|11000100|11011100|11010100|11100000|00100001|
|01010101|01000100|10100110|00011111|11101011|00011001|00001001|11010101|11100001|01001110|
|01010101|01000101|10100111|00011110|11101010|00011000|00001000|11011110|11100010|11110110|
|01010101|01010100|10110110|00001111|11111011|01011001|00011001|11001101|00100001|10111101|
|01010101|01010101|10110111|00001110|11111010|01011000|00011000|11001110|00100010|00000101|
|01010101|10011011|01111001|11000000|00110100|10010110|11001111|11010110|00100011|11011011|
|01010101|01010001|10110011|00001010|11111110|01011100|00011100|11001000|00100100|00111001|
|01010101|10011001|01111011|11000010|00110110|10010100|11001001|11010100|00100101|01101111|
*these packets were not all recorded sequentially as you may notice some gaps in the counter.
</code>```

I am new to the reverse engineering and signal processing scene so excuse me if I am not using the right terminology or if I am overlooking some simple things.
p.s. please don't steal my car :)

EDIT 1

I found these packets where the checksum is the same that might help:

```<code>|preamble|-------------------------rolling code-------------------------|counter-|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|
|01010101|01000100|10100110|00011111|11101011|00011001|00001001|11010101|11100001|01001110|

|01010101|01010001|10110011|00001010|11111110|01011100|00011100|11000010|00101110|10111101|
|01010101|01010000|10110010|00001011|11111111|00111101|00011101|11000011|00001111|10111101|
</code>```

Title: Reverse engineering key fob checksum


问:
Radare2: pd command ignores cfg.bigendian setting
I am currently using radare2 to disassemble a raw ARM binary (bootloader) in little endian format. I used the command e cfg.bigendian = false to set the endianness, but the pd command seems to ignore my settings. In particular, I used the following chain of commands:

```<code>$ r2 -a arm  bootloader.img
[0x00000000]> s 0xa48
[0x00000a48]> e cfg.bigendian = false
[0x00000a48]> pxw 4
0x00000a48  0xe92d41c0  // This is correct
[0x00000a48]> pd 1
0x00000a48      c0412de9  invalid // This is the wrong ordering
</code>```

When I use the following command:

```<code>[0x00000a48]> e cfg.bigendian = true
[0x00000a48]> pxw 4
0x00000a48  0xc0412de9
[0x00000a48]> pd 1
0x00000a48      c0412de9       invalid
</code>```

The byte ordering of pxw changes, but the byte ordering of pd does not.

How do I tell pd (or any other disassembler command) to assume a certain endianness? I am new to using radare2, so it might be that I am missing something here - feel free to point out any mistakes.


问:
radare2 difference between function offset and minbound
I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj):

```
    {
        "offset": 4549740,
        "name": "sym.tightdb::TableViewBase::sync_distinct_view_unsignedlong",
        "size": 2394,
        "realsz": 4598,
        "stackframe": 1200,
        "calltype": "(null)",
        "cost": 4425,
        "cc": 103,
        "bits": 16,
        "type": "fcn",
        "nbbs": 213,
        "edges": 298,
        "ebbs": 9,
        "minbound": "4267940",
        "maxbound": "4552134",
        ...
    }
```

There are a few things which are not clear:

When I do pdf @4549740 (print function at offset), radare2 starts to print at 0x456644 (=4548164), which is none of the values above.

I would expect that offset always points to the begin of the function's first basic block. Indeed, this seems to be the case here, as offset + realsize = maxbound. But maxbound - minbound = 284194 and this is clearly much longer than the function should be.

So, what does minbound indicate and how does it differ from offset?

Example binary


问:
Find vtable without complete object locator
I am learning to reverse Visual C++ objects.

I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the disassembled binary before (using a cross reference to the object's TypeDescriptor or ClassHierarchyDescriptor). The pointer to CompleteObjectLocator is the -1st field of the vtable.

However, as some classes are probably abstract in my program, they do not have CompleteObjectLocators. How do I find their vtables?

I know that the program writes the pointer to the vtable down to this in the object's constructor, however in my program the constructors are inlined in the child class constructors and there I do not see work with memory that could be the vtable of the parent.

For example:

ClassA inherits from ClassB (probably abstract) that inherits from ClassC that inherits from ClassD (probably abstract). I found this information in the BaseClassArray of each of the classes.

I am able to find vtable of ClassA and using a cross reference on it, I find its constructor

In the constructor of ClassA I see the program work with vtable of ClassC and vtable of ClassA (constructors are inlined, pointer to vtable of ClassC is written to a location and three instructions later it is rewritten by the pointer to vtable of ClassA)

I would expect to see some work with vtables of ClassB and ClassD in the constructor of ClassA as well. I would expect the pointer to vtable of ClassB to be written do the memory somewhere between the work with vtables of ClassA and ClassC, but there are only instructions that basically do nothing, only move some content from register to register.

Or, if the constructor of ClassA wouldn't work with vtables of ClassB and ClassD, I would expect at least calling their constructors from there, which does not happen as well.

I know I could find a vtable dynamically, because it would be the first element of this, but I do not know where (if anywhere) this of ClassB and ClassD is used. Can I find their vtables and constructors statically?


问:
GCC adds code involving `ecx` in main?
I have two pieces of code, one of which is compiled by me the other of which is supplied in binary-only. The code I am compiling has added instructions pertaining to ecx. What does this code do? The below is an excerpt from the main compiled by me,

```<code>[0x08049060]> pdf @ sym.main~ecx
│           0x08049172      8d4c2404       lea ecx, [arg_4h]           ; 4
│           0x08049179      ff71fc         push dword [ecx - 4]
│           0x0804917f      51             push ecx
│           0x080491c3      8b4dfc         mov ecx, dword [local_4h]
│           0x080491c7      8d61fc         lea esp, [ecx - 4]
</code>```

What's the point of this code? What are we doing with ecx?

Code is compiled with -m32 -fno-stack-protector -std=c89 -fno-PIE -no-pie -O0

Complete code here,

```<code>;-- eip:
(fcn) main 89
  main (int argc, char **argv, char **envp);
; var int local_4ch @ ebp-0x4c
; var int local_ch @ ebp-0xc
; var int local_4h @ ebp-0x4
; arg int arg_4h @ esp+0x4
; DATA XREF from entry0 (0x8049086)
0x08049172      8d4c2404       lea ecx, [arg_4h]                       ; 4
0x08049176      83e4f0         and esp, 0xfffffff0
0x08049179      ff71fc         push dword [ecx - 4]
0x0804917c      55             push ebp
0x0804917d      89e5           mov ebp, esp
0x0804917f      51             push ecx
0x08049180      83ec54         sub esp, 0x54                           ; 'T'
0x08049183      c745f4000000.  mov dword [local_ch], 0
0x0804918a      83ec0c         sub esp, 0xc
0x0804918d      8d45b4         lea eax, [local_4ch]
0x08049190      50             push eax
0x08049191      e89afeffff     call sym.imp.gets                       ; char *gets(char *s)
0x08049196      83c410         add esp, 0x10
0x08049199      8b45f4         mov eax, dword [local_ch]
0x0804919c      85c0           test eax, eax
0x0804919e      7412           je 0x80491b2
0x080491a0      83ec0c         sub esp, 0xc
0x080491a3      6808a00408     push str.you_have_changed_the__modified__variable ; 0x804a008 ; "you have changed the 'modified' variable"
0x080491a8      e893feffff     call sym.imp.puts                       ; int puts(const char *s)
0x080491ad      83c410         add esp, 0x10
0x080491b0      eb10           jmp 0x80491c2
0x080491b2      83ec0c         sub esp, 0xc
0x080491b5      6831a00408     push str.Try_again                      ; 0x804a031 ; "Try again?"
0x080491ba      e881feffff     call sym.imp.puts                       ; int puts(const char *s)
0x080491bf      83c410         add esp, 0x10
; CODE XREF from main (0x80491b0)
0x080491c2      90             nop
0x080491c3      8b4dfc         mov ecx, dword [local_4h]
0x080491c6      c9             leave
0x080491c7      8d61fc         lea esp, [ecx - 4]
0x080491ca      c3             ret
</code>```

Title: GCC adds code involving `ecx` in main?


问:
int 2eh instead of syscall/sysenter
I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this:

So after testing some bit, it tries to execute the system call via int 2eh. I have tried to manually create app and execute int 2Eh most naive way like this (visual studio + masm .asm file x64 bit project):

int2e.asm:

```<code>.code
_myNtWriteFile PROC
    mov r10,rcx
    mov eax,9
    int 2Eh
    ret
_myNtWriteFile ENDP
END
</code>```

Source.cpp:

```<code>#include <Windos.h>
#include <winternl.h>
extern "C" NTSTATUS myNtWriteFile (HANDLE           FileHandle,
  HANDLE           Event,
  PIO_APC_ROUTINE  ApcRoutine,
  PVOID            ApcContext,
  PIO_STATUS_BLOCK IoStatusBlock,
  PVOID            Buffer,
  ULONG            Length,
  PLARGE_INTEGER   ByteOffset,
  PULONG           Key);
int main()
{
     HANDLE hFile = CreateFileA("1.txt",GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);

      if(hFile!=INVALID_HANDLE_VALUE)
      {
         CHAR lpszStr[] = "Hello, World!";
         IO_STATUS_BLOCK pBlock = { 0 };
           NTSTATUS nStatus = myNtWriteFile(hFile,NULL,NULL,NULL,&pBlock,lpszStr,lstrlenA(lpszStr),0,0);
          CloseHandle(hFile);
      }
}
</code>```

I always get access violation on int 2eh, so my questions:

Is int 2eh is still supported even on latest x64 bit win 10?
Is the calling convention for this interrupt the same as for the syscall in x64 bit mode?

Title: int 2eh instead of syscall/sysenter


问:
Techniques for reversing (basic) hash function
Hi I'm relatively new to RE, and I'm using GDB and Radare2. As part of a crackme I'm trying to reverse a weak hash function that's a little too complicated for me to undo by hand. I've been trying to execute backwards with GDB but no luck. What are the common techniques for accomplishing this task?</p>


问:
How to tell when Cor20 starts for DLL's that are supposed to meet ECMA-335?
When I look at a .Net compiled DLL that is supposed to conform to ECMA-335, I see the PE Header well defined up to 0x1EF, but there seems to be block between 0x1F0 and 0x208 which is mainly 00's that is not referenced in the spec, the closest I get to is thinking it's the IT or IAT, but the document says it should be 40bytes long not the 28 I see.

The specific version of the DLL's CB is Major 2, Minor 5 - which is also missing from the spec.

Any thoughts? Or pointers to research content, please?


问:
How to save Radare2 Analysis?
How do I save a radare2 session after I did "aa"?

I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my analysis progress and if possible retain renamed variables.

It currently doesn't work because if I open it again another time it won't load the renamed variables and I can't do stuff like "ood" which is the way to reopen the binary as far as I'm concerned. But there are no errors.

After invoking radare2 with r2 -d calc I run aa and then Ps calc_project. After that I close the terminal and open up a new one. Then I start with r2 -d calc again and follow it with Po calc_project. Now, there are many errors which appear to be the same over and over again:

```<code>fcn_recurse failed
Cannot add basic block", that message 50 times or more.
</code>```

Version information:

```<code>radare2 version:
radare2 3.1.0-git 20049 @ linux-x86-64 git.3.0.1-214-g5759f21
commit: 5759f217c941478ef265bf9a6ba5e23cd646661a
</code>```

Title: How to save Radare2 Analysis?


问:
How to find which event is bound to which GUI part
let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):

that program has a button xyz:

1) how to find out which line/command is executed by clicking on that button?
 2) if that's possible to know that line before I click that button, it would be excellent.

I'd like a small "how-to" or steps what to do to get that.


问:
Reverse Engineering Linux Core Dump
I have a Linux Core Dump file for a binary (which apparently crashed during execution)

file command on the core dump:

```<code>core.123: ELF 64-bit LSB  core file x86-64, version 1 (SYSV), SVR4-style, from '/home/user/a.out'
</code>```

I have the binary, a.out, as well.

How can I analyse the crash in more details with this information?

I loaded the core using GDB using the command:

```<code>gdb -c core
</code>```

I can look at the backtrace of the stack using the bt command. And I can see that the program crashed due to: SIGTRAP

```<code>Core was generated by `/home/user/a.out'.
Program terminated with signal SIGTRAP, Trace/breakpoint trap.
#0  0x0000000000400566 in ?? ()
(gdb) bt
#0  0x0000000000400566 in ?? ()
#1  0x00007ffff7a3b1bb in ?? ()
#2  0x0000000000000000 in ?? ()
(gdb) x/i 0x0000000000400566
=> 0x400566:    retq
</code>```

However, I'd like to get more detailed information about the root cause of the crash.

Does IDA Pro support analysis of core dump files? If I have the original binary, can I do something to debug it in details?

I would prefer IDA Pro with remote debugging support in this case. However, if there's a way to do using GDB efficiently here, that's okay as well.

Title: Reverse Engineering Linux Core Dump


问:
Reverse crypto algorythm, based on AES
Hello!

I'm working on reversing one library (shared object) written for ARM architecture. It's obfuscated or packed with something pretty strong what makes debugging much harder and almost impossible on "long distance".

There is function which provides encryption with some strange algorithm (at least for me).

What I've researched for now:

Size of input and output is same;

Algorithm works with 4 memory regions, which affects on result (tested):

Size - 256 bytes. This is SBOX, but with custom values (values are different from AES SBox);

Size - 256 bytes. This is inverted SBOX;

Size - 16 bytes. Probably, initialization vector, but I'm not sure;

Size - 128 bytes. Unknown region.

Decryption function also works with same memory regions.

For now I know only first operations in data in algorithm:

Reverse bits in each byte (0x30 (00110000b) => 0xC (00001100b));

Reverse bytes (01 02 03 04 05 06 07 08 => 08 07 06 05 04 03 02 01)

Some additional information:

If input length < 15 it's just reverse bits and bytes.

Example (bytes in hex):

01 01 01 01 01 01 01 01 => 80 80 80 80 80 80 80 80 80

If input length is 15 it reverse bits in all bytes except 4th. Then reverse bytes.

Example (bytes in hex):

01 01 01 02 01 01 01 01 01 01 01 01 01 01 01 =>

80 80 80 80 80 80 80 80 80 80 80 80 02 80 80 80

If input length is 16 it reverse bits and bytes, encrypts data with this "unknown" algorithm;

If input length is 17-32 it'll reverse bits and bytes in first 16 bytes, encrypts first 16 bytes with this algorithm and just reverse bits and bytes in rest data.

Example: (bytes in hex, bold bytes contains result of encryption):

01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 03 04 05 =>

50 D4 51 BD 59 42 30 A1 B3 5F 77 BD B3 BF A1 9A A0 20 C0 40

I have opportunity to launch encryption on any data and change all variables. Also I have opportunity to launch built-in decrypt function.

Maybe someone know what it can be or can recommend me some additional steps to clarify name of this algorithm.

P.S. Sorry for my bad English, hope I've described everything clear.

Title: Reverse crypto algorythm, based on AES


问:
Re-engineering to create UML Diagrams from .NET binary assembly
What is the base way to generate UML diagrams (both class and sequence) from .NET assembly using OpenSource tools?

The 200% Reflective Class Diagram Creation Tool cannot be used due on problems starting custom build on machine.

Ready-to use builds needed.


问:
Is there a way to modify number of reads/writes to/from a memory address?
I haven't had any luck researching this, so I thought I would inquire here!

Let's assume I have found a memory address housing a value of interest. Using a program like Cheat Engine, I look for instructions that access the address.

Let's assume there are five total instructions that access the address: four of them read from the address, and one of them writes to the address.

Of the instructions that read, I see differing counts: one instruction reads a total of 4 times per second, another reads 60 per second, another reads 180 per second, and the last reads 300 per second. Naturally, these are arbitrary numbers simply meant to represent the difference in number of counts per instruction, per second.

Based on that information, is there a way I could manually increase/decrease the number of times any of those instructions access the address?

I've absolutely no idea where such timing exists. I'm assuming it doesn't happen at an instruction level, but rather elsewhere from some ultimate caller or something. Is there something like a table of timings for how often specific functions run?

Thanks for any advice on this topic!


问:
Common practices for 'hiding' a class within an Android application?
I've recently gotten into Android reverse engineering, and I've been messing around with some apps lately for education/research purposes to see how some things are done with private (mobile) APIs.

One of the apps I have been testing is giving me some weird behavior. After decompiling the APK, I've noticed there is a class which is completely missing, although I am able to see the class when tracing with Frida.

The developer must have 'hidden' this class somehow, right? Is this something to do with ProGuard/DexGuard? Or is it possible the developer has simply included an entire Java class in an encrypted string hidden in another Java class? I'm stumped trying to figure out how this kind of thing would be possible, but I am looking to learn.


问:
How to detect obfuscator (de4dot shows: Detected unknown obfuscator)
Generally, I use de4dot to detect obfuscator or deobfuscate. But some files are protected as they show:

```<code>Detected unknown obfuscator
</code>```

What are ways to detect the obfuscator of .exe?


问:
Executing MIPS binaries on Ubuntu Linux
I have a 32-bit MIPS binary and I'm trying to execute it on Ubuntu 64-bit.

file command for the binary shows:

```<code>bin: ELF 32-bit MSB  executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked (uses shared libs), stripped
</code>```

If I use qemu-mips to execute it, I get the following error:

```<code>/lib/ld-musl-mips-sf.so.1: No such file or directory
</code>```

How can I execute it? I'd like to remote debug it using IDA Pro.

Title: Executing MIPS binaries on Ubuntu Linux


问:
Assemble function of IDA Pro not working properly
I am using the Patch Program option of IDA Pro to edit the assembly of a binary at runtime.

When I enter the following instruction:

```<code>mov rax, [rsp + 0x48]
</code>```

I get an "Invalid operand" error from IDA Pro. I tried changing the above instruction to different variants as shown below:

```<code>mov rax, [rsp + 48h]
mov rax, [rsp + 48]
</code>```

However, it still gives me an error.

This is a valid assembly instruction. I can edit the assembly in other softwares like x64_dbg and it works with the above disassembly.


问:
Patching an app that updates frequently
Hello i am working with an app coded in c# which updates very often usually within 2-3 days or sometimes every 12 hours
The updates are really needed for the app to work
So i was wondering what can i use to patch the functions i want automatically
Been using dnspy for now but it is a big hassle doing the same thing every day
I am looking for suggestions, probabily dll injection or else
Thanks

Also the app uses an encrypted connection to comunicate with server, is it possible to create an app to hook/sniff the data in real time as i have the decryption key?

Title: Patching an app that updates frequently


问:
View XMM registers in IDA Pro while debugging
How can I view the XMM registers in IDA Pro?

While debugging, I can only view the default registers and eflags. Is there a way to view the XMM registers, xmm0 to xmm7?

Thanks.


问:
Reverse engineering a bar code's check digit
I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of them from scratch. The numbers I'm dealing with look like this:

```<code>929441812022112009904
929441812032118300109
929441812032118400109
</code>```

(I will get some more samples)

And the data breakdown (929441812022112009904) is as follows:

92944: vendor machine id

18: year

12: month

02: day

21120: uid, incremental for each operation

0990: price (as in 09.90$, so capped at 99.99$)

4: checksum character

The last two numbers threw me off a bit since they differ by 1 on the uid number and have the same check digit.

So for all of the above numbers we get:

```<code>92944|181202|21120|0990|4
92944|181203|21183|0010|9
92944|181203|21184|0010|9
</code>```


问:
Extracting Firmware file from Wireshark Dump
I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is Zip archived data but it has a CRC error when I try to extract it with binwalk/7zip.

I also tried to export as hex dump and make xxd -r -p dump outfile.

In the pcap file are many TCP DUP ACK and TCP Out-Of-Order packets.
I wonder if the exported binary takes over these dupes or out-of-order stuff.

I also tried chaosreader -r dump.pcap still corrupt.

Extracting the .exe with 7zip failed also with checksum error.

Any of you have any idea what I'm doing wrong?


问:
IDA SDK: How to add a struct (pointer) field to a struct?
I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:

```<code>00000000 SomeClass struc
00000000 __vftable dd ?  ; SomeClass_vtbl*
00000004 __members SomeClass_members ?
00000084 SomeClass ends
00000084
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 SomeClass_vtbl struc
00000000 ; ... several function pointers ....
00000048 SomeClass_vtbl ends
00000048
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 SomeClass_members struc
00000000 ; ... some members ....
00000020 SomeClass_members ends
</code>```

Creating the structs works fine, but I have trouble defining the 2 fields in SomeClass:

the pointer to SomeClass_vtbl for the first field, and

referencing SomeClass_members for the second field.

Not finding a sample in the SDK on how to define structs detailedly programmatically (is there one?), I checked the raw documentation and found add_struct_member to be doing what I want to do, using it as follows:

```<code>#include <bytes.hpp>
// ... other typical IDA SDK includes ...

bool idaapi run(size_t arg)
{
    qstring className = "SomeClass";

    // Create the structs.
    tid_t classType = add_struc(BADADDR, className.c_str());
    tid_t vftableType = add_struc(BADADDR, (className + "_vtbl").c_str());
    tid_t membersType = add_struc(BADADDR, (className + "_members").c_str());
    struc_t* classStruct = get_struc(classType);
    struc_t* vftableStruct = get_struc(vftableType);
    struc_t* membersStruct = get_struc(membersType);

    // Create vftable field.
    opinfo_t vftableField{ vftableStruct->id };
    add_struc_member(classStruct, "__vftable", 0, FF_STRUCT, &vftableField, 4);

    // Create members field.
    opinfo_t membersField{ membersStruct->id };
    add_struc_member(classStruct, "__members", 4, FF_STRUCT, &membersField, 4);

    return true;
}
</code>```

I'm not sure if setting the types of those struct fields like this is the right way to go:

FF_* #defines from bytes.hpp are not found by my compiler, even though I included that header right at the start in the only main.cpp file in my project (and they appear in IntelliSense...).

Even if I could use those #defines now, I did not see how that would allow me to differentiate between a pointer to a struct or simply referencing a struct.

After all, I'm not even sure if using the FF_* #defines for the flag parameter of add_struc_member is correct; the documentation only states "type + representation bits".

So, dumbly asked, ignoring my probably faulty tries above, what are the methods to set known types of struct fields?


问:
moving info from one register to another using dot, powerpc
There are three simple instructions from Power PC assembly:

```<code>mr. r7, r3
li r3, 0
beqlr
</code>```

Well, if i understand here all lines correctly, i move value from register r3 to r9, load r3 with 0 and jump to address from LR (link register); dot near mr instruction means that i load cr0 with information of the result of operation but what will be the value of cr0 after moving r3 to r9? and what is the condition under what i jump to the address in LR?


问:
How to patch JNI library to call functions on Linux
According to this post it is possible to run functions inside a shared library so long as they do not have a dependency on the JVM

It works by patching the .dynamic ELF section to remove unnecessary dependencies by replacing DT_NEEDED tags with DT_DEBUG tags. We also needed to remove constructors and deconstructors by changing the DT_FINI_ARRAYSZ and DT_INIT_ARRAYSZ to zero.

So how could this be implemented?

Thanks


问:
Finding decompress algorithm for unknown compression
I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression.

You can see the file here.

I think they are using some kind of LZRW 1 with some strange dictionary build routine.

I succeed to de-compress the IHeader of the file correctly (I verified it with CRC).

This the comparing between them:

This is the algorithm it worked with:

There is a 1 byte flag every each 8 bytes.

If the flag is > 0 I am checking its bits.

For example:

08 (0000 1000) 00 00 02 58 (00 83) 5A 08 06

The flag is 08 => 0000 1000

So it need to go 5 step forward after the flag => 00 83 ....

The dictionary looks to be built by 2 bytes, for example: 00 83

In binary:

0000 0000 1000 0011

The first 4 bits from the right are might be the length and the rest (12 bits) are probably the absolute offset.

offset length

(0000 0000 1000) (0011)

I looked to the next flags after the first chunk dictionary (0x0 0x83) and saw a new dictionaries (0x9 0x84) but it doesn't work well:

This is the "best" result I received with my algorithm:

My algorithm pseudo-code:

```<code>data = readFile(filePath)
i = 0
while i < len(data):
    controlbits = data[i] // controlbits is 8 bites
    i += 1
    for bit in controlbits:
        if bit == 0:
            output += data[i]
            i += 1
        else: // bit is 1
            // Example: data[i] = 0x0, data[i+1] = 0x83
            // data[i] = 0000 0000
            // data[i+1] = 1000 0011
            // dict = 0000 0000 1000 0011
            dict = data[i] << 8
            dict |=  data[i+1]

            offset = dict[0:12]
            len = dict[12:16]
            output += output[offset: offset+len]
            i += 2
</code>```

I gave a link in the beginning for the full file content but you also have here 570 bytes from the file:

```<code>0000-0010:  00 89 50 4e-47 0d 0a 1a-0a 00 00 00-00 0d 49 48  ..PNG... ......IH
0000-0020:  44 52 08 00-00 02 58 00-83 5a 08 06-80 00 83 64  DR....X. .Z.....d
0000-0030:  31 28 fe 00-00 21 00 c7-49 44 41 54-78 9c ed 00  1(...!.. IDATx...
0000-0040:  dd 79 54 14-57 fa 37 f0-00 6f 2f ac-22 8d a2 20  .yT.W.7. .o/."...
0000-0050:  41 00 40 82-4b 5c 23 2e-e8 24 00 ae-e8 88 1a b5  A.@.K\#. .$......
0000-0060:  d1 38 81 00-18 46 09 82-26 26 18 67-00 8c fa 33  .8...F.. &&.g...3
0000-0070:  a2 a2 a3 31-06 00 c6 2d-1a 15 63 3c-2a d1 00 18  ...1...- ..c<*...
0000-0080:  25 c6 65 cc-28 51 8f 00-21 6a 30 1a-11 a2 a0 c6  %.e.(Q.. !j0.....
0000-0090:  00 05 d4 38-80 2c 8d 46-a1 00 e9 a6-de 3f 3c f4  ...8.,.F .....?<.
0000-00a0:  4b 2d 00 dd-54 77 57 43-8b cf e7 00-1c ce a1 aa  K-..TwWC ........
0000-00b0:  6e df ba d5-00 b5 3d 5d-f7 d6 bd 32-86 00 61 18  n.....=] ...2..a.
0000-00c0:  10 42 08 21-84 10 02 c9-c8 1b bb 00-84 09 84 4d  .B.!.... .......M
0000-00d0:  08 0d 05 58-84 09 84 12-a3 00 41 8b-09 84 44 62  ...X.... ..A...Db
0000-00e0:  14 60 11 09-94 08 48 8c-02 2c 09 95-89 51 80 42  .`....H. .,...Q.B
0000-00f0:  45 09 a4 22-31 0a b0 09-a4 42 08 24-46 01 16 09  E.."1... .B.$F...
0000-0100:  b3 42 88 c4-09 28 c0 22-84 09 83 91-18 0a 63 ff  .B...(." ......c.
0000-0110:  09 84 0a 94-09 84 0a d5-09 94 0b 24-09 95 0b 64  ........ ...$...d
0000-0120:  fe 09 a4 0b-a4 09 a4 0b-e5 09 b3 0c-37 09 83 91  ........ ....7...
0000-0130:  7f 18 0a 63-09 84 0a 94-09 84 0a d5-09 94 0b 24  ...c.... .......$
0000-0140:  ff 09 95 0b-64 09 a4 0b-a4 09 a4 0b-e5 09 b3 0c  ....d... ........
0000-0150:  37 80 09 83-91 98 52 ea-0c 1f 3f 00-7e 8c 07 0f  7.....R. ..?.~...
0000-0160:  1e a0 b2 b2-00 12 1e 1e-1e 68 d9 b2-25 00 94 4a  ........ .h..%..J
0000-0170:  c9 57 d3 24-65 66 00 66-e2 f4 e9 d3-b8 7b f7 00  .W.$ef.f .....{..
0000-0180:  2e 34 1a 0d-00 60 eb d6-00 ad 8d 5c-2a 22 25 3a  .4...`.. ...\*"%:
0000-0190:  3f 00 08 21-f6 aa b4 b4-14 a9 00 a9-a9 d0 68 34  ?..!.... ......h4
0000-01a0:  18 37 6e 00-1c 5e 7e f9-e5 c6 2e 92-00 64 0a 0a  .7n..^~. .....d..
0000-01b0:  0a b0 68 d1-22 00 38 38-38 40 a5 52-a1 43 00 87  ..h.".88 8@.R.C..
0000-01c0:  0e 18 3c 78-30 5e 7a 00-e9 25 9b ad-53 c6 30 0c  ..<x0^z. .%..S.0.
0000-01d0:  00 63 6d 26-85 85 85 d8-b0 00 61 03-d2 d2 d2 90  .cm&.... ..a.....
0000-01e0:  97 97 00 87-9a 9a 1a c3-32 85 42 00-81 4e 9d 3a  ........ 2.B..N.:
0000-01f0:  61 e9 d2 a5-01 78 fd f5-d7 59 9f 1b-11 33 00 ae  a....x.. .Y...3..
0000-0200:  5d bb 66 32-ef bf fd 00-ed 6f f8 d7-bf fe 65 6d  ].f2.... .o....em
0000-0210:  00 11 ed da-d9 b3 67 31-7d 00 fa 74-e4 e4 e4 b0  ......g1 }..t....
0000-0220:  e6 2b 00 14-0a e8 74 3a-ab f3 1f 00-38 70 20 8a  .+....t: ....8p..
0000-0230:  8b 8b 0d d3-00 cb 96 2d-c3 c4 89 13-ad 00 ce 97  .......- ........
0000-0240:  88 63 e9 f9-41 48 00 53-b1 62 c5 0a-6c df be 00  .c..AH.S .b..l...
0000-0250:  dd 30 fd ca-2b af e0 cb-00 2f bf 6c-c4 12 11 ae  .0..+... ./.l....
0000-0260:  a2 00 a2 22-04 07 07 e3-8f 3f 80 01-a3 28 95 4a  ...".... .?...(.J
0000-0270:  7c f7 dd 77-00 78 ed b5-d7 1a bc 2c-fb 00 f7 ef  |..w.x.. ...,....
0000-0280:  c7 fc f9 f3-0d d3 00 ad-5b b7 46 46-46 86 55 00  ........ [.FFF.U.
0000-0290:  79 66 65 65-21 38 38 98-00 37 ff af-7f fd 2b b6  yfee!88. .7....+.
0000-02a0:  6c 00 d9 82-80 80 00 ab-f2 17 00 62-f5 4f e7 a3  l....... ...b.O..
0000-02b0:  47 8f 62 00-d2 a4 49 28-2d 2d 15 5c-00 ae d7 eb  G.b...I( --.\....
0000-02c0:  71 e5 ca 15-5c 00 bf 7e-9d b7 ec e6-cd 9b 00 b8  q...\..~ ........
0000-02d0:  7a f5 aa c9-fc ef df 20-bf 6f 17 33-5a 46 46 06  z....... .o.3ZFF.
0000-02e0:  86 00 0f 1f-0e ad 56 6b-b3 75 a0 21-23 1d 14 03  ......Vk .u.!#...
0000-02f0:  86 e9 f2 f2-72 00 9b ad-ab a1 dd be-7d 1b 00 27  ....r... ....}..'
0000-0300:  4e 9c 40 68-68 28 da 00-b5 6b d7 d8-c5 e1 b1 e6  N.@hh(.. .k......
0000-0310:  10 fc 78 56-23 c4 f7 ee-dd 43 00 71-71 31 b4 5a  ..xV#... .C.qq1.Z
0000-0320:  2d dc dd 00-dd 11 10 10-80 f6 ed db-00 c3 c1 c1  -....... ........
0000-0330:  a1 d1 cb 66-cf 02 c7 8b-bd 97 cf 52-14 03 ac 00  ...f.... ...R....
0000-0340:  6b 7d db b6-6d 1b b1 34-00 44 c8 fa-f5 eb 0d c1  k}..m..4 .D......
0000-0350:  15 40 00 18-63 24 26 26-36 4a 80 00-a5 d1 68 58  .@..c$&& 6J....hX
0000-0360:  c7 8b 2d ef-00 59 e9 e9-e9 08 09 09-c1 00 85 0b  ..-..Y.. ........
0000-0370:  17 24 3f 2e-ad 6a 00 83-95 9d 9d 8d-f1 e3 c7 00  .$?..j.. ........
0000-0380:  1b bd 79 10-d3 f4 7a 3d-00 a2 a3 a3-79 c1 55 bb  ..y...z= ....y.U.
0000-0390:  76 00 ed 30-62 c4 08 7a-a2 61 00 44-69 69 29 e2  v..0b..z .a.Dii).
0000-03a0:  e2 e2 10 00-14 14 84 c0-c0 40 4c 9d-00 3a 15 77  ........ .@L..:.w
0000-03b0:  ef de 6d ec-62 00 f1 3c-4f e7 c7 ef-bf ff 00 8e  ..m.b..< O.......
0000-03c0:  19 33 66 20-30 30 10 00-81 81 81 18-30 60 00 c6  .3f.00.. ....0`..
0000-03d0:  00 8f 1f 8f-88 88 08 8c-1a 00 35 0a-5d ba 74 81  ........ ..5.].t.
0000-03e0:  4a a5 40 42-24 43 16 2f-5e 8c c7 8f-00 1f 37 58  J.@B$C./ ^.....7X
0000-03f0:  d9 ec fd 78-b1 00 f7 f2-d9 9b e4 e4-64 38 00 3b  ...x.... ....d8.;
0000-0400:  3b 1b fe ba-76 ed 6a 00-32 bd 46 a3-61 a5 77 76  ;...v.j. 2.F.a.wv
0000-0410:  00 76 c6 c9-93 27 1b a8-b4 00 cf 8e-ba 3f c2 6b  .v...'.. .....?.k
0000-0420:  fd ef 04 7f-ff 13 fd f9-29 d3 9a b5-00 5f 1a 9a  ........ )...._..
0000-0430:  87 87 07 5e-7f 00 fd 75-0c 1e 3c 18-5e 5e 00 5e  ...^...u ..<.^^.^
0000-0440:  ac 65 45 45-45 98 39 00-73 a6 e4 eb-b4 ea 09 d6  .eEEE.9. s.......
0000-0450:  00 9c 39 73-f0 e4 c9 13-d6 40 bc 12-b3 22 26 26  ..9s.... .@..."&&
0000-0460:  06 7e 7e 00-7e a8 a8 a8-40 51 51 11-00 ae 5c b9  .~~.~... @QQ...\.
0000-0470:  22 f8 6b 6c-c6 00 8c 19-28 2a 2a 62-cd 4b 00 49  ".kl.... (**b.K.I
0000-0480:  49 69 f2 4f-ad 6a 1d 00-3b 76 0c 37-6f de 34 4c  Ii.O.j.. ;v.7o.4L
0000-0490:  08 3b 3a 3a-62 25 33 98-30 61 00 42-23 96 ca fe  .;::b%3. 0a.B#...
0000-04a0:  15 15 15 00-e1 8b 2f be-68 ec 62 d4-00 cb da f3  ....../. h.b.....
0000-04b0:  e3 59 a0 d5-6a 00 31 7b-f6 6c 6c da-b4 a9 00 de  .Y..j.1{ .ll.....
0000-04c0:  ea ec 27 4f-9e e0 e4 02-c9 93 38 79-f2 24 2c 93  ..'O.... ..8y.$,.
0000-04d0:  e0 00 ea ea-da 20 65 b4-f7 e3 00 c5-de cb 67 6f  ......e. ......go
0000-04e0:  74 3a 1d 00-aa aa aa 0c-d3 75 ff 17-00 c2 30 0c  t:...... .u....0.
0000-04f0:  2f 8d 5e af-b7 00 49 d9-9e 65 61 61-61 48 00 49  /.^...I. .eaaaH.I
0000-0500:  49 61 cd 1b-35 6a 94 02-e8 cf 57 57-57 9b 34 23  Ia..5j.. ..WWW.4#
0000-0510:  5a 80 2b b3-b0 6f df 3e-00 40 4d 10-4d 0d fe 33  Z.+..o.> .@M.M..3
0000-0520:  a3 63 ee dc-b9 00 86 e5-07 0e 1c c0-fd fb 00 f7  .c...... ........
0000-0530:  e1 e3 e3 23-d9 3a 2d 00-0e b0 4a 4a-4a f0 c3 0f  ...#.:-. ..JJJ...
0000-0540:  00 3f b0 e6-4d 9b 36 0d-9b 00 37 6f-16 9d c7 8c  .?..M.6. ..7o....
0000-0550:  19 33 00 78-f3 0e 1f 3e-fc dc 04 00-58 a7 4f 9f  .3.x...> ....X.O.
0000-0560:  66 4d c7 c7-00 c7 53 70-d5 44 48 71-7e 20 d8 bb  fM....Sp .DHq~...
</code>```


问:
Reconstruct InnoSetup file with existing CompiledCode.bin
Is it possible to somehow re-compile/reconstruct Inno Setup file and use existing CompiledCode.bin ? I dont have the source of CompiledCode.bin and writing from scratch is not an option.

Basically what I am trying to do is open up a setup.exe that was made via InnoSetup and edit a few text files inside, then recompile/reconstruct. I dont need to touch the Pascal script at all just change a few lines in a .txt file.


问:
Instrumentation fail when app use far jump 0x33 crash
Do you known any dbi tool that support instrumentation of application that use far jump 0x33?

P.S. pin, dymanoRIO don't support far jump 0x33.


问:
Android APK is somehow verifying package signatures without calling PackageManager.signatures
I'm reverse engineering a very popular Android app.

They perform some type of signature verification on the APK, however they do it without:

Calling PackageManager.signatures

Calling PackageInfo.signingInfo

Instantiating a JarFile or JarEntry

Calling native functions(there is a native library with signature verification code, however it has no JNI_onLoad and the function is not called)

Directly accessing the META-INF directory

Utilizing SafetyNet

I have verified that the APK is performing signature verification and not any other type of tamper-detection by resigning the APK and not modifying any files.

The only thing I can think of is that the APK is using reflection to call a method whose signature is encrypted or encoded.


问:
IDA rename argument in all xrefs to function
I have a function of the format:

```<code>sub_ABCDEF(&global, "stringName", unimportantValue)

push    offset string
mov     ecx, offset global
call    sub_410010
</code>```

That is called in several places, each varying the &global and string location.

I am wondering if it's possible in IDAPython to bulk rename all the &global's to the string value.

I used XrefsTo(410010, 0) to obtain a list of places the function is called from, but I am unsure how to get the parameters it was called with.


问:
Detect compression algorithm in .NPK archive
I'am trying to unpack Android game archive file (.NPK).

The game is "Nvidia Glowball demo" (it has been pre-installed on my android tablet)

Archive structure seems to be simple, but I can't decompress the data.

Archive structure:

```<code>4 bytes - "BE EF CA FE" signature
4 bytes - File headers count (little-endian)
[File headers]
4 bytes - "BE EF CA FE" signature
[Files data]
</code>```

File header structure:

```<code>4 bytes - File name length (little-endian)
[File name]
8 bytes - Unknown (not a checksum, signature?)
8 bytes - File offset (little-endian)
8 bytes - Compressed size (little-endian)
8 bytes - Uncompressed size? (little-endian)
</code>```

File examples:

initprescenecommon.txt

Header (10 bytes compressed, 2 bytes uncompressed, unknown field= 1033E64E):

```<code>A373h: 16 00 00 00 69 6E 69 74 70 72 65 73 63 65 6E 65  ....initprescene
A383h: 63 6F 6D 6D 6F 6E 2E 74 78 74 10 33 E6 4E 00 00  common.txt.3.N..
A393h: 00 00 F3 45 41 01 00 00 00 00 0A 00 00 00 00 00  ...EA...........
A3A3h: 00 00 02 00 00 00 00 00 00 00                    ..........
</code>```

Data:

```<code>141:45F3h: 1A F3 84 8A 6F 6F 6A 49 62 77                    ....oojIbw
</code>```

teleporter1_enter.txt

Header (10 bytes compressed, 2 bytes uncompressed, unknown field= 1933E64E):

```<code>A490h: 15 00 00 00 74 65 6C 65 70 6F 72 74 65 72 31 5F  ....teleporter1_
A4A0h: 65 6E 74 65 72 2E 74 78 74 19 33 E6 4E 00 00 00  enter.txt.3.N...
A4B0h: 00 58 52 41 01 00 00 00 00 0A 00 00 00 00 00 00  .XRA............
A4C0h: 00 02 00 00 00 00 00 00 00                       .........
</code>```

Data:

```<code>141:5258h: 1A F3 84 8A 6F 6F 6A 49 62 77                    ....oojIbw
</code>```

grate_enter.txt

Header (19 bytes compressed, 11 bytes uncompressed, unknown field= 1033E64E):

```<code>A1A8h: 0F 00 00 00 67 72 61 74 65 5F 65 6E 74 65 72 2E  ....grate_enter.
A1B8h: 74 78 74 10 33 E6 4E 00 00 00 00 8E 33 41 01 00  txt.3.N.....3A..
A1C8h: 00 00 00 13 00 00 00 00 00 00 00 0B 00 00 00 00  ................
A1D8h: 00 00 00                                         ...
</code>```

Data:

```<code>141:338Eh: 1A F3 94 40 25 A2 19 40 28 43 2E 8A 88 6D 6A 77  ...@%..@(C...mjw
141:339Eh: 10 6C FA                                         .l.
</code>```

Theese three files have compressed size bigger than uncompressed. I think this happens because theese are text files.
For example balltextures_entrance.nma file has 338 bytes compressed and 3263 bytes uncompressed.

Note that initprescenecommon.txt and teleporter1_enter.txt have same data, but differ "unknown field".

Does anyone have some ideas?


问:
Motorola Freescale mpc564 microcontroller
Im hoping somebody here can give me some advice.  Im trying to read the flash contents of a Mpc564 Motorola MCU.  The flash size is 512KB   The processor was removed from a bad circuit board. Is there a way to read the flash after the MCU has been removed from the board.  Any help would be appreciated.


问:
MITRE MAEC (Malware Attribute Enumeration and Characterization) opinions and usage
I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: https://maec.mitre.org/.  Do you see the potential for widespread adoption?

To me, it looks interesting from the description:

International in scope and free for public use, MAEC is a standardized
  language for encoding and communicating high-fidelity information
  about malware based upon attributes such as behaviors, artifacts, and
  attack patterns.

By eliminating the ambiguity and inaccuracy that currently exists in
  malware descriptions and by reducing reliance on signatures, MAEC aims
  to improve human-to-human, human-to-tool, tool-to-tool, and
  tool-to-human communication about malware; reduce potential
  duplication of malware analysis efforts by researchers; and allow for
  the faster development of countermeasures by enabling the ability to
  leverage responses to previously observed malware instances.

But it also looks fairly complicated, which might limit widespread adoption.

ContentLicense: CC BY-SA 3.0


问:
USB 3G Stick changing frequency bands
I have 4 different types of USB 3G modems from Europe. They're not operator locked. I'm trying to use them on an American network for 3G connectivity.

Even though they state "850, 900, 1800, 1900 MHz" bands in their specs, and my network supposedly has UMTS on 850 MHz, I can only get a 2G (EDGE) connection and furthermore, they all detect my SIM card as out of network and put me in "roaming" mode.

I've found out that the radios in these things are usually universal but the band limits are only in software. Therefore I was wondering if there would be any way (through undocumented AT commands or firmware flashing) I could get either one of these modems to switch allowed bands and let me get 3G speeds in North America.

Are there any resources where I can get AT command lists and/or different region firmware for these devices? Or is there anyone that could maybe point me in the right direction?

These are the devices I have:

Huawei E3131

Huawei E353

ZTE MF190

D-Link DWM-156

I tried flashing different versions of firmware and/or googling AT commands to change bands on some of these, but at the end, the moment I switch mode to 3G I get "no service"

Any help would be greatly appreciated...

Title: USB 3G Stick changing frequency bands


问:
Looking for crackme with full solutions
There are lot of crack me site.

I looking for site that have lot of hard crack me/ malware to research anti debug/anti vm... but with full solution

Title: Looking for crackme with full solutions


问:
Help understanding ARM Assembly example code - loops, set flags and code mnemonics
This is the example code:

```<code>_start:
LDR r0, =n
LDR r0, [r0]
LDR r1, =array1
MOV r2, #0
LDR r4, =array2
loop:
LDR r3, [r1], #4
CMP r3, #58
BGT a_point
CMP r3, #47
BLT a_point
SUB r3, r3, #0x30
STR r3, [r4], #4

a_point:
    subs r0, r0, #1
    BGT loop

stop:
    b stop

.Data
n: .word 6
array1: .word 0x30, 0xFFFFFFF5, 0x37, 0x4b, 0x18, 0x40
array2: .word 0x01, 0x0, 0x0, 0x0, 0x0, 0x0
</code>```

I'm having trouble understanding how the loop works, what it does and specifically how the branch instruction work on pair with the -lt and -gt suffixes. What is the purpose of this simple program? Thanks in advance for your help.


问:
Unable to figure out how to map segments in IDA
I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU.

The segments go from 4000 (0x140000) to F000 (0x1F0000).

I'm attempting to map the segments in the Program Segmentation window, but when doing so, addresses for call / jump operations fail to resolve when converting the entrypoint to code.

Taking the final segment as an example, I set the Start Address to 0x1F0000, and the End Address to 0x200000. I set the base to 0xF000, as this is how it's referred to in the machine code.

I do the same with the other segments, including the problem segment (0xD000 -> 0x1D0000).

When converting to code, the resulting line is resolved as follows:

```<code>jmp far ptr 0D000h:1Ah
</code>```

This is as expected, jumping to segment 0xD000, with an offset of 0x1A, however IDA is not happy with this, complaining about it with the NONAME and BOUNDS errors.

I have no idea how to properly map this in IDA. Can someone point me in the right direction?

[edit]

For reference, I already have the full list of segments I want to map along with their binary addresses:

2000:0x1F0000

3000:0x1F0000

4000:0x140000

5000:0x150000

6000:0x160000

7000:0x170000

8000:0x180000

9000:0x190000

A000:0x1A0000

B000:0x1B0000

C000:0x1C0000

D000:0x1D0000

E000:0x1E0000

F000:0x1F0000


问:
How to decompile a obfuscated mach-o dylib?
I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES"

I want to analyze what it really does, so I dragged it in to IDA, and found that it exported "_sub_06adf","_sub_06bdf","InitFunc_0"

In _sub_06adf:

```<code>db 'VfhT2zwxQpLeHRL6j4Oe4mrsmrjEAW',0
align 10h
</code>```

In _sub_06bdf

```<code>db '(c) 2014 - Cryptic Apps SARL - Disassembling not allowed.',0
db    0
db    0
db    0
db    0
</code>```

They aren't correct asm code! And I have no clue what tool obfuscated this file.

And I'm also curious about how can this dylib overwrite exisiting functions?

Note: I've read https://alexomara.com/blog/a-silly-anti-disassembly-trick/, however this dylib isn't that trick, but is really obfuscated XD


问:
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.

While testing, I have noticed that if the program is run and the user selects option 4, then the program crashes with a segfault instead of exiting cleanly. Testing in GDB confirms that this happens during the "call exit" instruction at 0x08048954.

Reading the manpage for exit, I can see that undefined behaviour can occur in certain circumstances when functions are registered with atexit(3) or on_exit(3). However, I can't see any functions being registered in this way, and I can't see any other way which exit would fail to execute successfully. Why is a segfault happening during the exit call?

For reference, the surrounding code is:

```<code>0x080489F1:
push    offset aDonTGiveUp ; "Don't give up !"
call    puts
add     esp, 4
push    0
call    exit
push    offset aInvalidChoice ; "Invalid choice"
call    puts
add     esp, 4
nop
</code>```

Thank you for taking the time to read this.


问:
.NET Method Tracing with Parameters
Is there a tool which can profile the .NET binaries (32-bit and 64-bit) during execution to generate an API trace providing details of the methods called and the parameters passed to each method?

Since .NET is JIT based, I think it should be feasible to do.

An API trace in the following format would be desirable:

```<code><Address 1> <Method 1> <Parameter 1, Parameter 2>
<Address 2> <Method 2> <Parameter 1, Parameter 2>
....
<Address N> <Method N> <Parameter 1, Parameter 2>
</code>```

And an extension of this question. Is there a tool which can provide the similar information for each Windows API called by the .NET Binary as well?

Title: .NET Method Tracing with Parameters


问:
Tracing calls, rets and instructions with Intel Pin
I am writing a Pin tool with the following functionality:

It has to record instructions with arguments. (works well)

It has to record memory access operations associated with instructions. (works well)

It has to record a name of a function that is being called (if the name is available from external library). This functionality is based on calltrace.cpp from examples provided with Intel Pin. (Partially works well)

It has to record where a return instruction has landed (a function name, or, a main module of an instrumented executable). E.g. funcA is called, then funcB is called from funcA, then return from funcB lands in funcA. Recording of rets to functions partially works well, however I have no idea how to record return to the main module.

Before providing a source code let me describe what (as I think) is wrong with the output of a tool that I get.

Recording begins with a set of instructions that ends with return to a function that has not been called (or at least my PinTool didn't record it).

[mov esp, esi]

[pop ebx]

R

[pop edi]

R

[pop esi]

R

[pop ebp]

R

[ret 0x10]

R

InDirect RETURN to[RtlAnsiCharToUnicodeChar]

Sometimes it records names of the functions that are called without corresponding call instruction:

[push 0x77736e7c]

W

[push dword ptr [ebp-0x110]]

RW

[call 0x7779a490]

W

[LdrGetProcedureAddress]

[LdrGetProcedureAddressForCaller]

[RtlAcquireSRWLockExclusive]

Similar is for rets. Even more sometimes it records return to the same function twice in a row (but it should not).

[call 0x777a8b60]

W

[RtlRetrieveNtUserPfn]

InDirect RETURN to[RtlDeactivateActivationContextUnsafeFast]

////OR////

[mov ecx, dword ptr [edi]]

R

[call 0x7777e531]

W

[RtlAddAccessAllowedAce]

[RtlAcquireSRWLockExclusive]

InDirect RETURN to[RtlAddAccessAllowedAce]

[RtlReleaseSRWLockExclusive]

InDirect RETURN to[RtlAddAccessAllowedAce]

InDirect RETURN to[RtlAddAccessAllowedAce]

[mov esi, eax]

I feel like there is something fundamentally wrong in the way I handle these calls and rets "decoding". Can someone point me to where am I exactly wrong? Also two secondary questions.

1)  How to record return to the main module of an executable based on the instruction?

2) Is there a way to get values of IARG_BRANCH_TARGET_ADDR and IARG_BRANCH_TAKEN outside of INS_InsertCall (or similar) functions?

Thank you.

The source code is below.

```<code>#include <stdio.h>
//#include <chrono>
#include "pin.H"
#include <string>
#include <exception>

FILE * ftrace;
long long icount=0;
long long ilimit=1000000;
BOOL print_args=false;

string invalid = "invalid_rtn";
const string *Target2String(ADDRINT target)
{
    string name = RTN_FindNameByAddress(target);
    if (name == "")
        return &invalid;
    else
        return new string(name);
}

VOID  do_call_args(const string *s, ADDRINT arg0)
{
    fprintf(ftrace, "\n[%s]\n", (*s).c_str()); //(INS_Disassemble(ins)).c_str()
    fflush(ftrace);
}

/* ===================================================================== */

VOID  do_call_args_indirect(ADDRINT target, BOOL taken, ADDRINT arg0)
{
    if (!taken) return;

    const string *s = Target2String(target);
    do_call_args(s, arg0);

    if (s != &invalid)
        delete s;
}

/* ===================================================================== */

VOID  do_call(const string *s)
{
    fprintf(ftrace, "\n[%s]\n", (*s).c_str()); //(INS_Disassemble(ins)).c_str()
    fflush(ftrace);
}

VOID  do_ret(const string *s)
{
    fprintf(ftrace, "\nDirect RETURN to[%s]\n", (*s).c_str()); //(INS_Disassemble(ins)).c_str()
    fflush(ftrace);
}

/* ===================================================================== */

VOID  do_call_indirect(ADDRINT target, BOOL taken)
{
    if (!taken) return;

    const string *s = Target2String(target);
    do_call(s);

    if (s != &invalid)
        delete s;
}

VOID  do_ret_indirect(ADDRINT target, BOOL taken)
{
    if (!taken) return;

    const string *s = Target2String(target);
    fprintf(ftrace, "\nInDirect RETURN to[%s]\n", (*s).c_str()); //(INS_Disassemble(ins)).c_str()
    fflush(ftrace);

    if (s != &invalid)
        delete s;
}

VOID Instruction(INS ins, VOID *v)
{

    //start = std::chrono::high_resolution_clock::now();
    UINT32 memOperands = INS_MemoryOperandCount(ins);

    fprintf(ftrace, "\n[%s]\n", (INS_Disassemble(ins)).c_str()); //(INS_Disassemble(ins)).c_str()
    fflush(ftrace);
    if (INS_IsCall(ins))
    {
        if (INS_IsDirectBranchOrCall(ins))
        {
            const ADDRINT target = INS_DirectBranchOrCallTargetAddress(ins);

            INS_InsertPredicatedCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_args),
                IARG_PTR, Target2String(target), IARG_FUNCARG_CALLSITE_VALUE, 0, IARG_END);

        }
        else
        {
            INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_indirect),
                IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_END);
        }
    }
    else
    {
        if (INS_IsRet(ins))
        {
            if (INS_IsDirectBranchOrCall(ins))
            {
                const ADDRINT target = INS_DirectBranchOrCallTargetAddress(ins);

                INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_ret),
                    IARG_PTR, Target2String(target), IARG_FUNCARG_CALLSITE_VALUE, 0, IARG_END);

            }
            else
            {
                INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_ret_indirect),
                    IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_END);
            }
        }
        else
        {
            // sometimes code is not in an image
            RTN rtn = INS_Rtn(ins);

            // also track stup jumps into share libraries
            if (RTN_Valid(rtn) && !INS_IsDirectBranchOrCall(ins) && ".plt" == SEC_Name(RTN_Sec(rtn)))
            {
                if (print_args)
                {
                    INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_args_indirect),
                        IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_FUNCARG_CALLSITE_VALUE, 0, IARG_END);
                }
                else
                {
                    INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(do_call_indirect),
                        IARG_BRANCH_TARGET_ADDR, IARG_BRANCH_TAKEN, IARG_END);

                }
            }
        }
    }

        for (UINT32 memOp = 0; memOp < memOperands; memOp++)
        {

            if (INS_MemoryOperandIsRead(ins, memOp))
            {
                fprintf(ftrace, "R");
                icount++;

            }

            if (INS_MemoryOperandIsWritten(ins, memOp))
            {

                fprintf(ftrace, "W");
                icount++;

            }
        }

}
VOID Fini(INT32 code, VOID *v)
{    fprintf(ftrace, "\n");
    fclose(ftrace);
}
INT32 Usage()
{
    PIN_ERROR( "This Pintool prints a trace of memory addresses\n"
              + KNOB_BASE::StringKnobSummary() + "\n");
    return -1;
}
KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool",
    "o", "pinatrace2.out", "specify output file name");

KNOB<long long> KnobInsLimit(KNOB_MODE_WRITEONCE, "pintool",
    "i", "1000", "specify instruction limit");

KNOB<BOOL>   KnobPrintArgs(KNOB_MODE_WRITEONCE, "pintool", "a", "0", "print call arguments ");

int main(int argc, char *argv[])
{
    PIN_InitSymbols();
    if (PIN_Init(argc, argv)) return Usage();
    ilimit=KnobInsLimit.Value();
    ftrace = fopen(KnobOutputFile.Value().c_str(), "w");
    print_args = KnobPrintArgs.Value();
    INS_AddInstrumentFunction(Instruction, 0);
    //TRACE_AddInstrumentFunction(Trace, 0);
    PIN_AddFiniFunction(Fini, 0);
    PIN_StartProgram();

    return 0;
}
</code>```