问:
Is it possible to get address of function that implement virtual
I have address of virtual function in export table , is it possible to get implementation function address, that makes whole logic of virtual ?

Code sample:

this is virtual function that goes to export table

```<code>class CORE_API FArchive
{
public:
    virtual ~FArchive()
    {}
    virtual void messageboxer(char* messagetext){}
};
</code>```

and this is virtual function implementation

```<code>class FArchiveFileReader : public FArchive
{
public:

    void messageboxer(char* messagetext)
    {
        MessageBoxA(0, messagetext, "alert", MB_ICONERROR);
    }
};
</code>```

So in export table goes only virtual - like that ?messageboxer@FArchive@@UAEXPAD@Z

If i go on that address(in memmory via debugger) i get this
http://i.imgur.com/VuJITVl.png?1 - i dont see there nothing usefull, like jmp or call.
and this http://i.imgur.com/wegPZfq.png?1 is where function implementation is, is it connected somehow ? so i can calculate it.

Or having virtual function address from export table - is nothing, in terms of getting address of function(with actual logic) ?

If so - can someone give me an simple and good article describing on how to get address of actual function(not virtual).

P.S.
And sorry if i talk little strange, english isnt my common language, if you think that some place in my text is unclear, pls tell me where and i would try to explain better !

Hope someoe would help me

thx!


问:
immunity debugger MSVCR90.dll R6034
I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit image and MSVCR90.dll in pythons install directory. Whenever I execute the pycommands I get a MSCVR90.dll runtime error R6034. Does this debugger work on 64 bit host? If so what can I do to correct this runtime error?

Your advice is really appreciated...

ContentLicense: CC BY-SA 3.0

Title: immunity debugger MSVCR90.dll R6034


问:
Reverse Engineering program written in Python, compiled with “freeze 2 [REWRITE]
I am already aware of the question: 'Reverse Engineering program written in Python, compiled with “freeze”'

I have Immunity Debugger and is this the pyc code and the structures?

When I run the PyCommand mentioned in the original question, it doesn't dump the pyc code and do not make PYC files. And, I have the PythonMagic Code Correct (Python 2.4).

Any help?


问:
Redundant mov instructions; Why is this?
It's not the first time I see code like the following in assembly:

```<code>mov [ebp - 4], eax
mov edx, [ebp - 4]
</code>```

Which makes myself wonder why it hasn't been optimized to be:

```<code>mov edx, eax
</code>```

Why is this? (With partial answers)

Can it be because the optimize option wasn't set during compilation?

In fact, if we set in GCC compiler the -O2 option, the code changes to a more efficient version

Is it a common trace from known compilers which one can look for when reverse engineering?

It's a trace in the sense that, the compiler, if set to add all debugging symbols and information, will give us the change to debug line by line in the original source code (this can only be true if I understood Peter's comment well). Still remains totally unanswered.


问:
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.

This is the current uncompressed image:
https://www.dropbox.com/s/vxxz3x8ek84iie0/Firmware_N30?dl=0

According to what I have found this is an eCos image:
http://ecos.sourceware.org/

I want to separate the binaries, analyse how they work and see if it's possible to make modifications. How can I continue?

Title: Analysing eCos image


问:
What optics are used in Microsoft HoloLens?
How does Microsoft project an image so close to the eye yet understandable by the brain?

How is the display transparent?

This link has good information but is speculative. https://www.reddit.com/r/HoloLens/comments/2v0nac/hololens_display_tech_and_what_to_expect_from_it/

What materials are used?

For a list of patents see this: http://vrwiki.wikispaces.com/Microsoft+HoloLens


问:
Where can I get a dataset of URLs of websites that diffuse malware?
In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites.

Thank you


问:
Static Address in Dynamically Loaded DLL
I am trying to re-write the following function in my injected DLL.

```<code>mov edi,edi
push ebp
mov ebp,esp
mov eax, [sound.dll+1AE0]
push eax
mov ecx,[ebp+08]
mov eax,[ecx]
mov eax,[eax+0C]
push eax
call sound.dll+7C640
pop ebp
ret 0004
</code>```

I am loading my DLL via CreateRemoteThread. Is there a way to get the address of sound.dll+1AE0 (or linkage) when the DLL is loaded without having to to do GetModuleHandleEx and calculate the address dynamically?

Maybe with some imports or some linkage artifact?

Thanks!

EDIT:

The GetModuleHandleEx approach will look like:

DWORD mem1AE0=0;

Load mem1AE0 with sound.dll+1AE0 address

and then in my function:

```<code>_declspec(naked) void MyFunction() {
    __asm {
        mov edi,edi
        push ebp
        mov ebp,esp
        mov eax, mem1AE0
        mov eax, [eax]
        push eax
        mov ecx,[ebp+08]
        mov eax,[ecx]
        mov eax,[eax+0C]
        push eax
        call sound.dll+7C640
        pop ebp
        ret 0004
    }
}
</code>```

The problem is when I have a call [sound.dll+XXXX] instruction

In that case I need to create a variable which will point to that memory

DWORD memXXXX=0;

Load it with the correct address and also create a proxycall DWORD

DWORD memXXXX_content=0;

and then do:

```<code>push eax
mov eax, memXXXX
mov eax, [eax]
mov memXXXX_content, eax
pop eax
call memXXXX_content
</code>```

which is totally inefficient unless I am doing somehting wrong?

Thanks

EDIT: I believe there is no way to get static links if you are dynamically loading your DLL.


问:
Reverse engineer StackExchange winter bash
I'm curious if it's possible to reverse engineer the hat positioning and control of the StackExchange winter bash.

They offer the "show controls" checkbox, but it's still all mouse-based; when you try to get as large a hat and as far off as possible, it simply starts shrinking, and it's difficult to go back.  Any idea if it's possible to get around that?  (The controls only seem to change the alignment, and are not too helpful.)


问:
How can I figure out what serial port communication protocol is a software using?
I'm working to adapt an stress excercise test software so that it can work with a treadmill that uses a different communication protocol.

The communicate via a RS232 cable, with a USB-RS232 adapting device on the laptop end.

I have created a pair of virtual ports using com0com and have written a program in VB (using Visual Studio) that can open, read and write on the virtual ports. The purpose being that the program can work as a translator.

I have the treadmill protocol but not the software one, so I'm trying to listen to what the software tells to the virtual port and figure out what protocol it's using.

Is this option viable? Are there any further reading material / software I could use?

The only messages I got sof far were:

"?" when first running the test

"ìù 015ñ 000" when I set the treadmill on/off

If I don't answer, the software displays the message "treadmill failed". If I send any array of characters, it doesn't display the message and appears to start the test.


问:
Catch function flags change event in IDA plugin
Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it doesn't issued. Nevertheless, I can't find any event which issued when other flags change in SDK. Is it impossible?</p>


问:
Looking to RE a Ducky Shine 5
I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning tools etc to start me off? The help would be greatly appreciated!

Mostly looking for how to grab the firmware from the keyboard, how to analyse the resulting firmware (I read an article briefly on this subject but it didn't go into great detail) and how to then repackage the firmware to try it out on the keyboard.

Mostly this is a side project of sorts. Learning a new skill as well as attempting to create some custom profiles for the ducky shine 5s awesome RGB switches (the standard stuff is fun and all... but.. it would be nice to have customizability in there!)

Title: Looking to RE a Ducky Shine 5


问:
Buffer overrun overwrittens dynamic function table
I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to exactly understand.

The scenario is as follows:

W64 application on Windows 8.1 which instantiates a COM object (a library).

The library is prone to a buffer overrun with user controled input. No EIP gets overriten as library was compiled with MS Visual Studio /GS options (Stack canary protection)

Private symbols of an older version of the library are available, so I can force them to load with .reload /i

After calling to the function ProcessMessage, a 1023 bytes output buffer is filled with user controled input,for example a string with 2048 bytes.

After return from this function ProcessMessage, stepping with the debugger raises messages of type "Unable to read dynamic function table entry at ....".

This is the offending calling code:

```<code>    lea     r9,[rsp+78h]  ;* _EVENT_DATA_DESCRIPTOR
    lea     rdx,[rsp+40h] ; format string in data section (.... %s)
    mov     r8d,1         ; # of _EVENT_DATA_DESCRIPTORs
    mov     dword ptr [rbp-80h],eax  ;stringLen of data in _EVENT_DATA_DESCRIPTOR
    mov     dword ptr [rbp-7Ch],esi
    call    qword ptr [Library!ADVAPI32_NULL_THUNK_DATA]      ;call to EtwEventWrite
    call    qword ptr      [Library!_imp_PeekNamedPipe        ;calls GetCommandLineW
    lea     rdx,[Library!$xdatasym+0x70]                      ;format string in data section (.... %s)
    lea     rcx,[rbp-60h]  ;output buffer which will store result of ProcessMessage and will get overrun
    mov     r8,rax         ;result of _imp_PeekNamedPipe. Will used together with format string in rdx to form a string and store it in output buffer in rcx
    call    Library!`VulnerableClass::ProcessMessage'::`1'::catch$0+0x38
</code>```

Aftet the call to ProcessMessage, the following messages appear debugging with Windbg:

```<code>0:013> p
Unable to read dynamic function table entry at 00007ff801642c90
Unable to read dynamic function table entry at 00007ff801642cd0
0:013> p
Unable to read dynamic function table entry at 00007ff801642c50
Unable to read dynamic function table entry at 00007ff801642c90
</code>```

Does those messages mean our overflowed buffer has overwritten the vtable pointer of an object in the stack which has virtual methods? If so, is it possible to know to which object or functions does those addresses belong? Doing a u or dd on those address show no results.

In case it helps, the exceptions handlers declared, except of the current stack frame, were overwritten as well by user input (a mona.py pattern as shown below), don't know exactly if it has to do anything with the messages about dynamic function table:

```<code>0:013> !exchain
    31 stack frames, scanning for handlers...
    Frame 0x00: Library!VulnerableClass::SetValue+0x88b
    ehandler Library!`operator new'::`6'::`dynamic atexit destructor for 'nomem''+0x6490
    Frame 0x01: error getting module for 3462413362413262
    Frame 0x02: error getting module for 307a5a6241356241
    Frame 0x03: error getting module for 7a5a327a5a317a5a
</code>```

Thank you very much for the answers.


问:
figure out the CRC bytes
I am trying to write some code to figure out a CRC on the following byte sequence for an AI algorithm class project, and would like to seek some suggestions from this forum.

For example, the following bytes patterns are provided:

```
0f81265b6341
0f80265b63eb
0f83265b634a
0f89265b636d

0f81265b6269
0f83265b6262
0f80265b62c3
0f89265b6245

0f81265b594c
0f83265b5947
0f80265b59e6

0f81265b5A34
0f83265b5A3F
0f80265b5A9E
0f89265b5A18
```

I am trying to make an algorithm to see which bytes are involved and also which algorithm to try to deduce the final checksum byte. The final goal is to teach a machine how to do CRC by a learning process.

Title: figure out the CRC bytes


问:
I need a tool to assist decompiling C++
I am trying to reverse engineer some C++ code that was made by "architecture astronaut", having multiple layers, lots of virtual functions, lots of polymorphism, metaprogramming, inlined stuff, and so on.

I know that generating C++ from machine code is an almost absurd idea, but what I am looking for is a tool to help me organize information.

Example of features that I would appreciate: support navigating through code by vtables (ie: after you manually find all relevant vtables, you point them to the program, and clicking on a code that jumps to member "6" of the vtable jumps to that function, if this is ambiguous due to various vtables being possible, it asks you what vtable you want).

Easy editing of nested structures (example: instead of defining a class as a struct myClass { myBase baseClass; int someInt;}; you can actually see "myBase" contents inside "myClass" and even edit it, without having to edit the separate structures.

Support for STL names (extremely long names, names with <>: , characters in it)

Being able to tag some code as "copy and paste" of another code, at least in a highlight manner, so you can more easily see what is going on (for example for heavily inlined code, templates, metaprogramming abuse, and so on).

Being able to organize and compare vtables, suppose you have 1 base vtable that is almost entire pure virtual functions, and 2 vtables that override it later, then you can compare all 3, and know what is what (for example you know what functions are overriding the pure virtual functions, and thus if you have debug symbols or something figure the name of the original pure virtual functions).

Being able to merge structs (suppose you find functions of a class all over the code, and create a struct for each one, eventually you find it is the same class)

Being able to give "fake names" to entries on vtable (suppose you know the correct name of a function in a vtable, also the compiler optmized away this function because it was identical to other unrelated function, this way you can use the original name, instead of seeing A::func1(); A::func2(); B::func47(); A::func4();

Title: I need a tool to assist decompiling C++


问:
Log to file WSS Websocket packet traffic
How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ?

I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf , but I would like to know how to configure it


问:
Multiple "overlays" using same addresses in IDA
I am debugging an old Sony PlayStation 1 MIPS binary that swaps a bunch of submodules using same base address for loading. I am trying to find a workflow that would allow me to have all the submodules loaded at the same time.

From my understanding it's impossible to create overlapping segments in IDA, so I tried loading the binary at a higher address(outside of the 2MB of RAM IDA expects), but IDA doesn't like this - code blocks are not automatically detected and when forced - offsets are all wrong(not a big surprise). So do I have any options here? Looks like other way around is to try to sync data between multiple projects, but based on other answers - that's far from perfect too.


问:
IDAPython loading parameters bruteforce
I have a binary file for known hardware platform, but nothing more is known.

When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable strings.

I suggest that the case in the loading parameters: the loading address and the entry point. Maybe some even.

The only solution I see in the bruteforce these parameters and re-launch auto analysis. Before that I would like to help IDA by designation some pieces of code - readable strings as strings, small common hardware patterns as code pieces.

Success criteria - the appearance of xrefs to the strings.

Unfortunately I'm newbie in IDAPython, and I'm only has learned to show to IDA strings (by MakeStr-function).

How can I change loading parameters and launch full auto-analysis in IDAPython script?

Title: IDAPython loading parameters bruteforce


问:
Determine ARM architecture from IDA plugin
Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues:

1) How can I distinct specific ARM architecture (e.g. ARMv5, ARMv7 et cetera) via plugin API? While appropriate arch is clearly stated in IDB header, I've failed to find any suitable API to retrieve that info from plugin.
idaapi.get_inf_structure() -> procName
returns 'ARM' for any ARM ELF/Mach-O binary, as it seems.
Scanning opcodes can be a solution, but I doubt that's a good solution

2) 32/64 flags (i.e. is_32bit/is_64bit) are available to distinguish arm64, for example, fat mach-o's reports +/- for 32-bit (ARMv7) and +/+ for 64-bit (ARM64) IDA. Am I missing something?

3) Is there any best-practice to determine ARM' thumb-instructions mode?
Hadn't go that far yet, stuck with architecture issue...

May be I'm blind?


问:
IDA Pro get line number in main view
I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is GetLineNumber(ea) but it only gives me the line number in the source files, not the line num of the disassembled code.

Title: IDA Pro get line number in main view


问:
Why program opened with OllyDbg 2 isn't paused at start?
There is one thing that I still can’t understand about Olly.

I have a sample (an .SCR file) which I’m trying to analyze. When I open it with Olly 1.10, the file is loaded and its execution is paused just at the start.

But when I open it with Olly 2.01, it is loaded AND executed immediately, so it closes processes, breaks Olly, VM, etc… I’ve tried to select different options in “Options”->”Debugging”->”Start”, but noticed no difference at all.

How can I make Olly 2.01 behave like Olly 1.10 so I can step over the instructions from the very beginning?

UPD.: I've tried to uncheck the "Unpack SFX module authomatically" checkbox, but the process is still executing after opening.

P.S. I’ve uploaded the sample here: http://s000.tinyupload.com/?file_id=91057886723949836306
IT IS A VIRUS SAMPLE, so the archive is encrypted with the password "infected".


问:
Android shared Library (.so)
I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I've managed to extract the libraries from the APK and I've found some code in the APK itself which references them. So would the best way of using them for my own purposes be just reusing the current code the app uses to implement them? Or is there some special techniques that would need to be used in order to use them correctly?

Sorry if this has been asked before
Nathan

Title: Android shared Library (.so)


问:
Java source code deobfuscator?
Does anyone know of any source code deobfuscator in java?
I'm currently writing an obfuscator for java source code and I want to test how well I have made it with an deobfuscator.</p>

Title: Java source code deobfuscator?


问:
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed the tutorial IDA Help: Debugging code snippets with QEMU.

It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:

Should I adjust something on the memory map? As you can see, the code is rebased in the range of 0x8f0000000.
Or is it something with the generated intermediate ELF file?

I am using the Mipsel_Malta config, cmd line is

"D:\attila\qemu\bin\qemu-system-mipsel" -S -gdb tcp::%p,ipv4 -cpu 4Km -kernel "%e".

ContentLicense: CC BY-SA 4.0


问:
Running vmlinux ELF under QEMU
I have a vmlinux ELF file to run under QEMU.

My arguments to qemu-system-arm.exe are:

The correct -cpu argument.

The versatilepb -machine which I'm not sure if it's the right choose, but can't see the other options with -cpu help.

The -kernel flag to pass the vmlinux file.

The -serial stdio -nographic flags with "console=ttyAMA0 console=tty1 console=ttyS0" kernel arguments.

Why I don't see any output? I also tried the -D flag to get a log file.

Title: Running vmlinux ELF under QEMU


问:
SysTracer by SysReveal.com clean?
SysTracer from SysReveal.com (not from www.blueproject.ro) seems to be a very nice tool for live monitoring your system and check what executable files do at your system. I saw some videos on YouTube where sys-admins used it to show e.g. how Ransomware works. In this video on YouTube ( https://www.youtube.com/watch?v=Sm5TbBKeFvU ) by the well known company "Trend Micro", they mentioned (at 0:56) the website SysReveal.com, where you can download SysTracer. The website is on Google's SafeBrowsing blacklist and the tool "SysTracer" hits 8 (.zip) or 9 (.exe) of 55 at Virustotal.

I would appreciate it, if you check this tool NOR share your thoughts about it.

Website: sysreveal.com (Google's SafeBrowsing Alert!)

SysTracer:
hxxp://sysreveal.com/download/SysTracer.zip (8 of 55 at Virustotal)

Image of SysTracer

Title: SysTracer by SysReveal.com clean?


问:
Reverse engineering a hash generated from IP and unixtime - How to approach?
There is a website that gives you a token and the unixtime to access a resource on another domain.

I can use those 2 values to access it like that:

Example: example.com/test.txt?st=[HASH]&e=[UNIXTIME]

I build a small script that generates those values and displays them in the format

[UNIXTIME] : [HASH]

http://46.101.150.244/m/serve.php (You can refresh to see new combinations.)

Observations:

When I request a token and get "st" and "e" by using my remote server, I can't access the resource. -> it is bound to a specific IP, no other parameters.

Also when generating 2 tokens at the same unix time from different ips, they are different -> confirmation of 1.

When generating a token multiple times within a second from the same IP, the token is always the same until the unix second passes. -> Pretty sure the only dynamic factors are the IP and the time.

When looking at the last character of the hash, it is always either A, Q, g or w. Their hexvalues are (same order) 41, 51, 67, 77. A,Q and g,w are exactly 0x10 apart.

I assume it is base64, but it has - and _ instead of + and /. Do you think thats possible? It also has 22 characters.

I tried many different things, trying to decode base64 (often padding error), trying substrings to maybe find something useful, the IP in binary representation for example, but since the whole string completely changes every time the unix time changes, I really dont know if there is anything I can do.

Its totally possible that it is salted and I have zero chances of finding a solution, however the fact that the last letter is always one of four possibilities gave me hope.

I had a lot of fun approaching this challenge, if someone could give a hint how to approach this situation, what I should try out etc, that would be great!


问:
Unknown firmware header for ARM device
I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I can't see anything obvious. Any ideas very welcome. srec_info seems to think it's "Motorola S-Record" but this is clearly a padded binary format, ending with what looks like a SHA256 hash:

```<code>0000000 0001 0000 0200 0000 0000 0003 0000 0400
0000010 0000 0000 0005 0000 3000 0000 0000 0031
0000020 0000 3200 0000 0000 0101 0010 0020 0403
0000030 18ff 0300 ff04 0018 0000 0000 ffff ffff
0000040 ffff ffff ffff ffff ffff ffff ffff ffff
*
0000200 df03 fae3 dcb6 3e5e 1dd8 d3b8 8805 a692
... firmware blob ...
0003410 0073 0065 ffff ffff ffff ffff ffff ffff
0003420 ffff ffff ffff ffff ffff ffff ffff ffff
*
0003500 0001 0000 0200 0000 0000 0003 0000 0400
0003510 0000 0000 0005 0000 3000 0000 0000 0031
0003520 0000 3200 0000 0000 0101 0010 0020 0403
0003530 18ff 0300 ff04 0018 ffff ffff ffff ffff
0003540 ffff ffff ffff ffff ffff ffff ffff ffff
*
00035e0 8bce 56ef c6db d0db a6ce 9cce 9cce 9cce
00035f0 9cce 9cce 9cce 9cce 9cce 88d1 55aa 1385
0003600
</code>```

Any ideas very welcome, thanks!

Title: Unknown firmware header for ARM device


问:
Reading stp (Designaknit Stitch Pattern)-Files
I want to write a small knitting program for my wife. In it, I will also read * .stp files (Stitch pattern). These are small files containing a graphic created by the program DesignaKnit and many of which are files on the Internet. (Examples z. B. to http://www.stricknetz.net/muster/dateien/).
To read it I need of course the format. Since I found it nowhere I tried to decipher. I have found much, but not get ahead now and hope to help.

Here what I found out:

```<code>Byte 0-2: D7C
Byte 3-4: width
Byte 5-6: Height
Byte 7-8: width
Byte 9-10: Height
Byte 11-12: number of pattern repeats Horizontal
Byte 13-14: Number of vertical pattern repeats
Byte 44: 'Knitting technique:
    '0 = different - see the pattern ????
    '1 = marquetry
    '2 = 2-color jacquard
    '3 = 3-color jacquard
    '4 = 4-color jacquard
    '12 = Handstrick
    '14 = Structure pattern right side
    '15 = Textured pattern left

Byte 177-209: Font name - padded with 0 (209 = End 0)
248-249 = height (number of rows)
250-251 = size image data in bytes
252 - (252 + image data size) = image data - (somehow RLE - compressed)
Then: 2 bytes = height (number of rows or number ???)
then 2 bytes Size of data
then ending bytes
then unknown data
then pallet (48 colors - if color is not used to zero)
Color 1 = 25 bytes
    Byte 0: number?
    Byte 1: message numbers
    Byte 3: Number
    Byte 6-8: RGB color
    Byte 9: Length Color Name
    Byte 10-24: color name with a final 0 (at length 15 without 0)
</code>```

But I'm stuck with the RLE encoding of data. They are somehow specially coded. The figures (for number the same color, but also for the number in the range) switch repeatedly. z. B.

```<code>00h 05h 21h 00h 22h 02h 29h 0Ch
Color 1 | 2 Color | Color 1 | 2 Color | Color 1 | 2 Color | Color 1 | Colour 2 | etc.
</code>```

Thus, the position changes in the pallet continuously (or to re-calculate - for example color 1 in the example. 00h, 21h, 22h, 29h ...)

But the number of same-colored pixels in the RLE-encoded bytes changes constantly. So 2 is the same color pixels once B3h, then B9H, then again B9H, then B4h etc.
In tests I found out that it is connected with any bytes from position 35h (decimal 53).
But I do not come on.
I tried to look in a program that they can read files with IDA (SilverKnit Utility (www.silverknit.nl/download/) -. But since I speak no assembler I not get Perhaps someone can help me the riddle of STP to solve files (if at all possible) ??????????????????

Alfred


问:
Trying to replicate a serial protocol
Spent the last few weeks reading, typing, testing, rinse & repeat to no avail in solving a problem.

Problem: Trying to reverse engineer a serial protocol at work.  Instrument is currently being sold.  Speaks exclusively to a GUI that was 'written' in Labview and is old and buggy.  I can't navigate the Labview 'code' for the life of me and the old SW engineer is gone.  I have the firmware code - but I'm not a firmware guy and I can't seem to find any kind of communications protocol in the firmware (I'm looking for read functions in the UART routines with input compare logic.. can't find anything).

I've been using Busdog and some other serial monitors to read USB port communications between GUI and instrument.  I try to mimic what the GUI is saying, but I get different responses from instrument.  I've tried every common baud rate and I can't get the instrument to respond in the same manner (I'm seeing 57600 in firmware and software code but still can't get that baud rate to work).  Language I'm using is C# if that matters. Instrument also uses USB adapter for old style D-Sub serial cable, really not sure if that matters either.

Here's the GUI/Instrument startup log:

Id    Type    Time    Length  Hex Ascii

    12   Out  (USB URB Function: 9)  0.000000    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.008934    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.010073    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.007099    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.010093    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.009898    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.010076    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.010085    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.010055    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.009993    4   00 00 00 00 ....

    12   Out  (USB URB Function: 9)  1.010076    4   00 00 00 00 ....

12    In  (USB URB Function: 9)   0.478304    19  01 60 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00    ..................

12    In  (USB URB Function: 9)   0.015842    29  01 60 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00    ............................

12   Out  (USB URB Function: 9)  0.035298    5   09 01 00 00 f6  .....

12    In  (USB URB Function: 9)   1.476104    7   01 60 09 01 00 00 f6    ......

12   Out  (USB URB Function: 9)  0.000255    4   01 00 00 ff ....

12    In  (USB URB Function: 9)   0.255325    14  01 60 01 13 32 33 30 30 34 35
  37 00 02 14   ...2300457...

12    In  (USB URB Function: 9)   0.016031    13  01 60 01 c7 00 78 00 58 f9 01
  03 04 d8  ....x.X.....

12   Out  (USB URB Function: 9)  0.001046    5   05 01 01 00 f9  .....

12    In  (USB URB Function: 9)   0.190664    50  01 60 05 3c 01 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 01 00 01 43 44 4f 4d 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52
  46    ..<...................CDOM.....................RF

12    In  (USB URB Function: 9)   0.016036    18  01 60 55 00 00 00 00 00 4e 00
  00 00 00 00 02 9d 03 bc   .U.....N.........

12   Out  (USB URB Function: 9)  0.000203    5   05 01 02 00 f8  .....

12    In  (USB URB Function: 9)   0.223419    9   01 60 05 3c 02 00 00 00
  00    ..<.....

12    In  (USB URB Function: 9)   1.015965    59  01 60 00 00 00 00 00 00 00 00
  00 00 00 01 00 01 42 72 69 67 68 74 65 6e 65 72 73 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00 00 05
  3f 06 b9  ...............Brighteners..............RFU.....N......?..

12   Out  (USB URB Function: 9)  0.000705    5   05 01 03 00 f7  .....

12    In  (USB URB Function: 9)   0.223026    7   01 60 05 3c 03 00 00    ..<...

12    In  (USB URB Function: 9)   0.015999    61  01 60 00 00 00 00 00 00 00 00
  00 00 00 00 00 01 00 01 54 72 79 70 74 6f 70 68 61 6e 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00
  00 05 82 06
  b9    .................Tryptophan...............RFU.....N.........

12   Out  (USB URB Function: 9)  0.000924    5   05 01 04 00 f6  .....

12    In  (USB URB Function: 9)   0.238712    5   01 60 05 3c 04  ..<.

12    In  (USB URB Function: 9)   0.016021    63  01 60 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 01 00 01 43 34 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00
  00 00 00 01 47 02
  bd    ...................C4.......................RFU.....N......G..

12   Out  (USB URB Function: 9)  0.000253    5   05 01 05 00 f5  .....

12    In  (USB URB Function: 9)   0.239318    10  01 60 05 3c 05 00 00 00 00
  00    ..<......

12    In  (USB URB Function: 9)   0.016044    58  01 60 00 00 00 00 00 00 00 00
  00 00 01 00 01 43 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00 00 01 45
  02 bd .`.............C5.......................RFU.....N......E..

12   Out  (USB URB Function: 9)  0.000724    5   05 01 06 00 f4  .....

12    In  (USB URB Function: 9)   0.239014    7   01 60 05 3c 06 00 00    ..<...

12    In  (USB URB Function: 9)   1.016014    61  01 60 00 00 00 00 00 00 00 00
  00 00 00 00 00 01 00 01 43 36 00 00 00 00 00 00 00 00 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 52 46 55 00 00 00 00 00 4e 00 00 00 00
  00 01 43 02
  bd    .................C6.......................RFU.....N......C..

12   Out  (USB URB Function: 9)  0.000268    5   05 01 07 00 f3  .....

12    In  (USB URB Function: 9)   0.255336    55  01 60 05 3c 07 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 44 65 70 74 68 00 00 00 00 00
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 43 00 00 00 00
  00    ..<...................Depth.....................C.....

12    In  (USB URB Function: 9)   0.015864    13  01 60 00 00 00 00 00 00 00 02
  0f 03 bc  ............

12   Out  (USB URB Function: 9)  1.009433    4   00 00 00 00 ....

12    In  (USB URB Function: 9)   0.013163    6   01 60 00 00 00 00   .....

12   Out  (USB URB Function: 9)  1.011897    4   00 00 00 00 ....

12    In  (USB URB Function: 9)   0.010717    6   01 60 00 00 00 00   .....

12   Out  (USB URB Function: 9)  1.011300    4   00 00 00 00 ....

12    In  (USB URB Function: 9)   0.011293    6   01 60 00 00 00 00   .....
  (idling at this point... )

Here's my program/instrument log @ 57600 baud:

Id Type    Time    Length  Hex Ascii

12   Out  (USB URB Function: 9)  0.000000    4   00 00 00 00 ....

12    In  (USB URB Function: 9)   0.001779    7   01 68 30 00 ce 00 30    .h0...0

12    In  (USB URB Function: 9)   0.027282    70  01 60 e0 e7 3e fe 3e c0 fe 07
  80 30 f8 98 fe 3e 0e f8 07 83 ce 06 0e f0 0e 00 30 1e ce e6 78 83 f0
  0e fe 18 80 30 e0 30 00 30 3e 06 f8 30 00 30 1e 98 0e 1e e7 f0 18 3e
  e0 98 00 f0 30 e0 ce 00 01 60 30 00 f0
  f0    ...>.>....0...>..........0...x......0.0.0>..0.0.......>....0....0...

12   Out  (USB URB Function: 9)  2.699018    4   00 00 00 00 ....

12    In  (USB URB Function: 9)   0.000785    3   01 70 00

12    In  (USB URB Function: 9)   0.001493    8   01 68 ce 00 30 00 f0 30

12    In  (USB URB Function: 9)   0.015390    9   01 60 e0 ce 00 30 00 f0 f0

12   Out  (USB URB Function: 9)  1.669796    4   00 00 00 00

12    In  (USB URB Function: 9)   0.000797    3   01 70 00

12    In  (USB URB Function: 9)   0.001374    8   01 68 ce 00 30 00 f0 30

12    In  (USB URB Function: 9)   0.016017    9   01 60 e0 ce 00 30 00 f0 f0

12   Out  (USB URB Function: 9)  0.573729    4   00 00 00 00

12    In  (USB URB Function: 9)   0.000870    3   01 70 00

12    In  (USB URB Function: 9)   0.001373    8   01 68 ce 00 30 00 f0 30

12    In  (USB URB Function: 9)   0.015141    9   01 60 e0 ce 00 30 00 f0 f0

12   Out  (USB URB Function: 9)  2.286973    5   09 01 00 00 f6

12    In  (USB URB Function: 9)   0.000881    3   01 68 c0

12    In  (USB URB Function: 9)   0.000244    3   01 60 00

12    In  (USB URB Function: 9)   0.001108    8   01 68 33 00 30 00 f0 30

12    In  (USB URB Function: 9)   0.015015    10  01 60 00 fe e6 00 30 00 f0 f0

12   Out  (USB URB Function: 9)  1.950696    4   01 00 00

12    In  (USB URB Function: 9)   0.000805    3   01 68 c0

12    In  (USB URB Function: 9)   0.000213    3   01 60 00

12    In  (USB URB Function: 9)   0.015034    8   01 60 33 00 30 00 f0 f0

12   Out  (USB URB Function: 9)  0.561288    5   05 01 01 00 f9

12    In  (USB URB Function: 9)   0.000797    3   01 68 f0

12    In  (USB URB Function: 9)   0.000245    3   01 70 00

12    In  (USB URB Function: 9)   0.001254    8   01 68 33 00 30 00 f0 30

12    In  (USB URB Function: 9)   0.000123    3   01 70 00

12    In  (USB URB Function: 9)   0.000248    3   01 68 ff

12    In  (USB URB Function: 9)   0.015170    8   01 60 c6 00 30 00 f0 f0

12   Out  (USB URB Function: 9)  1.869307    5   05 01 01 00 f9

12    In  (USB URB Function: 9)   0.000888    3   01 68 f0

12    In  (USB URB Function: 9)   0.000250    3   01 60 00

12    In  (USB URB Function: 9)   0.001117    8   01 68 33 00 30 00 f0
  30    .h3.0..0

12    In  (USB URB Function: 9)   0.000124    3   01 70 00    .p.

12    In  (USB URB Function: 9)   0.000249    3   01 68 ff    .h.

12    In  (USB URB Function: 9)   0.015890    8   01 60 c6 00 30 00 f0
  f0    ...0...

12   Out  (USB URB Function: 9)  3.052994    5   05 01 02 00 f8  .....

12    In  (USB URB Function: 9)   0.000804    3   01 68 f0    .h.

12    In  (USB URB Function: 9)   0.000124    3   01 70 00    .p.

12    In  (USB URB Function: 9)   0.001377    8   01 68 33 00 30 00 f0
  30    .h3.0..0

12    In  (USB URB Function: 9)   0.000123    3   01 60 00    ..

12    In  (USB URB Function: 9)   0.000125    3   01 68 ff    .h.

12    In  (USB URB Function: 9)   0.015154    8   01 60 c6 00 30 00 f0
  f0    ...0...

12   Out  (USB URB Function: 9)  2.182100    5   05 01 03 00 f7  .....

12    In  (USB URB Function: 9)   0.000870    3   01 68 f0    .h.

12    In  (USB URB Function: 9)   0.000207    3   01 60 00    ..

12    In  (USB URB Function: 9)   0.001265    8   01 68 33 00 30 00 f0
  30    .h3.0..0

12    In  (USB URB Function: 9)   0.015650    10  01 60 00 fe e6 00 30 00 f0
  f0    .....0...

  >

Not sure why I can't match the startup routine.  Or match anything else.  I assume I'm missing something big.. I just don't know what.  Any insight helps.  Thanks.

Title: Trying to replicate a serial protocol


问:
SSL unpinning Twitter android app
I want to run twitter app behind a proxy so i decompiled the app
to read the source code.I have noticed that it is using this code

https://github.com/moxie0/AndroidPinning/tree/master/src/org/thoughtcrime/ssl/pinning

to pin the certificate.
I patched the code to ignore pinning.But it is still not working.
So I run it in androbug debugger to see the source of the problem.After some digging around I have noticed that the runtime library libcore.net.http calls another trust manger than the one I have modified. And this library is not in the apk file. So what are my options now ?

Title: SSL unpinning Twitter android app


问:
SSL Unpinning Twitter app
I want to run twitter app behind a proxy so i decompiled the app
to read the source code.I have noticed that it is using this code to pin the certificate.

https://github.com/moxie0/AndroidPinning/tree/master/src/org/thoughtcrime/ssl/pinning

I patched the code to ignore pinning.But it is still not working.
So I run it in androbug debugger to see the source of the problem.After some digging around I have noticed that the runtime library libcore.net.http calls another trust manger than the one I have modified. And this library is not in the apk file. So what are my options now ?

Title: SSL Unpinning Twitter app


问:
Anti-Anti-Dump Approaches
tl;dr: What would be alternative approaches for attacking an anti-dump design that allocates encrypted blocks of code on the heap and uses a vm to resolve addresses and decrypt before execution?

I'm working on a binary with about 900 pages (4k) of stolen bytes. The binary in .text jumps with a hardcoded address as a parameter that runs through VMcode, generates a value based on a few identifying features (cpuid, threadid, processid), and eventually decrypts the page on the heap and jumps to it in order to execute the stolen functionality. It doesn't shred the bytes or re-encrypt them most likely for performance reasons - future calls jump directly to the destination code.

I have isolated a few blocks of code that decrypt the code itself and jump (haven't quite figured out the key generation yet), and have considered a few approaches:

1.Dump every 4k page allocated(about 900 or so) and append them to the end of the binary at the right address (they won't be allocated in a dumped binary due to real OEP being after the initial packer OEP that sets all this up), and try to trace the vm to manually fix the jumps in the .text section to the decrypted address.

2.Decrypt the pages, strip out garbage instructions (will probably take a while with not the best confidence level), and paste them in-place where they should be in the executable (the bytes that were stolen have its encrypted counterpart in the original location).

3.Try to inject some shared library at the packer OEP, override ntalloc, allocate the memory in a linear fashion accessible from the dll, and log all the decrypted functions; eventually, write some kind of loader that can use the dumped memory as some kind of switchboard that can jump and update the calls in the original binary to jump into the library that would redirect control flow.

4.Some other method I haven't considered.

It seems like they would all work, but the amount of work in any case seems to range from a lot to a ridiculous amount. Are there any other approaches that might be worth exploring?

Thanks!

Title: Anti-Anti-Dump Approaches


问:
What checksum is Super Smash Bros. Wii U using?
When you save a screenshot in Super Smash Bros. for Wii U on the SD card it writes to, it makes two files: a .JPG and a .BIN file. Both these files are in the format of HNI_XXXX.EXTENTION, where XXXX is the number of the screenshot. I believe that the .BIN file is (at least in part) a checksum to verify that the images are not edited (outside of the game), because modifying the .JPG file in any way will cause the game to refuse to recognize it.

Since the .BIN file is always 32-bytes exactly, I've tried using some of the common 265-bit checksums like SHA-256, and GOST. But none have ever matched up what has been contained in the .BIN files.

I've included three sets of images and their respective checksums in a convenient zip file, so please take a look.

Does anyone have any ideas what checksum Super Smash Bros. might be using? If you need any more details I'd be more than happy to provide them.


问:
Get DLL from EXE file
I am trying to reverse engineer an DLL that is loaded from a EXE.

I don't have the DLL file. I just have an executable file that injects the DLL into a certain process.

When I try using ollydbg or similar software, I could not find it.

Any help is appreciated.

I am trying to dump the DLL file it injects!

Title: Get DLL from EXE file


问:
How get a full memory dump of a running services.exe instance?
How can I get a full memory dump from a services.exe process on Windows 8.1 x64?


问:
How to propagate an enum type in IDA Pro?
I'd like to mark some data as being an enum, and have that automatically propagate to all uses of this piece of data. Both direct accesses to the data (e.g. cmp data_with_enum_type, enum_value), and future use by any register it is copied into (e.g. mov al, data_with_enum_type | cmp al, enum_value).

Is this possible in IDA, or something that could be straightforwardly scripted, or something an existing plugin may handle?


问:
IDA: Extracting functions arguments from stripped binary
This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0).
Is it possible to extract such information from stripped binaries? </p>


问:
Giving labels to local variables with GDB
In the GDB debugger of Linux, is it possible to give a local variable (at specific offset from the %esp register) a constant name, which I will see everytime I call disassemble instead of seeing the address?

I mean something like the capability of IDA Pro to set names to unknown variables.


问:
Dll Injection into QT application
I'm pretty new to this stuff, so please excuse me if anything I ask is kinda stupid.
I'm trying to inject a DLL into a QT application and call some of the QT functions. I got the injection working with notepad.exe or explorer.exe, but everything else I tried (Spotify, some QT apps, skype, ...) wont show my messagebox, although the injection intself doesn't throw any errors.

Here's the code of my injector program:

```<code>#include "stdafx.h"
#include "windows.h"
#include <iostream>

using namespace std;
char const path[] = "C:\\InjectedDll.dll";

void setDebugPrivilege()
{
    HANDLE hToken;
    TOKEN_PRIVILEGES privileges;
    privileges.PrivilegeCount = 1;
    privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
    {
        std::cout << "Failed to open process." << std::endl;
    }
    if (!LookupPrivilegeValue(0, SE_DEBUG_NAME, &privileges.Privileges[0].Luid))
    {
        std::cout << "Failed to look up privileges." << std::endl;
    }
    if (!AdjustTokenPrivileges(hToken, false, &privileges, sizeof(privileges), 0, 0))
    {
        std::cout << "Failed to adjust token privileges." << std::endl;
    }
    CloseHandle(hToken);
}

int main(int argc, char* argv)
{
    setDebugPrivilege();

    HWND hWnd;
    hWnd = FindWindowA(0, "Spotify");
    if (!hWnd) {
        std::cout << "Could not find editor window." << std::endl;
    }

    DWORD pId;
    GetWindowThreadProcessId(hWnd, &pId);
    if (!pId) {
        std::cout << "Could not find process id." << std::endl;
    }

    HANDLE hProcess;
    hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pId);
    if (!hProcess) {
        std::cout << "Failed to open process." << std::endl;
    }

    HANDLE allocatedAddress;
    allocatedAddress = VirtualAllocEx(hProcess, 0, sizeof(path), MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    WriteProcessMemory(hProcess, (void*)allocatedAddress, (void*)path, sizeof(path), 0);

    HANDLE hRemoteThread;
    hRemoteThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA"), allocatedAddress, 0, 0);
    if (!hRemoteThread) {
        std::cout << "Failed to create remote thread: " << GetLastError() << std::endl;
    }

    WaitForSingleObject(hRemoteThread, INFINITE);
    VirtualFreeEx(hProcess, allocatedAddress, sizeof(path), MEM_DECOMMIT);
    CloseHandle(hProcess);

    system("Pause");

    return 0;
}
</code>```

And here is my basic DLL.h:

```<code>#pragma once
#include "windows.h"

#ifdef INJECTEDDLL_EXPORTS
    #define INJECTED_DLL_API __declspec(dllexport)
#else
    #define INJECTED_DLL_API __declspec(dllimport)
#endif

INJECTED_DLL_API LRESULT CALLBACK newWndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam);
INJECTED_DLL_API DWORD WINAPI creation();
INJECTED_DLL_API int WINAPI DllMain(HINSTANCE hInstance, DWORD reason, LPVOID reserved);
</code>```

And DLL.cpp:

```<code>#include "injected_dll.h"

DWORD WINAPI creation()
{
    MessageBoxW(HWND_DESKTOP, L"Failed to subclass window.", L"Noez!", MB_OK);
    return TRUE;
}

int WINAPI DllMain(HINSTANCE hInstance, DWORD reason, LPVOID reserved)
{
    if (reason == DLL_PROCESS_ATTACH)
    {
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)creation, 0, 0, 0);
    }
    return true;
}
</code>```

So can anyone tell me why this isn't working? I tried both, using MessageBoxA(..) and MessageBoxW(..) and just MessageBox(..), they all worked on notepad.exe, but none worked on the other programs.

Title: Dll Injection into QT application


问:
Reverse Engineering a whole project desktop application
Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create a whole new appliclation is to understand those Dll´s and use them to make new better one; but i need to map the whole situation: the functions a classes that those Dll´s use are available to be checked using ida or ollydbg, most of them functions are called between programs and Dlls, so my questios is to know if is there a tool live viual studio does with a proyect, that can show me the whole Dlls, its functions and clases so i can try to understand the program from the point of view of their use, instead from the disassembly.
Thanks in advance</p>


问:
How get a full memory dump of a running specific process from kernel mode by driver?
How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?</p>


问:
Unpacking / Decrypting .dat file
Problem

I am trying to decrypt or unpack a .dat file to know its value. here is the file

download here

When opened in notepad the text would look like these:

```<code>UOSEDALB        @(                                                                     &
  Ü
8Ïq"Ê¹zd
#ÅÁLŒô¨8\Jõ^ŒMÿf2 #¯N>¶„¼ÌQ^1C”[8¦ 9ÙÞb![ÒyîÜG#Ž¥n¸õ?ïIÐ±áá¾¥™pG’
æ°ÜóbûûvêØ¢2BKˆ—+Õ/v»XT’‚'Ç]|Véé{&î}ÐÃd6z;¢éÊ¨ÿS÷úm™¼ #“åd„\HŽ    ¢;$‹ hý€t²'ùjÈ&Í—“‡Rö×&Ôoz…ÉL·ûY·roùˆÝÐ]ÄËDyjÕ[òô!+ØZÎ“ž]àFì0Í+]6†i„ŸƒxÉ´„o''
</code>```

I'm looking for a tool to unpack this .dat file, I'm positive it will have xml type of texts. Thanks in advance.

Title: Unpacking / Decrypting .dat file


问:
Collecting malware samples
Could you please list some sites from where I could download viruses/worms/trojans in .exe format. I have read the answers to the other similar questions but couldn't make much use of them.
I am a novice at dynamic analysis of malware and it's easier for me to analyse the malware samples on my virtual machine if they are in .exe format.

Title: Collecting malware samples


问:
Modyfying PE file data section
I am a bit new to RE, so forgive me any weird or stupid questions.
The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy  changes to a new executable. I found out I can use resource editor to do that, but unfortunately I am able to change only menus and dialogs, icons and graphics. There are no strings including this one I want to change. To sum up, I'd like to know any method to change string located in data section.
Thanks in advance.</p>

Title: Modyfying PE file data section


问:
Reversing network traffic and rebuild packets
I want to learn something about reverse engineering.

I want to rebuild the TeamSpeak connection (client connects to server).

I hooked the recv and send + encrypt/decrypt functions and logged the following:

```<code>SEND_CRYPT: clientinitiv alpha=5KPOgZDgbleuNw== omega=MEwDAgcAAgEgAiBHsn4CYlt90fs0G1sEnx0nmGPfQYMwegBrhzD3yKj3xAIhAKmF+INBCx3rP6FPHq5XfEQt2RFDHdan9EhyZwaziDrV ip=52.28.46.214
RECV_CRYPT: initivexpand alpha=5KPOgZDgbleuNw== beta=xauLd710Z+FpNA== omega=MEsDAgcAAgEgAiAeZO7JB+dpowIKbjBiTtovildErI2tDPRfMmgBBF\/h5AIgLkw8l3NXolC6nzuMltP3dbewY0hLzMnEK38uhl0N20w=
SEND_CRYPT: clientinit client_nickname=zodiac client_version=3.0.18.2\s[Build:\s1445512488] client_platform=Windows client_input_hardware=1 client_output_hardware=1 client_default_channel client_default_channel_password client_server_password client_meta_data client_version_sign=F0hY25Dtja0wcU6dzC39rNuYbhnDAbIwPHC3VO9Oicf13kUY2I2g6scPZ3p195Cw9gUYdBIRYm8ucHEhtSeWCw== client_key_offset=104 client_nickname_phonetic client_default_token client_badges=Overwolf=0 hwid=c7b85b27969edb59fc3103155deb11fb
SEND_CRYPT: ,3e8bfb43b3abf4f6331ebd6d65523eeb
RECV_CRYPT: ‘—
</code>```

Teamspeak encrypts with AES the network traffic so alpha/omega are probably the keys for that.

I also sniffed the traffic:

I tried in Delphi to simply send this:

```<code>clientinitiv alpha=5KPOgZDgbleuNw== omega=MEwDAgcAAgEgAiBHsn4CYlt90fs0G1sEnx0nmGPfQYMwegBrhzD3yKj3xAIhAKmF+INBCx3rP6FPHq5XfEQt2RFDHdan9EhyZwaziDrV ip=52.28.46.214
</code>```

as an udp packet to the server, but didn't get a response.

I hope someone can explain me how I can figure out what to send and what each packet does/contains.

Thanks!


问:
Inserting Win32 controls into MFC application
I was wondering if there's a way to insert native win32 controls(button, static, etc.) into a MFC application during runtime. I was abled to embed my dll but everytime I create a new control via CreateWindowEx it is being shown as a white box for a split second and removed instantly. Here's how I'm creating the window:</p>

```<code>HWND newButton = CreateWindowEx(NULL, "BUTTON", "New button", WS_VISIBLE | WS_CHILD, 100, 100, 150, 200, mainWnd, NULL, 0, 0);
</code>```


问:
Discovering byte array obfuscation function
I'm in the middle of reverse engineering SafeNet (formerly Rainbow) iKey 1000 USB dongle protocol, in order to create Linux driver for it. I'm using Windows as guest in virtual machine on Linux host and Wireshark to examine USB packets. The protocol is quite simple, however I'm stuck with challenge-response MD5 authentication (ikey_MD5_CHAP).

The challenge is sent do the dongle in plain text then device calculates MD5 of challenge and key stored in device and sends it back to host. However, MD5 value transmitted back in control packet seems to be obfuscated for some reason.

The example value send via USB is:

```<code>09 77 e6 be 59 44 22 bc ef 60 47 da 4f bd be 80
</code>```

when value returned by ikey_MD5_CHAP function by original software is

```<code>0a 9a 2b 26 e2 ef ef ab ed 3d 02 73 c5 11 f1 90
</code>```

My goal is to discover the transformation function. There's great possibility that it consists of some XORs and additions since something similar was used in security officer password obfuscation as described in  http://www.securityfocus.com/advisories/2440. I noticed that first byte is always incremented by one in all hashes that I had generated.

Since I'm reverse engineering newbie I'm asking for directions which should I follow to discover the transformation function. I can generate as many hashes as needed.


问:
Sending image to Epson wireless Projector (SOLVED!)
I have an Epson Ex5220 that doesn't have a linux driver and have been trying to work out communication through wifi. I can connect and send images captured through packet traces from a Windows machine with a driver but cannot create an acceptable image. Here is where the problem lies:

In the data send, a jpeg image is sent with a header attached like this.

```<code>00:00:00:01:00:00:00:00:02:70:01:a0:00:00:00:07:90:80:85:00

00:00:00:04 - Number of jpeg images being sent (only the first header)
00:00 - X offset
00:00 - Y offset
02:70 - Width of Jpeg image (624 in this case)
01:a0 - Height of Jpeg image (416 in this case)
00:00:00:07:90 - Unknown (I believe it's a version number perhaps)
80:85:00 - (What I'm after) Some count of data units?
</code>```

Following the header is a normal jpeg image. If I strip off that header, I can view the image. Here is a screen shot of a partial capture with the 3 bytes highlighted:

I have found what seems to be a base line by setting those last three bytes to 80:85:00. Anything less and the image will not project. Also the smallest image size I can send to the projector is a 3w x 1h which correlates with my first two images show below.

Here are some examples:

1a - All white (RGB565) image 1024x768 - filesize 12915 - 4 blocks

2a - Color (RGB565) image 1024x768 - filesize 58577 - only 3 blocks

I then changed the 3 bytes to 00:b5:80 (incremented the middle one by 0x30)

1b - All white (RGB565) image 1024x768 - filesize 12915 - 22 full rows and 4 blocks.

2b - Color (RGB565) image 1024x768 - filesize 58577 - 7 rows and 22 blocks.

So it seems that the 3 bytes have something to do with data units. I've read lots of stuff about jpeg and am still digesting much of it but I think if I knew what was required to calculate data units, I'd find my mystery 3 bytes.

ADDITIONAL INFO:

The projector only supports the use of RGB565 jpeg images inside the data send.

SOLUTION!!!!!

I was able to solve this, but I would like to know why this works. Here is the formula for those last 3 bytes:

```<code>int iSize = bImage.length;
baHeader[17] = (byte) ((iSize) | 0x80);
baHeader[18] =  (byte) ((iSize >> 7) | 0x80);
baHeader[19] = (byte) ((iSize >> 14));
</code>```

I got fed up with messing with it and just look at several images, wrote down all the file sizes and the magic bytes, converted everything to binary and hammered away at ANDing ORing bitshifting until I forced a formula that worked. I would like to know if this is related to calculating jpeg data units. I'm still researching Jpeg but it's not simple stuff!


问:
Does anybody knows a good dataset for malware families?
Does anybody knows a good dataset for malware families?
What i need is a dataset where malware are already classified in families.
And is not duplicate of "Where can I, as an individual, get malware samples to analyze?"
What i want is the malware samples plus their classification. This means n malware which are the same variant.</p>


Title: Reversing a serial communication with two inputs

Body:
I'm making a device that needs me to transfer some sort of initiation code like handshaking to start further communications.
There is 2 inputs and 2 outputs the first output is pretty similar to a two's compliment which only works on even numbers and copy the value into the odd numbers.

But the second output is more complicated it is a combination of the first input and the second one and if the second input is 0 the second output is equal to the first output, let's see some examples:

```<code>Input 1          Output 1                  Input 2           Output 2

0- 00000000      1- 00000001     ------    8- 00001000      33- 00100001
1- 00000001      5- 00000101     ------    8- 00001000      37- 00100101
2- 00000010      5- 00000101     ------    8- 00001000      37- 00100101
3- 00000011      9- 00001001     ------    8- 00001000      57- 00111001
4- 00000100      9- 00001001     ------    8- 00001000      57- 00111001
5- 00000101      21- 00010101     ------    8- 00001000      53- 00110101
6- 00000110      21- 00010101     ------    8- 00001000      53- 00110101
7- 00000111      17- 00010001     ------    8- 00001000      49- 00110001
8- 00001000      17- 00010001     ------    8- 00001000      73- 01001001
9- 00001001      21- 00010101     ------    8- 00001000      77- 01001101
</code>```

This was the outputs for input 2 equal 8

```<code>Input 1           Output 1                    Input 2           Output 2

25- 00011001      85- 01010101   ------      31- 00011111      248- 11111000
26- 00011010      85- 01010101     ------    31- 00011111      245- 11110101
27- 00011011      73- 01001001     ------    31- 00011111      242- 11110010
28- 00011100      73- 01001001     ------    31- 00011111      239- 11101111
29- 00011101      69- 01000101     ------    31- 00011111      236- 11101100
30- 00011110      69- 01000101     ------    31- 00011111      233- 11101001
31- 00011111      65- 01000001     ------    31- 00011111      230- 11100110
32- 00100000      65- 01000001     ------    31- 00011111      195- 11000011
33- 00100001      69- 01000101     ------    31- 00011111      192- 11000000
34- 00100010      69- 01000101     ------    31- 00011111      61- 00111101
35- 00100011      73- 01001001     ------    31- 00011111      58- 00111010
36- 00100100      73- 01001001     ------    31- 00011111      55- 00110111
</code>```

Here also you can find some different inputs and outputs while holding one input constant and the others change:

Input2=16,

Input 2=5,

Input 1=2, link: pastebin.com/k5D5J1d5

Any help on a way to find the protocol for the outputs or the formula between them would be highly appreciated.

Thanks in advance.


问:
How to pass Obfuscated Elf binary to gcc optimization end
Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be  obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize it ?</p>


问:
To write a Python file to return a JSON represented list
I need to write a script that uses the r2pipe API to call the radare2 instance, analyze notepad.exe, and have it return a JSON-represented list of each function in the binary along with its virtual address. I used the link below for help, but I still can't figure out how to do it.
I have installed r2pipe bindings and radare2.
 My python file looks somewhat like this,

```<code>import r2pipe
import json

r2 = r2pipe.open("/bin/ls")
x=(r2.cmd("pd 10"))
json.dumps(x)
</code>```

Links i used to understand,

https://github.com/radare/radare2/wiki/R2PipeAPI

https://github.com/pwntester/cheatsheets/blob/master/radare2.md


问:
What does this enum mean (IDA Pro)?
Trying to teach myself how to use IDA Pro, and I'm stuck trying to understand this enum:

```<code>enum Input::Action, copyof_42, bitfield
</code>```

Local type 42 is defined as:

```<code>typedef ChunkStatus::Enum
</code>```

who's enum is:

```<code>enum {Nothing = 0x0,
      CustomTiles = 0xA,
      BasicTiles = 0x14,
      CorrectedTiles = 0x1E,
      Tiles = 0x28,
      Entities = 0x32,}
</code>```

I know the Input::Action enum has values at least from 0 to 90.

Here's my questions:

What do the commas in the first statement mean?
Can I put a limit on the range of values that Input::Action can take?
I've loaded the PDB file, and have gotten the name of enum members for some of the other enums. Can I get names for the members of this enum?

Title: What does this enum mean (IDA Pro)?


问:
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.

But the control flow graph and references to system call of those template functions should be almost the same.

So is there a good and reliable way to identify and recognize these STL classes ?

Note: some classes using template like std::string is fixed. These classes can be recognized by FLAIR (Fast Library Acquisition for Identification and Recognition).


问:
Reverse Engineering 2 byte checksum on RFID card
I am currently researching my studentcard.
Money is stored on this card.

But the vending machine also checks a checksum on the card.
I already did a lot of effort to find it but didn't succeed.

The information:

Studentcard layout:

Some transaction with the card. Only these values change on the card.

(Unknown value(pink) is the checksum)

I did some testing with changing the values and this what I concluded from it:

Transaction byte is used in the checksum

Money is also used in the checksum

Some unique value from the card is also used.

Thanks for any help!
Meanwhile I will keep breaking my head :)


问:
Help for unpacking software
I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked.
Can you help me please ?</p>

Title: Help for unpacking software


问:
Tracing what references a buffer in memory using Olly?
im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded so im trying to find the routine that is going to decode it, i know its possible since people have done it in the past and im just trying to re-create it to learn.

Anyways so i tried placing a hardware breakpoint on the buffer but it only gets hit like 3-4 times and none of them really copy the buffer or modify it in any way :/ so im wondering if im not finding all references to the buffer ? and how one would go about this in general.


问:
Field that is never assigned?
I am reversing a DLL insied a Unity game with .NET Reflector, and I found some weird fields.
They are never assinged, there was no item under the Assigned by while there were some items under the Used by.

How is this explained?

Reflection?
Native side assign?

Title: Field that is never assigned?


问:
Mutable parts of PE files in memory
I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, when they are loaded into memory?

My overall goal is to understand, what a normalization process of memory dumps of specific processes could look like (as mentioned here for example).

My understanding so far:

Sections getting mapped to different locations

Sections get page-aligned

IAT gets updated

Base relocations are performed

Did I miss anything?

Title: Mutable parts of PE files in memory


问:
IDA LoadLibraryError
I installed IDA Demo today, however I'm having a bit of trouble installing plugins. I'm trying to install a plugin called 'ClassInformer'. I followed all the instructions, editing the plugins.cfg file, copying the files to the plugin folder. However when I boot up IDA it gives me these errors:

```<code>LoadLibrary(C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW) error: The specified module could not be found.
C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW: can't load file

LoadLibrary(C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW) error: The specified module could not be found.
C:\Program Files (x86)\IDA Demo 6.9\plugins\IDA_ClassInformer_PlugIn.pLW: can't load file
</code>```

However the files are in the correct folder so I don't know why they can't be found. Here's a picture of the children of the folder.

Folder Children

Title: IDA LoadLibraryError


问:
Modification of existing binary firmware update
I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload into camera using camera's Web interface. I decide to use special binary.

Ok, I'd download this binary from here. The binary successfully uploaded into camera and I decide to watch inside it. I use binwalk program. binwalk tell me next:

```<code>[arhichief@arhichief-pc updates]$ binwalk di20_fl_03.upw

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
152           0x98            uImage header, header size: 64 bytes, header CRC: 0x863E2566, created: 2014-08-01 04:16:33, image size: 3091196 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x3B8FC9B, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
16243         0x3F73          gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
3091412       0x2F2BD4        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 7403482 bytes, 24 inodes, blocksize: 262144 bytes, created: 2015-05-10 02:32:07
</code>```

The file command told me, what it is a binary image of ROM:

```<code>[arhichief@arhichief-pc updates]$ file di20_fl_03.upw
di20_fl_03.upw: UNIF v-740431636 format NES ROM image
</code>```

After extracting the parts of binary, I found that data after 0x2F2BD4 is an image of the storage with additional software and bash script to run it. Looks like, I found the way how to insert my software into camera.

Using dd, I get this part of binary, extract it, add my programs, pack it back and write back into binary file.

```<code>[arhichief@arhichief-pc updates]$ dd conv=notrunc bs=1 if=di20_fl_03.upw skip=3091412 count=7403482 of=fs.sqhsfs
7403482+0 records in
7403482+0 records out
7403482 bytes (7.4 MB, 7.1 MiB) copied, 8.7586 s, 845 kB/s

[arhichief@arhichief-pc updates]$ unsquashfs fs.sqhsfs
Parallel unsquashfs: Using 4 processors
23 inodes (72 blocks) to write

[=================================================================================================================================================================================================================================================================|] 72/72 100%

created 23 files
created 1 directories
created 0 symlinks
created 0 devices
created 0 fifos
[arhichief@arhichief-pc updates]$ cd squashfs-root/
[arhichief@arhichief-pc squashfs-root]$ dd if=/dev/random bs=1 of=TEST.FILE count=1258291
^C234+0 records in
234+0 records out
234 bytes copied, 28.535 s, 0.0 kB/s

[arhichief@arhichief-pc updates]$ mksquashfs squashfs-root/ fs.sqhsfs -comp xz -Xdict-size 100% -b 262144
Parallel mksquashfs: Using 4 processors
Creating 4.0 filesystem on fs.sqhsfs, block size 262144.
[=================================================================================================================================================================================================================================================================|] 78/78 100%

Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
    compressed data, compressed metadata, compressed fragments, compressed xattrs
    duplicates are removed
Filesystem size 8529.98 Kbytes (8.33 Mbytes)
    56.79% of uncompressed filesystem size (15020.30 Kbytes)
Inode table size 494 bytes (0.48 Kbytes)
    47.23% of uncompressed inode table size (1046 bytes)
Directory table size 374 bytes (0.37 Kbytes)
    87.59% of uncompressed directory table size (427 bytes)
Number of duplicate files found 0
Number of inodes 25
Number of files 24
Number of fragments 3
Number of symbolic links  0
Number of device nodes 0
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 1
Number of ids (unique uids + gids) 2
Number of uids 1
    arhichief (1000)
Number of gids 1
    users (100)

[arhichief@arhichief-pc updates]$ dd if=fs.sqhsfs of=di20_fl_03_new.upw conv=notrunc bs=1 seek=3091412
8736768+0 records in
8736768+0 records out
8736768 bytes (8.7 MB, 8.3 MiB) copied, 8.81158 s, 992 kB/s
</code>```

After what I match new firmware update binary with binwalk to make sure, everything is ok.

```<code>[arhichief@arhichief-pc updates]$ binwalk di20_fl_03_new.upw

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
152           0x98            uImage header, header size: 64 bytes, header CRC: 0x863E2566, created: 2014-08-01 04:16:33, image size: 3091196 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x3B8FC9B, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.0.8"
16243         0x3F73          gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
3091412       0x2F2BD4        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8734702 bytes, 25 inodes, blocksize: 262144 bytes, created: 2016-06-06 07:46:09
</code>```

I try to upload new firmware update binary into the camera, but camera return me an error.

Ok. I'd try to search for some solutions and found this. From answers in that thread I get a python script what extract firmware and shows the checksums of firmware parts. Good. This script show me next:

```<code>[arhichief@arhichief-pc updates]$ python2 extract_hikvision_dav_file.py di20_fl_03.upw
Magic number:    5a4b5356
Header checksum: 0000223a
Header length:   00000098
File number:     00000002
Language:        00000001
Device class:    00000002
Calced checksum: 0000223a
75496d6167650000000000000000000000000000000000000000000000000000980000003c2b2f001d4e7b18
File name:          uImage
Start:              00000098
Length:             002f2b3c
Checksum:           187b4e1d
Calced checksum:    187b4e1d
6170702e696d6700000000000000000000000000000000000000000000000000d42b2f00000071003d7de138
File name:          app.img
Start:              002f2bd4
Length:             00710000
Checksum:           38e17d3d
Calced checksum:    38e17d3d

[arhichief@arhichief-pc updates]$ python2 extract_hikvision_dav_file.py di20_fl_03_new.upw
Magic number:    5a4b5356
Header checksum: 0000223a
Header length:   00000098
File number:     00000002
Language:        00000001
Device class:    00000002
Calced checksum: 0000223a
75496d6167650000000000000000000000000000000000000000000000000000980000003c2b2f001d4e7b18
File name:          uImage
Start:              00000098
Length:             002f2b3c
Checksum:           187b4e1d
Calced checksum:    187b4e1d
6170702e696d6700000000000000000000000000000000000000000000000000d42b2f00000071003d7de138
File name:          app.img
Start:              002f2bd4
Length:             00710000
Checksum:           38e17d3d
Calced checksum:    38754ea4
</code>```

I found that checksums in default and updated firmwares are mismatch. I have some experience in C, so, I decide to rewrite python script in C and modify it so it will correct checksums. Here is my code. So, It works well, I think. The results of python script and my code are same after my code patch checksums. But when I try to upload firmware with corrected checksums into camera, it still return error.

I don't know what I shall do next, and I think you will give me some advices.

Thanks in advance.

P.S. Please, sorry for long question. I think you will need to know all my steps to give me correct answer. I think I've made an error some there in it.


问:
How to get to daemon source?
I'm performing static analysis on system framework code, and some of the interesting ones seem to be talking to daemons via sockets. How do I get to the source of the daemons to see what they do with the data being sent over? I suppose these are C code rather than java? Do the binaries reside as ELF binaries somewhere or compiled into a library? How do I figure it out?

Thanks!

Title: How to get to daemon source?


问:
Flash dump with encoded firmware
I downloaded firmware from 4MB spi flash in HDMI extender (more info here). It contains following sections:

```<code>0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting bootloader)
0x00080000 – 0x0016ee5d – SMEDIA02 …….456789ABCDEF (encoded – probably the main firmware)
0x00250000 – 0x00250200 – some zeroes with some data
0x00257e00 – FAT with webroot
0x00367e00 – FAT with config
0x003e0000 – MAC + 2 unknown bytes
</code>```

I'm interested in first two sections. The first one seems to be a bootloader and the second one the main firmware. There are some other unknown parts in the firmware which might be some kind of a key.

Can someone please help decode those first two sections?

Title: Flash dump with encoded firmware


问:
Knockoff CGA/EGA to vga firmware update
The problem with this, as I know from experience in dealing with this exact same issue is the firmware in the CGA/EGA/VGA converter board. There is an update that needs to be written to the converter board in order for the POG T340+ boards to work with them, I've had to do the exact same thing. I ordered 40 of the converter boards and then shipped them to a guy in Florida that updated the firmware in all of them to work with my POG T340+ boards. I personally don't have the cables to update the firmware in the converter boards but I think it's done using HyperTerminal in windows.

I got some(ALOT) of them Chinese CGA/EGA to VGA converter boards, unfortunately I cant get them to work with what I need. After some googling I see it as a common problem with them is a bad batch of firmware.

GBS-8200 styled board.

Im trying to take the RGBS out of a POG board

After looking through the POG manuals, I don't see any information on its sync, or clamp settings ext.

I looked through the GBS-8200 it says there is a i2c isp header for updating the firmware, but no relevant links on where to get it or how to put it on.

I think either the settings or wrong, or that the boards don't have working firmware. I bought a couple to see if it was a device problem, but dosent seem to be.

Iv tested the POG board using my friends CGA compatible CRT and it comes up just fine.

I can get as far as soldering the pins to the I2C interface for updating, but I don't know what the command is nor do I have the firmware.

I tried pulling the firmware using my MINIPRO-TL866 programmer, but there docent seem to be a setting for the mtv230mv chip.

Also, my OS is linux.

UPDATE:
After lurking Russian and Arabic hacker forums ("And being probably put on several NSA watch-lists for registering on them") I located what i believe to be the firmware. And some program to flash it with. So, Now i need to figure out how to use Postal2 ext.

Also, a friend came over and lent me his motherboard with the same chip-set, but different firmware and it worked like a charm. So that proves this can work. I also poped the chip off and used it on my board ant it worked, so its definitely firmware on the MTV230

Here is the datasheet for the MTV230 datasheet

Clarification:
How do I write/read the firmware to the MTV230 using its I2C interface?
Using a Arduino, or a USB I2C adapter on Linux.

Title: Knockoff CGA/EGA to vga firmware update


问:
How can I control a USB device if I have a driver for it, but no application?
I have a Apogee filter-wheel which is connected via USB and the driver for it.

However, as far as I could find out the device only comes with a driver but no application to control it. The filter wheels are apparently usually bundled with a camera and both are apparently meant to be controlled together via commercial 3rd party software. I don't have this 3rd party software and I also don't want to use it if I can avoid it.

My only experience with USB devices/applications/drivers was quite long ago and that device (a USB-controllable power socket) used a HID-protocol which made is quite easy to use it.

Is there a way to take a look into the driver to see what functionality it offers and how to use it? E.g. like looking at a DLL with depends.exe to find exposed functions? I found a Linux library that deals with those devices but this seems also mostly about the cameras.

Any advice how I could access the filter wheel on Windows 7? I just want to turn the filter wheel.

OwnerDisplayName: katzenversteher


问:
Is there anyway to save search results in IDA Pro?
This might be a newbie question but it really takes too long to search for certain things in IDA, when I close the app and save the database all my searches are gone and that's just frustrating.
I'm aware that I can copy and paste them all in text file but I prefer saving them in IDA itself.

Any help will be much appreciated.


问:
Decrypting Firmware File
I am by no means a hardware or software expert. But I've got a bit of a dilemma. I have on my hands an "encrypted" firmware image. I say that with air quotes because I'm not sure if it's encrypted, obfuscated, or whatever. It's an old firmware file that was written to a temporary firmware memory on a device and then executed through a bootloader of some kind. People before me have decrypted the same file; however that was about three years ago and the user who posted the decrypted file has dissappeared, along with the file. I really need the decrytped file, as well as the ability to re-encrypt it once I change some code and have it still run on the device once I've edited it. According to the user who decrypted it originally:

"The format is pretty complex, the cryptography is simple. There can be multiple files, encryption is optional, metadata is optional."

The things I know:

It is not any advanced encryption of any kind - the 1990's vintage chip had to decode it very quickly

The first few lines are plaintext

The extension is .enc

It has been decrypted in the past and is apparently fairly easy

Where should I start with this? I tried running a few of the first tools that come up in a google search and they lead me to dead ends. Basically I'd like something that doesn't require me to have a degree in CS to understand. Things would be so much easier if the user who figured out how to decrypt this originally had not fallen off the face of the earth, but we aren't so lucky.

Here's a link to the original file if you want to look

Title: Decrypting Firmware File


问:
Why can I not read .so file public functions compiled in C?
I can read the public functions (name and full signature) of some .so files that associated with Android APK, whereas others only show the function name.

For example, running this command only shows function names:

```<code>user$ /usr/local/bin/android-ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-nm -gDC libsccrypto.so
00088952 T a2d_ASN1_OBJECT
000940f4 T a2i_ASN1_ENUMERATED
00093628 T a2i_ASN1_INTEGER
000938a0 T a2i_ASN1_STRING
000a6520 T a2i_GENERAL_NAME
000a5bf6 T a2i_ipadd
000a5d1a T a2i_IPADDRESS
000a5d54 T a2i_IPADDRESS_NC
         U abort
         U accept
000a94d0 T ACCESS_DESCRIPTION_free
000f4db8 D ACCESS_DESCRIPTION_it
000a9518 T ACCESS_DESCRIPTION_new
00051124 T AES_bi_ige_encrypt
00052164 T AES_cbc_encrypt
00050d74 T AES_cfb128_encrypt
00050d9c T AES_cfb1_encrypt
00050dc4 T AES_cfb8_encrypt
00050e10 T AES_ctr128_encrypt
00051d5c T AES_decrypt
00050d5c T AES_ecb_encrypt
00051924 T AES_encrypt
00050e38 T AES_ige_encrypt
00050dec T AES_ofb128_encrypt
</code>```

Whereas this library reveals more information to include function signatures:

```<code>user$ /usr/local/bin/android-ndk/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-nm -gDC libBreakpad.so

00006a24 T google_breakpad::ExceptionHandler::HandleSignal(int, siginfo*, void*)
00006768 T google_breakpad::ExceptionHandler::SignalHandler(int, siginfo*, void*)
00007500 T google_breakpad::ExceptionHandler::WriteMinidump(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const
&, bool (*)(google_breakpad::MinidumpDescriptor const&, void*, bool), void*)
0000766c T google_breakpad::ExceptionHandler::WriteMinidump()
000077f8 T google_breakpad::ExceptionHandler::AddMappingInfo(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > cons
t&, unsigned char const*, unsigned int, unsigned int, unsigned int)
000078f4 T google_breakpad::ExceptionHandler::RegisterAppMemory(void*, unsigned int)
00007960 T google_breakpad::ExceptionHandler::UnregisterAppMemory(void*)
00005f4c T google_breakpad::ExceptionHandler::InstallHandlersLocked()
00006460 T google_breakpad::ExceptionHandler::RestoreHandlersLocked()
00006c34 T google_breakpad::ExceptionHandler::WaitForContinueSignal()
000079ac T google_breakpad::ExceptionHandler::WriteMinidumpForChild(int, int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::alloc
ator<char> > const&, bool (*)(google_breakpad::MinidumpDescriptor const&, void*, bool), void*)
00007284 T google_breakpad::ExceptionHandler::SimulateSignalDelivery(int)
00007430 T google_breakpad::ExceptionHandler::SendContinueSignalToChild()
00006d34 T google_breakpad::ExceptionHandler::DoDump(int, void const*, unsigned int)
00005bd8 T google_breakpad::ExceptionHandler::ExceptionHandler(google_breakpad::MinidumpDescriptor const&, bool (*)(void*), bool (*)(google_breakpad::M
inidumpDescriptor const&, void*, bool), void*, bool, int)
00005bd8 T google_breakpad::ExceptionHandler::ExceptionHandler(google_breakpad::MinidumpDescriptor const&, bool (*)(void*), bool (*)(google_breakpad::M
inidumpDescriptor const&, void*, bool), void*, bool, int)
00006130 T google_breakpad::ExceptionHandler::~ExceptionHandler()
00006130 T google_breakpad::ExceptionHandler::~ExceptionHandler()
00012408 T google_breakpad::MemoryMappedFile::Map(char const*, unsigned int)
00012688 T google_breakpad::MemoryMappedFile::Unmap()
000123e4 T google_breakpad::MemoryMappedFile::MemoryMappedFile(char const*, unsigned int)
000123d4 T google_breakpad::MemoryMappedFile::MemoryMappedFile()
000123e4 T google_breakpad::MemoryMappedFile::MemoryMappedFile(char const*, unsigned int)
000123d4 T google_breakpad::MemoryMappedFile::MemoryMappedFile()
00012630 T google_breakpad::MemoryMappedFile::~MemoryMappedFile()
00012630 T google_breakpad::MemoryMappedFile::~MemoryMappedFile()
0000df50 T google_breakpad::UTF32ToUTF16Char(wchar_t, unsigned short*)
00010a24 T google_breakpad::LinuxPtraceDumper::ThreadsResume()
</code>```

I thought function signatures had to be in the dynamic table of the .so file or else it would throw a linker error. Also, is there a good references to tell me how to read the dynamic symbol table?


问:
Ignore Path and Extension in OllyDBG 2?
I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a new exe because of the change in directory, so it creates a new udd file.

After a bunch of searching i see that Olly v1 has an option "Debugging options -> Security -> Ignore path and extension" but i don't see this in Olly v2. Per http://ollydbg.de/version2.html, the ability to do this has been present since OllyDbg 2.01 alpha 3:

Option to load .udd information even when path, file name or file checksum is different.

does anyone know how to do this?

Title: Ignore Path and Extension in OllyDBG 2?


问:
IDA Pro .til files backward compatibility
I read in the IDA Pro Book that

you may use till.exe to parse header files and create standalone .til
  files which can be made globally available by copying them into
  <IDADIR>/til.
  This is all well and good when you happen to have access to source code that you then allow IDA (or till.exe) to parse.

Now I was wondering what would happen if the header file is from a library version older than the one used by the target binary (or vice versa). The closest I could find was this SO answer:

If the ABI in the exported functions don't change you should be able
  to get away with using an older DLL with a program linked against a
  newer .lib, as long as the program isn't using a new export that are
  in the new .lib but not in the older DLL.

Things which affect the ABI (I'm not claiming this is a comprehensive
  list):

calling convention

export name

parameter list (including types)

Does anyone have experience with using .til files although the version does not exactly match? In the best case, I guess, the .til file should work fine. But what could happen in the worst case, i.e. if any of the above mentioned three things change?

Is there any chance I can detect when the application of a slightly wrong .til file causes problems?


问:
Extracting information from a windows executable
I've been given the task of writing a functional clone for an executable since we don't have the source code.

None of the .NET tools at my disposable recognise it and loading the thing into a text editor, I see the telltale:

```<code>MZ...This program cannot be run in DOS mode.
</code>```

Further down I see:

```<code>Microsoft Visual C++ Runtime Library
</code>```

And further on still:

```<code>MultiByteToWideChar
</code>```

Leading me to conclude it is a C/C++ executable. So far so good.

Without wasting days trying to find a disassembler, is there anything that could help me glean any further information from this type of executable? I already know about Sysinternals Strings application. I've also found something that can dump the assembly code (for all the good this does me!).

OwnerDisplayName: Robbie Dee


问:
Patch is detected yet hardware access breakpoint isn't hit
I wonder how is that possible.

I found debugger detection in TLS Callback function - there is conditional jump after some check.

When I step over it with debugger and modify ZF flag to bypass detection everything works fine. But when I try to patch this jump to the opposite (jne to je) application freezes and bombards me with OutputDebugString.

I don't save patch to the file, I patch it while process is in memory.

I was interested how this patch is detected, so I set Hardware Access Breakpoints on bytes that I patched, and then run it. Breakpoints weren't hit, and yet application changed it behavior just like it always do when I patch.

Notice that difference in code flow have nothing to do with this detection since when I modify ZF flag application works fine.

So I am very baffled, how does this application detects that patch, when it doesn't apparently access memory that I patched? Or is Hardware Access Breakpoint imperfect? I am interested in general ideas, how would you go about detecting whether your code was patched or not, without hitting hardware breakpoints.


问:
Reassemble function that has its control flow chopped so that it can be decompiled by IDA
I try to decompile a function that is obfuscated by having split
up the controlflow into asmblocks scattered around the .text section
and connected by "jmpq" jumps.

```<code><func1>:
0:    insn..
1:    jmpq xx100
2:    callq sub
3:    jmpq  xx104
...
<nonfunc>:
..
xx100: insn...
xx101: jmpq 2
..
xx104: insn
...
</code>```

Is there a tool/plugin that can reassemble the function code by following the jmpq blocks and appending the chunks? I guess it is not that
trivial because you also have to account for relative offsets and patch
relocation sections, etc. .


问:
IDA pseudocode: [var*size+ var + offset] to [structure pointer] format
I'm trying to get the hang of IDA and I try to reverse engineer some code with a similar code [not 100% the same] to help me, I'm just using it to check.

The problem is that I came accros this issue:

How could I convert this into a friendlier pointer format ?
This blocks me because this is not using the classic BASE+OFFSET format plus it's using two variables...

Thank you for your help.


问:
program terminates right after opening in ollydbg
So here's the thing, a few years ago I bought 2 games from a Russian site, sketchy I know, but they worked really well, I was instructed to protect the files with Themida as this was used in a gaming hall and files could be passed around freely.

I made a backup of the original files but disk got damaged and I can't find the USB flash drive. Basically the first games exe is protected with Armadillo 8.2. No problem, I memorized the name and password, but it has a .dll protected with Themida 2.0.3 and Xtreme-protector v1.08... Second one is protected with same version of Themida and Aspack 2.12.

I'm new to the unpacking scene so any help would be appreciated. I've tried loading it on olly with phantom, strong od, scyllaHide and odgbscript, used the script of LCF-AT with success by loading the .dll only, checked the dumped file only to find out its the same thing with same protection but bigger size on it, after doing like 14 hours of research I saw you have to mount it and run the script to be successful.

Now the problem is as soon as I mount it (f9) it terminates itself and I can't do anything else, I can load the dll and it pauses but as soon as I run f9 it terminates, the if I load the exe it terminates instantly. Any help would be appreciated, or if anyone is willing to take a look at it I'll be grateful.


问:
Ducky Mini Firmware Hacking
This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other keyboards based on the same or similar chips have had their firmware successfully modified, such as a Quickfire Rapid playing snake.

Using the link above as a guide (albeit a crude one - the article was written as more of a general process than a guide to firmware hacking these keyboards,) I've started work on creating CFW for the Ducky Mini (which will hopefully work later on any Holtek32-based keyboards such as the Poker 2 and Pok3r.)

My progress so far: I've successfully isolated the firmware from an executable updater released by Ducky, and accomplished XOR decryption to scrambled and partially encrypted assembly code. From what's disassemblable, I believe I've found and fixed the small bit of assembly that prevents reading flash data over USB past 0x2C00 (the keyboard firmware version is held in a memory region between 0x2800 and 0x2C00 for simplicity,) something similar to the Quickfire Rapid. I'm far from an expert at ARM assembly, and following segmented code in IDA is a pain, but I'm pretty sure the small changes I made were correct.

Where I'm stuck: The author of the article above mentions writing a small program using libusb to dump the unencrypted firmware directly from the keyboard. Unfortunately, I have absolutely none of the knowledge of libusb or USB protocols needed to accomplish this step. Thus, I can't even confirm that the changes to the firmware I've made make the flash readable past 0x2C00, let alone allow me to dump the firmware. Can someone interested and experienced help here?

Title: Ducky Mini Firmware Hacking


问:
When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?
I'm  on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate.  I allocate a chunk of memory for a stack.  I load a library to memory and determine an entry point to the library.  I write the library to my code buffer using vm_write, no problems there.

I setup the registers and call thread_create_running and run remote thread into another process.

Over in the other process the thread starts.  I'm using lldb and have it setup so when my thread starts it breaks on that entry point  I see my code.  I step through the code.

However it crashes when it tries to do the _pthread_set_self.  If I step into pthread_set_self, it crashes in
_pthread_mutex_lock at the following instruction:

```<code>movq %gs:0x0, %rax
</code>```

(Note: gs is 0x00000000 prior to the instruction where the crash occurs)

It's my understanding this instruction is an operation to retrieve the first segment of gs from a thread segment structure and move it into the rax register.

My question is what do I need to do to prevent the crash that ensues upon execution of this instruction?  Upon execution of this instruction I see EXC_BAD_ACCESS in pthread_mutex_lock.

I tried putting in the code to pthread_mutex_init, followed by pthread_mutex_lock then pthread_set_self.  However when it hits the first pthread_mutex_lock, i get the same issue.  It dies at the same spot.

Any ideas?

My target app to which i don't have source code, is multi-threaded.


问:
Trace replayer won't load binary debug information
So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function breakpoint plus I can set source breakpoints and my source lines are followed.

However recently I got a segfault at some-point with my application. I decided to use the trace debugger to help me better understand what exactly happened there and I recorded the part where I think the program crashes. But surprise, surprise the Trace debugger won't switch and follow my source files and no binary debug information is present for it. Any help will be appreciated - I have no intention to try decompiling or matching my own source code.

I got ida 6.8 btw.

Trying to load the < replay > debug symbols I get some error like this:

DWARF: Cannot determine location of DWARF info for "< replay >".


问:
rebuilding a java application
I wish to rebuild MotiveWave, a charting tool, from its jars. This application has a feature (probably in one of the class files but I don't know which) that i want to build upon. I mean I want to inherit that class and use it in another custom class. The jars are without the source code. I have tried jd to view the source of jars and was able to view some of the code. What I want is to build and run it in debug and then access that specific feature using the UI to see which code gets triggered.
Is this possible/ Can anybody point me to the right direction as I am totally lost right now.</p>

Title: rebuilding a java application


问:
Plugin directory in IDA?
According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there & restart IDA, IDA still do not see that.

What can go wrong, and how can I debug this issue?

Thanks.

Title: Plugin directory in IDA?


问:
OllyDbg step over command not behaving exactly as the Immunity Debugger
I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching.

In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until it reaches the end of code.

However, it seems my OllyDbg is not behaving as expected for such command (and file) as once clicked the step over command it runs all the commands in a row without breaking.

Anyway, Immunity Debugger executes the step over command steadily for the same file.

So, what is the possible problem I am facing?

I am using the Lena's Ollydbg configuration file provided with the tutorial and its version is 1.10 running on a Windows 10 virtual machine.


问:
Immunity Debugger Unable to set Breakpoint
I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.

The first error is that Immunity is 'Unable to set a breakpoint' this is set to the default WinMain function.

The second is that Immunity is 'Unable to write back modified registers'.

I originally suspected that there may have been some Anti-Debug tactics involved however have come to realise that is not the case after implementing some plugins that circumvent that type of protection.

Scratching my head here as i cant seem to find anyone with the same issue as me.

Any help would be greatly appreciated!


问:
How to patch object file in static library / how to extract object file that has full path within archive
I am trying to extract an object file (.obj) from a Windows static (.lib) library so I can patch it in IDA, then rearchive it back into the library.  I am doing this because IDA won't allow me to patch a static library containing multiple object files.

I am trying to use the ar that comes with mingw.  The file I am looking to extract has a full path (e.g. "E:/some/path/to/filename.obj" - the forward slashes are correct).  I can see this file as listed when I run ar -t library.lib.  However, when I run ar -x library.lib E:/some/path/to/filename.obj I get an error "no entry E:/some/path/to/filename.obj in archive".

What am I doing wrong please?   Or can I apply a patch to an object file within a static library using IDA directly?