Hot answers tagged

36

I'll answer this in two parts, #1 is relatively easy, #2 impossible to the level which I'm assuming you want. 1. Extracting the hex code from the Uno: While the specifics will depend on the revision of the Uno that you have, you'll want to use avrdude (available for linux, bundled with the OS X Arduino software) and a command similar to the following that ...


14

So, in which language, instruction set or machine code is it written? It's written in a language that can be compiled to machine code that can be executed by the processor (the CPU). Typically, it's a combination of C and assembly language. Doesn't it need any kind of processor to perform its operations? Yes, the processor is what runs the BIOS code. ...


8

As the names in /proc/mtd suggest, mtd0 is probably not a file system, but more likely is the boot loader. Likewise, the name of mtd3 suggests that it contains the saved configuration settings (admin password, wireless settings etc). The "flags" and "main" names for mtd1 and mtd2 respectively are a bit ambiguous, but I would expect, due to the name and the ...


7

VirtualQueryEx() can be used to scan through the user-mode address space of a process to enumerate each memory allocation, and PE headers of images in memory can be parsed to determine which memory blocks are associated with which PE sections. PE headers for DLLs also contain the DLLs' names.


6

In the paper Heart of Darkness - exploring the uncharted backwaters of HID iCLASS TM security is a technique described (section III.C) that might work,but it does require a working device which might not be at hand in your situation. In short they use a TTL-232 cable in synchronous bit bang mode to emulate the PIC programmer. They then override the boot ...


5

Try IczDump -- it works by injecting itself as a DLL into the target process and dumping the target process's memory from within the process itself.


5

But how does knowing OEP relate to IAT? OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer. When application is unpacked in memory, can't we get pointer to IAT just by walking through PE header This is exactly why import reconstruction is needed. Because the ...


4

If your binary is allocating a new memory page & writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new binary into IDA will indeed show you those new parts. The data has to come from somewhere though (ressource, compressed, encrypted, another file, Internet, etc). ...


4

You have picked a particularly hard target to try and find JTAG on, if this is your first project. There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so you can't trace the pins from there. Same with the flash. It is almost certainly a multi-layer board as well. So there are a number of options: It may never ...


4

I'm not sure how much trouble you'd be willing to go through, but I'd suggest taking a full memory dump with something like DumpIt and use Volatitlitys' "procmemdump" command to pull the running process.


4

Yes it is possible in a very large variety of ways, depending on OS, user privileges and user abilities. In some cases you even should not break - it is enough to get memory dump of the process with tools such as procdump from sysinternals package.XML data has very easy detectable structure and can be easily found in the dump. Update by 3/27/2017: This ...


4

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed. Easiest solution is to disable ASLR and then unpack. If you want to disable ASLR on the packed executable, edit the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag of the DLL ...


3

question is very vague only proper answer that this question can get is it depends assuming your program does some like this int main(void) { FILE *fp; long fsiz; char *buff; if((fopen_s(&fp,"c:\\myxml.xml","rb")) == 0) { fseek(fp,0,SEEK_END); fsiz = ftell(fp); fseek(fp,0,SEEK_SET); if ( (buff = (char *)...


3

the lack of icon is merely due to the unpacked executable not having a correct resource DataDirectory. does the dumped executable actually run (under a debugger)? You might want to try QuickUnpack or Deroko's Dream of every reverser.


3

It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong. Instead of mounting it maybe try just extracting the files from the image, e.g. using this script.


3

I think there is something mixed up here. But how does knowing OEP relate to IAT? It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware tries to hide its imports my not using the official IAT, but by creating their own at runtime. The Tools should help you to reconstruction somewhat of a 'normal' ...


3

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out the initial "Start to decompress!" message at PC 0x80001e38. Hopefully that should get you started.


3

Looks like Wiko use Android as OS [based on http://www.wikogeek.com/], so Android tricks should work here as well. If you need access to SoC on RDA8851CL in more "user-friendly" way, try to connect to it with adb: For Windows: http://kernel.wikomobile.com/WIKO_Android_USB_Driver.zip For Linux: Follow the following manual from XDA: https://forum.xda-...


3

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with references to flags and code (q=quiet) Example: > px [nBytes] @[address][offset] "Print hex 10 bytes at rbp plus 10" [0x5618eccbf77a]> px 10 @rbp+10 > ...


2

On windows for an arduino nano, you do this: cd "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin" followed by this: "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude" -F "-CC:\Program Files (x86)\Arduino\hardware\tools\avr/etc/avrdude.conf" -v -v -patmega328p -carduino -PCOM14 -b57600 -D-Uflash:r:c:\keep\program.bin:r Here's the output ...


2

.Net files store their resources in the COM Data Directory substructures. I did several resources that might help you to understand, such as a hand-made .Net file, and a poster that covers the basic of Net data structures. Otherwise, you should definitely look at your binary in PE insider (the successor of CFF Explorer, same author), and check the author's ...


2

You should try using .writemem For example: .writemem c:\www.exe 0x400000 0xE3000 where 0x400000 is the main executable's image base. Extract it from pEPROCESS->SectionBaseAddress, 0xE3000 is SizeOfImage as in PE header, and c:\www.exe is the output file.


2

Mark Russinovich's SysInternals suite contains a utility named VMMap, which can be used to view the memory layout of a process and/or dump the information in various formats. As Brendan mentioned, an answer in /proc/self/maps equivalent on Windows shows how to obtain the information via calls to VirtualQueryEx(). So you could easily whip up your own ...


2

Malware can be removing/manipulating its own PE Header. void destroyPEHeaders(){ DWORD OldProtect = 0; char *pBaseAddr = (char*)GetModuleHandle(NULL); VirtualProtect(pBaseAddr, 4096, PAGE_READWRITE, &OldProtect); srand(time(NULL)); ZeroMemory(pBaseAddr, 4096); srand(time(NULL)); for (...


2

The malware could destroy its PE Headers at runtime so you might want to look for a tool that is capable of handling those cases. Scylla should do the job.


2

First, you will need to make a map of every pins on the PCB, you will find a good starter here. Once done, what I propose is to use a JTAG discovery tool. You can find some like this one or this one . It just need an Arduino and cables. These tools are usefull to find JTAG pinout, but be careful to use a 5V to 3.3V adaptor as most JTAG are 3.3V compliant, ...


2

If possible, please try to dump modules together. If that is not possible, load any of them in IDA and go to File -> Load file -> Additional binary file to load each file one after another. After selecting the file, IDA will display the following dialog: Here you have to make sure that each part is loaded at the right offset.


2

First Step: Research First off just do some research on your product. See if anyone has done any research or reverse engineering on your particular keyboard model. If no one has done any work on it before you will have to venture off on your own. Second Step: Disassembly You will probably need to open up the keyboard if the developers didn't include some ...


2

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever ) the code below is rubbish hack you may need to declare proper managed types etc to make it robust it is just to show an idea $procid = (Get-Process -Name $args[0]).Id $baseaddr = (Get-Process -Name $args[0] -Module)[0]....


2

Just set a breakpoint in 0x00ef674c. Press F9. When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file. Just make sure that the EIP is the OEP.


Only top voted, non community-wiki answers of a minimum length are eligible