Lowyat.NET: Latest topics by Tullamarine

How does C/C++ store integer in binary file?

Tullamarine — Wed, 24 May 2023 08:07:53 +0800

The C code writes two integer to a binary file called "integer.bin".

CODE

#include <stdio.h>

int main()
{
int i;
int j;
FILE *fptr;

fptr = fopen("C:\\Users\\BOO\\Projects\\integer.bin","wb");
i=0x1234;
j=0x12345678;
putw(i,fptr);
putw(j,fptr);
fclose(fptr);

return 0;
}

I use format-hex cmd-let in PowerShell to hexdump the 8-byte "integer.bin".

The results is quite awkward, for 0x1234, it is " 34 12 00 00", but for 0x12345678, the "34 12" is not on the left-hand size, it is becoming as "78 56 34 12"..... No wonder I pening, pening kepala when doing my disassembler (passing the 32-bit integer as 64-bit parameter).

Can someone know explain? Are you also new to this?

By the way, there is no way to save integer to file in Python, either text or byte mode only, means have to convert number to string then save to file, in Python.

Tabiat Tidur Yang Baik

Tullamarine — Tue, 09 May 2023 18:16:19 +0800

I took it from local hospital, and scan it myself.

Sorry, didn't notice whether got English version of the leaflet.

You have to zoom it to see the text. Too long for me to type.

A salted egg without yolk

Tullamarine — Fri, 05 May 2023 14:51:16 +0800

Is this edible? Looks strange!

Using IDA Free - Part 2

Tullamarine — Fri, 28 Apr 2023 04:57:39 +0800

Hi, it's me again! Upon encouragement by @KLKS and @junyian in last series, I am keen to explore more in IDA Freeware.

Today I will use a more complex executable, created using Visual C++, I call it "lyn.exe".

This is the output by running "lyn.exe" in command prompt window:

Select "lyn.exe" as the file to disassemble.

Click OK to confirm the default setting. (Doesn't load resource)

Voila, this is the main window.

As compared with last time, this time got many function stubs.
The disassembled code is: (I can't paste complete code because forum blocked it)

And this is my original C++ code.

The Win32 API GetTickCount function is to "retrieves the number of milliseconds that have elapsed since the system was started, up to 49.7 days."
https://learn.microsoft.com/en-us/windows/w...pi-gettickcount

"lyn.exe" is a 64-bit portable executable, as seen from the register used (with r prefix), and the stack alignment.

I highlight a "call cs:GetTickCount" instruction in IDA View:

And get a corresponding hex bytes in Hex View:

Actually if scroll up a little bit the main window, I can see the summary of the executable:
(snipped because forum blocked it)

There is more to explore, like if I click "pre_c_initialization" function stub, this floating window appears:
https://pictr.com/images/2023/04/28/E4E7hv.png
Of course I have no clue what it does...

Now if I right-click the window, this pop-up menu appears:

This brings me to another window:
https://pictr.com/images/2023/04/28/E4EaqD.png

Can confirm "lyn.exe" has dependency on MSVCP140.dll.

Not just MSVCP140.dll, also dependency on VCRUNTIME140.DLL, and KERNEL32.DLL (Of course).

And many more...
; Imports from api-ms-win-crt-math-l1-1-0.dll
; Imports from api-ms-win-crt-runtime-l1-1-0.dll
...
...

Finally, the Debugger menu and Options menu... (snipped because forum doesn't allow images more than these)
https://pictr.com/images/2023/04/28/E4Eru6.png
https://pictr.com/images/2023/04/28/E4ENXq.png

IDA Free is too powerful, there are many features I don't know yet how to use.
I think it is quite difficult to trace a C++ program, because it has so many function stubs.

Can you tell what are they?

Tullamarine — Tue, 25 Apr 2023 01:07:20 +0800

These are converted using my console apps, if you are interested in the command-line program, I can share the link.

Now can you tell what are they? The output in the right.

First time using IDA Free!

Tullamarine — Sat, 01 Apr 2023 04:28:37 +0800

Finally! After so many years digging with x86 and x64 Assembly, finally I have started my journey in Disassembly, or reverse-engineering, by first exploring IDA Free!

IDA Free: https://hex-rays.com/ida-free/#download

While there is IDA Pro which supports 68 families of processors and over Over 45 file formats (and for commercial use), I found that (also suggested by others) IDA Free is enough for personal use, as it supports x86/x64 processors, and the well known PE, ELF, Mach-O file formats.

In case you miss my previous "First time using WinDbg" topic, you can visit:
https://forum.lowyat.net/topic/5348191

As pointed out by @junyian, WinDbg is debugger while IDA Free is disassembler.

Let's start disassembling my own msgbox.exe (written in FASM). Go!

Output of my msgbox.exe

Click "IDA Freeware".

Click "New" (Disassemble a new file).

After select 'msgbox.exe', I see this window. I just click OK without changing the default settings.

Voila, this is the main window I see.

The disassembled code as follows:

CODE

; Attributes: noreturn

public start
start proc near
push 40h; '@' ; uType
push offset Caption ; "LYN Codemaster"
push offset Text ; "Apa khabar semua, marilah kita bersama-"...
push 0 ; hWnd
call ds:MessageBoxA
push eax ; uExitCode
call ds:ExitProcess
start endp

And my original source code is:

CODE

start:

push 0x40
push title
push message
push 0
call [MessageBox]

push eax
call [ExitProcess]

I think the disassembled code is brilliant, which annotated with data value contents, and as with any full-featured disassembler, the Win32 API function call is in human-readable name (e.g. ds:MessageBoxA), not just memory address.

The IDA Free auto-detects my msgbox.exe as 32-bit (x86) instruction set, because I think PE format has header field specifying whether the executable is in which processor mode (e.g. 0x14C for IMAGE_FILE_MACHINE_I386).

Now I click Windows menu, and then "Imports" (Alt+F6):

This is the window for import table:

It also matches the source code:

CODE

section '.idata' import readable writable

library kernel,'KERNEL32.DLL',\
user,'USER32.DLL'

import kernel,\
ExitProcess,'ExitProcess'

import user,\
MessageBox,'MessageBoxA'

But I don't know how to find out the resource section, because my 'msgbox.exe' comes with manifest.xml to make the message box in XP style.

This is the end of my session in IDA Free with you all.

Any feedbacks are welcomed, particularily the famous rockstar malware analyst @KLKS and @junyian!

Computer demo

Tullamarine — Sun, 26 Mar 2023 20:26:22 +0800

According to a definition:

Demos are special computer programs. They are beautiful presentations made by talented people - programmers, graphics, musicians - just for fun. This is real electronic art. Size-limited demos are called intros, and there are some categories of them - we have intros in 64 kilobytes, 4 kilobytes, even in 256 bytes and less. It's wonderful that some people make very impressive effects in so tiny space.

http://hardcode.untergrund.net/

Michal: I write C# which run without .NET runtime

Tullamarine — Mon, 20 Mar 2023 22:12:48 +0800

Source: https://github.com/MichalStrehovsky

QUOTE

I'm Michal, I live in Slovakia, and I work remotely at the .NET Runtime team at Microsoft.

He has a top repo 'zerosharp' (Demo of the potential of C# for systems programming with the .NET native ahead-of-time compilation technology.)

QUOTE

no-runtime is a rather pointless sample that demonstrates how to write code in C# that is directly runnable without a runtime. C# has value types and you can p/invoke into an unmanaged memory allocator, so you can do things with this, but you're so severily limited it's rather pointless. But Hello world ends up being about 8 kB native EXE with no dependencies, so that's rather cool.

https://github.com/MichalStrehovsky/zerosharp

CODE

using System;
using System.Runtime;
using System.Runtime.InteropServices;

#region A couple very basic things
namespace System
{
public class Object
{
#pragma warning disable 169
// The layout of object is a contract with the compiler.
private IntPtr m_pMethodTable;
#pragma warning restore 169
}
public struct Void { }

// The layout of primitive types is special cased because it would be recursive.
// These really don't need any fields to work.
public struct Boolean { }
public struct Char { }
public struct SByte { }
public struct Byte { }
public struct Int16 { }
public struct UInt16 { }
public struct Int32 { }
public struct UInt32 { }
public struct Int64 { }
public struct UInt64 { }
public struct IntPtr { }
public struct UIntPtr { }
public struct Single { }
public struct Double { }

public abstract class ValueType { }
public abstract class Enum : ValueType { }

public struct Nullable<T> where T : struct { }

public sealed class String { public readonly int Length; }
public abstract class Array { }
public abstract class Delegate { }
public abstract class MulticastDelegate : Delegate { }

public struct RuntimeTypeHandle { }
public struct RuntimeMethodHandle { }
public struct RuntimeFieldHandle { }

public class Attribute { }

public enum AttributeTargets { }

public sealed class AttributeUsageAttribute : Attribute
{
public AttributeUsageAttribute(AttributeTargets validOn) { }
public bool AllowMultiple { get; set; }
public bool Inherited { get; set; }
}

public class AppContext
{
public static void SetData(string s, object o) { }
}

namespace Runtime.CompilerServices
{
public class RuntimeHelpers
{
public static unsafe int OffsetToStringData => sizeof(IntPtr) + sizeof(int);
}
}
}
namespace System.Runtime.InteropServices
{
public sealed class DllImportAttribute : Attribute
{
public DllImportAttribute(string dllName) { }
}
}
#endregion

#region Things needed by ILC
namespace System
{
namespace Runtime
{
internal sealed class RuntimeExportAttribute : Attribute
{
public RuntimeExportAttribute(string entry) { }
}
}

class Array<T> : Array { }
}

namespace Internal.Runtime.CompilerHelpers
{
// A class that the compiler looks for that has helpers to initialize the
// process. The compiler can gracefully handle the helpers not being present,
// but the class itself being absent is unhandled. Let's add an empty class.
class StartupCodeHelpers
{
// A couple symbols the generated code will need we park them in this class
// for no particular reason. These aid in transitioning to/from managed code.
// Since we don't have a GC, the transition is a no-op.
[RuntimeExport("RhpReversePInvoke")]
static void RhpReversePInvoke(IntPtr frame) { }
[RuntimeExport("RhpReversePInvokeReturn")]
static void RhpReversePInvokeReturn(IntPtr frame) { }
[RuntimeExport("RhpPInvoke")]
static void RhpPInvoke(IntPtr frame) { }
[RuntimeExport("RhpPInvokeReturn")]
static void RhpPInvokeReturn(IntPtr frame) { }

[RuntimeExport("RhpFallbackFailFast")]
static void RhpFallbackFailFast() { while (true); }
}
}
#endregion

unsafe class Program
{
[DllImport("libc")]
static extern int printf(byte* fmt);

[DllImport("kernel32")]
static extern IntPtr GetStdHandle(int nStdHandle);

[DllImport("kernel32")]
static extern IntPtr WriteConsoleW(IntPtr hConsole, void* lpBuffer, int charsToWrite, out int charsWritten, void* reserved);

#if !WINDOWS
// Export this as "main" so that we can link with the C runtime library properly.
// If the C runtime library is not initialized we can't even printf.
// This is not needed on Windows because we don't call the C runtime.
[RuntimeExport("main")]
#endif
static int Main()
{
string hello = "Hello world!\n";
fixed (char* pHello = hello)
{
#if WINDOWS
WriteConsoleW(GetStdHandle(-11), pHello, hello.Length, out int _, null);
#else
// Once C# has support for UTF-8 string literals, this can be simplified.
// https://github.com/dotnet/csharplang/issues/2911
// Since we don't have that, convert from UTF-16 to ASCII.
byte* pHelloASCII = stackalloc byte[hello.Length + 1];
for (int i = 0; i < hello.Length; i++)
pHelloASCII[i] = (byte)pHello[i];

printf(pHelloASCII);
#endif
}

return 42;
}
}

Should I resign as delivery rider?

Tullamarine — Tue, 08 Sep 2020 00:05:37 +0800

In the past 15 months, I work as delivery rider for automotive part shop. The company is good, workmates are friendly and most importantly my boss is kind enough to arrange flexible working hours for me.

Recently, I could not pay attention while riding motorcycle anymore. Sometimes I am shocked how could I ride from location A to location B without noticing it. The routes to customer workshops are fixed, so I wonder if this causes almost a robotic habit when riding motorcycle. It would be quite dangerous for me to keep it this way as I am afraid of fatal accident.

If I do resign, I do not know where should I head to given my age coming close to my mid-40's.

I can work with computers but not everything in computers. I cannot work with people because I have social phobia. Is there any solution?

How to insert hyperlink containing white space?

Tullamarine — Sat, 29 Aug 2020 00:10:35 +0800

https://github.com/netspooky/hardcode/tree/.../dos/horizontal slice

[URL=https://github.com/netspooky/hardcode/tree/master/00128/dos/horizontal slice]My Webpage[/URL]

It won't work.

Binary Golf Grand Prix (Final Result)

Tullamarine — Wed, 26 Aug 2020 21:08:00 +0800

QUOTE

Binary Golf Grand Prix

Welcome to the Binary Golf Grand Prix! This is a challenge for people who like to craft tiny binaries. There have been a few CTF challenges involving binary golf, but it is sadly a dying art outside of the demoscene and some virus writing circles. Binary Golf is similar to Code Golf, where the purpose is to program something in as few instructions as possible. It takes it a step further and challenges people to create the smallest possible binary file as well. The goal of the Binary Golf Grand Prix is to challenge programmers to make the smallest possible binary that fits within certain constraints.

https://n0.lol/bggp/

Their inaugural challenge has been extended from July 24th to August 28th (New York time).

If you do not already know, you can look at the website for more details, and submit your source code by this Saturday.

Can CDM return extra money if "transaction cancel"

Tullamarine — Wed, 19 Aug 2020 21:42:14 +0800

I am not authorized to speak in behalf of company and account clerk insists that the amount was merely wrongly written.

Long story short. Can CDM return extra bank notes if suddenly "Transaction cancelled"?

Two days ago, I bank in at CIMB bank. Initially it rejected RM60 with RM2500 balance already in the machine. I pressed Add Cash and inserted RM60 back to the CDM. Then the machine generates strange sound, after about 15 seconds, the screen says "Transaction cancelled" and it returns about RM2900!

But my company account clerk insisted the right amount is RM2900, which is about RM400 more than what was originally written / calculated.

What formula to create photo filter effect?

Tullamarine — Tue, 18 Aug 2020 14:27:46 +0800

Each pixel has ARGB with Alpha being the opacity?

If we focus on RGB, can perform bitwise operation with one of the R or G or B to create photo filter effect. But what are the formulas?

Can anyone understand what I am talking about?

WTS Acer Aspire XC-704 (8GB RAM) RM 300

Tullamarine — Mon, 10 Aug 2020 00:57:54 +0800

Item(s): Acer Aspire XC-704

Intel Celeron N3050 1.6GHz
8GB DDR3 RAM
500GB SATA HDD
HDMI only. (No VGA port)

Package includes:
-Power adapter
-HDMI to DVI video cable

Comes with activated 64-bit Windows 10 Home

Price: RM 300

Warranty: No

Dealing method: COD

Location: Balakong only

Contact method/details: Reply or PM
---

Item(s) conditions: 4 years old

Picture:

Reason for sale:

Introducing ProcMon

Tullamarine — Fri, 24 Jul 2020 16:42:50 +0800

I saw two hacking threads on this forum this afternoon and thought I would share something in addition to disassembling/decompiling. Microsoft SysInternals understands how underlying stuffs work in Windows kernel, they have this powerful ProcMon (monitor and dump process) and PortMon (monitor and dump serial/parallel port incoming/outgoing data).

I am far from being a hacker, but I think to hack a software, not just to look at what it is, but what it does, too.
Normally we hex dump binary file. But ProcMon allows us to monitor and dump Windows process.

Let's get started.

What is ProcMon?

QUOTE

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon,

Download: https://docs.microsoft.com/en-us/sysinterna...wnloads/procmon
(SysInternals was acquired by Microsoft a long time ago)

So I want to show you how to "hack" software process, I take "Run as admin" compatiblity setting as an example.(I will try to change Properties of Google chrome.exe app shortcut)

Normally users need to open the Properties of the app shortcut, go to Compatibility, and tick "Run as adminstrator" to enable it, as pic shown below:

But what if you want this to be done programmatically? How do we know what Windows does when we tick "Run as administrator"? Here is where ProcMon comes handy.

You need to actually open the app shortcut, go to Compatibility, tick "Run as administrator", then click "OK" to commit changes.

Spot on! The changes to this particular registry key seem like what Windows did to enable "Run as admin", as pic shown below:

Similar to disassembling / decompiling, you need patience to find out what are really useful info and get rid of the rest.

CODE

9364 RegCreateKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags SUCCESS Desired Access: Write, Query Value, Enumerate Sub Keys, Disposition: REG_OPENED_EXISTING_KEY
9364 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags SUCCESS
9364 RegCreateKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS Desired Access: Write, Query Value, Enumerate Sub Keys, Disposition: REG_OPENED_EXISTING_KEY
9364 RegSetValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files (x86)\Google\Chrome\Application\chrome.exe SUCCESS Type: REG_SZ, Length: 26, Data: ~ RUNASADMIN
9364 RegCloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers SUCCESS

So I go to RegEdit, and found exactly the registry key that has been written to, as pic shown below:

Then we can write code to do that (enable / disable RunAsAdmin for all shortcut of a particular app), programmatically:

Sample code in C# .NET

CODE

Console.Write("Press 1 to RunAsAdmin, Press 0 to disable RunAsAdmin");
string input = Console.ReadLine();
RegistryKey key;

if (input == "1")
{

key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers", true);
key.SetValue(@"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe", "~ RUNASADMIN");
key.Close();
}
else if (input == "0")
{
//Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers", @"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe", "");
key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers", RegistryKeyPermissionCheck.ReadWriteSubTree, RegistryRights.SetValue);
//key.DeleteSubKey(@"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe");
key.SetValue(@"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe", "");
key.Close();
}

If you do not already know, I hope this info would be useful for you..... Happy "hacking".

What happened to JobStreet.com Code Challenge?

Tullamarine — Wed, 22 Jul 2020 22:52:14 +0800

The original URL was: http://www.jobstreet.com.my/event/code-cha...seeker/home.htm

QUOTE

About JobStreet.com Code Challenge
JobStreet.com Code Challenge is a competition for programmers in Malaysia to work on interesting and challenging problems, compete amongst each other and emerge as a champion. Potential top coders will also have a career opportunity with JobStreet.com.

Now can only be accessed through Internet Archive:

https://web.archive.org/web/20151108092732/...seeker/home.htm

FAQ:
https://web.archive.org/web/20150510215915/...seeker/faqs.htm

Did anyone take part? What happened to this Code Challenge?

Got a missed call from +3228088795

Tullamarine — Tue, 21 Jul 2020 16:48:41 +0800

It always freaks me out whenever I receive overseas numbers, as I do not have friends in overseas.

This +3228088795 is from Belgium? Who was going to call me from Europe???

Jobs on UpWork seem difficult

Tullamarine — Sat, 18 Jul 2020 00:09:10 +0800

Now I have my profile approved and goes live!

[attachmentid=10541137]

But I see their jobs are difficult even though it is within my expertise.

I need your input:
Do these hirers (mainly from US/UK) expect me doing it professionally from start to end?

As an amateur (sw/hw interfacing) R&D freelancer, it means I get clueless initially, and often mess up with my work in the beginning. I expect these hirers to see how the things get done in the end.
I also become panic if I took more hours than usual, because this means more expensive service charge for them. How?

For example, I saw a job ad about "serial port interfacing" which is good. But once I read further "calibrating hundreds of sensors which took 6 hours for a complete cycle". Anxious. Then further more I read "we have done it ourselves but it was slow."--- which means the hirer expects a faster, not just working, serial port interfacing solution. Panicked.

Any cool advice?

What changes and what doesn't?

Tullamarine — Fri, 17 Jul 2020 20:25:47 +0800

As an old man who started batch programming in last century, I understand the sentiments "chasing IT trend is tiresome".

I would like to compile a list of "What changes (in IT) and what doesn't" . While this list is far from exhaustive, I ask fellow members to help updating the list.

Let start with me, with my limited experience and my exposure :

What doesn't change:

Serial port interfacing
(C# & VB.net can use System.IO.Ports assembly)

Binary computer system
(Although can be commonly represented in decimal and hexadecimal)

COBOL?

What changes:

Low-level:
i8086: 16-bit registers, DOS / BIOS interrupt calls, DMA allowed
Win32- i386: 32-bit & 64-bit registers, Win32 API syscall, new CPU instructions introduced
(e.g. POPCNT is not seen during my days in i8086 assembly programming. POPCNT returns number of set bit)

Parallel port interfacing - No longer hear any new PC comes with LPT ports....

DOS ---> command prompt ---> PowerShell ???

Quick Sort --> TimSort ???

----

Let me be clear, I emphasis on the What Doesn't Change so that no one lose sight of IT fundamentals.... What do you think, folks?

Looking for sw/hw interfacing R&D job

Tullamarine — Mon, 13 Jul 2020 23:33:29 +0800

I am already a part-time sw/hw interfacing R&D engineer (freelancer), but I want more challenge and at the same time more income.

When I mean sw/hw interfacing, it is those hardware or electronic devices that you would like to control from within software (i.e. Windows) using serial port or socket programming.

I have done the following:
- Arduino Uno ATmega328P + LED stick WS2318: To show green or red LEDs from within Windows .NET (Also can visualize audio in Windows on the LED stick )
- SUNMI P payment terminal using websocket programming: To initiate sales (card) / sales (swipe) / refund from within C# .NET to the handheld payment terminal through Wi-Fi (LAN)
- ESC/POS printer commands .DLL : Can print 1D/2D barcode, multi-column + multi-line CJK characters, B/W logo graphics as well as x8 bigger character (such as McD queue ticket number) on receipt printer. (Portion of it relies on existing open-source code)
- L4000 intelligent controller : To control several light bulbs on and off from within Windows .NET through RS232-RJ45 adapter

Please PM or reply.

Skills:
1. C# (.NET Framework 4.7.2)
2. ASM i8086 (and also can reverse-engineer some software program)
3. Free Pascal (Optional) -- If I use it mainly for standalone console app .EXE