Lowyat.NET: Latest topics by FlierMate

Using IDA Free, Part 3

FlierMate — Mon, 12 Jun 2023 23:19:11 +0800

Today I will investigate syscall function in Windows. As we know, Windows library are provided through its API, but actually can skip the Windows API and use syscall directly, just like in Linux x64.
But the syscall numbers on Windows, from release to release, are not stable.

For syscall table in Windows, see: https://github.com/j00ru/windows-syscalls

So I will try my luck for my version of Windows, by debugging two EXEs (PE 64-bit) using IDA Freeware 8.3.

Below is the normal code for a program to exit with errorlevel 7:

CODE

format PE64 console
entry start

include "win64a.inc"

section ".code" code executable readable

start:

mov rcx, 7
call [ExitProcess]

section ".idata" import readable

library kernel, "kernel32.dll"

import kernel, ExitProcess, "ExitProcess"

As you see from above, there is an extra section called "idata", which is import table mandatory for every Win32 programs to be useful.

But today I will just hack it so that the newly created program will be even smaller, and without the import table at all.

After loading the exit.exe (source code listed above), I step into "call [ExitProcess]", and this is what I entered into, RtlExitUserProcess:

RtlExitUserProcess

If I further step into NtTerminateProcess, this is what we see:
Now it uses "syscall" with ID "0x2C" (the syscall number varies from one release of Windows to another)

NtTerminateProcess

After some investigation, I came up with this program, also exit with errorlevel 7:

CODE

format PE64 console
entry start

section ".code" code executable readable

start:

mov rdx, 7
or rcx, 0xFFFFFFFFFFFFFFFF
;xor rcx, rcx
mov r10, rcx
mov rax, 0x2C
syscall

And after I load it in IDA Freeware, this is the output.

Disassembly of NtExit.exe (source code above):

The file size:

CODE

Directory of C:\Users\BOO\Projects

06/12/2023 10:48 PM 1,536 exit.EXE
06/12/2023 10:59 PM 1,024 ntexit.EXE
2 File(s) 2,560 bytes
0 Dir(s) 91,136,335,872 bytes free

The NtExit.exe is without extra 512 bytes section of import table.

In summary, it is not practical to use syscall number directly in a Windows program, but I heard some malware are using it. @junyian @KLKS

Thank you for reading!

What Depression Feels Like

FlierMate — Tue, 06 Jun 2023 15:59:55 +0800

What Depression Feels Like How it Looks to Co-Workers

✅ Deep feelings of sadness ☑ Withdrawal from team, isolates oneself

✅ Loss of interest in work or social activities ☑ Indifference

✅ Difficulty concentrating, slowed thoughts ☑ Putting things off, missed deadlines, accidents

✅ Forgetfulness and trouble remembering ☑ Seems "scattered" or absentminded

✅ Trouble making decisions ☑ Procrastination, indecisiveness, slowed productivity

✅ Trouble sleeping, or sleeping too much ☑ Late to work, afternoon fatigue, accidents

✅ Feelings of worthlessness or inappropriate guilt ☑ Unsure of abilities, lack of confidence

✅ Energy loss or increased fatigue ☑ Low motivation, detached

✅ Irritability, anger or tearfulness ☑ Inappropriate reactions, strained relationships

✅ Weight or appetite changes ☑ Change in appearance

A Twitter user keeps hearing voice

FlierMate — Mon, 29 May 2023 02:51:20 +0800

Sorry to protect her privacy, I hide her username.
She has 0 followers and following 0 users. Account created since 2019.

She looks like having depression and hearing voices. Recently she was busy and had no time to visit hospital.

This is what she wrote in Jan 2023.

She was married with kids, and she is grateful her beloved parents still alive.

Misaligned output on wide screen

FlierMate — Thu, 24 Nov 2022 19:15:23 +0800

Can someone tell what is the problem with misaligned output on really wide screen?

I run the C# code through online compiler on:
https://dotnetfiddle.net/15ih29

Below is different result I got:

On my normal laptop screen:

On his wide screen:

My cyberpal monitor:

Is this that particular website issue, or incompatible with wide screen?

Use the creative way to print "2023"

FlierMate — Sun, 20 Nov 2022 20:56:33 +0800

Hi fellow coders! Since 2019 starting my inaugural LYN unofficial coding challenge on here, I have only organized another "smallest PDF file" crafting challenge on Kaki.gg developer's forum (by @pujan, but now no longer existed).

Thanks to @angch, this is my simple task for everyone on here.

Guess what is it? Print "2023" characters (minimum 50 columns x 10 rows) the creative way.
Since everyone use different programming language, compilers & interpreters, it is difficult to assess your work by size of program, lines of code, or execution speed. So your work will be judged by its creativity of generating the "2023" big characters on screen (or on webpage).

Example:

Some suggestions on how to print "2023" the creative way.
1) Store the 50x10 characters in compressed format, and expand it when printing out

2) Convert from image (B/W, etc) to ASCII art containing "2023"

3) Read system's font information (8x8, etc), and expand each pixel to larger size when printing out

4) Print "2023" as it is (the least creative way )

You can do like below, but it will be the least creative.

CODE

#include <stdio.h>

int main()
{
printf(" ** ******* ** ******* \r\n");
printf(" ** ** ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** \r\n");
printf(" ** ** ** ** ** ** \r\n");
printf(" ******* ******* ******* **** \r\n");

return 0;
}

You can do it with web programming, console app programming, or DOS programming.

Since it is difficult to judge when printing "2023" as picture, this coding challenge is limited to "2023" in characters-based output.

Fano Framework?

FlierMate — Wed, 18 May 2022 01:03:15 +0800

Has anyone ever heard of less known web framework like this Fano Framework?
It is made by someone from Indonesia, not from white guy, so it is indeed surprising to see coders from less developed countries could also design and develop web frameworks.

https://github.com/fanoframework

Anymore software creation like this from third world countries?

WTS Aku Budak Medik 4.0

FlierMate — Sat, 14 May 2022 04:21:58 +0800

Item(s): Aku Budak Medik 4.0

Package includes: 1x 206-page book

Price: RM 10

Warranty: No

Dealing method: COD

Location: Cheras, Balakong

Contact method/details: PM or Reply below
---

Item(s) conditions: Second hand

Picture:

Reason for sale: This is the only non-fictional book in my house, no point to keep only one book on book shelves

A simple transpiler

FlierMate — Fri, 06 May 2022 15:33:15 +0800

Example of my Pancake language:

CODE

O Hello World
O Press key in your name
I a
O Hi,
O a
O A
O Variable name is case-sensitive
O a
O Can you please enter your age?
I A
O Your age is...
O A

...where you use I for input from StdIn, O for output to StdOut.

Result in command prompt window:

CODE

C:\FASM>1
Hello World
Press key in your name
wong
Hi,
wong
A
Variable name is case-sensitive
wong
Can you please enter your age?
23
Your age is...
23

C:\FASM>

This transpiler convert simple Pancake source file to Assembly source file (for use by FASM).

Cute? The C# source:

[attachmentid=11145663]

Has anyone done anything like that?

I wish to improve my series of compiler (Satay, Sambal, Pipit) and transpiler (Pancake) so that they support more commands and programming language feature.

Anyone want to join?

---

Example .ASM file generated by Pancake transpiler:

CODE

format PE console
entry start

include 'win32a.inc'

section '.data' readable writable
_stdin dd ?
_stdout dd ?
_dummy dd ?

section '.code' code readable writable executable
_S0000 db 'Hello World',13,10,0
_S0001 db 'Press key in your name',13,10,0
_S0002 rb 256
_S0003 db 'Hi,',13,10,0
_S0004 db 'a',13,10,0
_S0005 db 'A',13,10,0
_S0006 db 'Variable name is case-sensitive',13,10,0
_S0007 db 'a',13,10,0
_S0008 db 'Can you please enter your age?',13,10,0
_S0009 rb 256
_S0010 db 'Your age is...',13,10,0
_S0011 db 'A',13,10,0
_L0000 dd 14
_L0001 dd 25
_L0002 dd ?
_L0003 dd 6
_L0004 dd 4
_L0005 dd 4
_L0006 dd 34
_L0007 dd 4
_L0008 dd 33
_L0009 dd ?
_L0010 dd 17
_L0011 dd 4

start:
invoke GetStdHandle, -10
mov dword [_stdin], eax
invoke GetStdHandle, -11
mov dword [_stdout], eax

invoke WriteConsole, dword [_stdout], _S0000, [_L0000], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0001, [_L0001], _dummy, 0
invoke ReadConsole, dword [_stdin], _S0002, 255, _L0002, 0
invoke WriteConsole, dword [_stdout], _S0003, [_L0003], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0002, [_L0002], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0005, [_L0005], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0006, [_L0006], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0002, [_L0002], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0008, [_L0008], _dummy, 0
invoke ReadConsole, dword [_stdin], _S0009, 255, _L0009, 0
invoke WriteConsole, dword [_stdout], _S0010, [_L0010], _dummy, 0
invoke WriteConsole, dword [_stdout], _S0009, [_L0009], _dummy, 0
invoke ExitProcess, 0

section '.idata' import readable writable
library kernel32,'KERNEL32.DLL'

import kernel32,\
GetStdHandle, 'GetStdHandle', \
WriteConsole, 'WriteConsoleA', \
ReadConsole, 'ReadConsoleA', \
ExitProcess,'ExitProcess'

Does anyone use CentOS Linux 8?

FlierMate — Tue, 03 May 2022 20:14:48 +0800

I did not know EOL of CentOS Linux 8 until yesterday! No one discuss it on this subforum, I mean this is Linux, and CentOS was a great choice and popular OS for many firms.

How did you survive its EOL? What is the replacement OS you use?

WhatsApp coder group

FlierMate — Fri, 29 Apr 2022 05:04:22 +0800

Hi, any coders from Malaysia / Singapore who like to join new WhatsApp group can click

Two ways to run .NET programs on Linux

FlierMate — Mon, 25 Apr 2022 21:17:04 +0800

I am using Debian 11, and Wine is used to run ordinary Windows program, but not .NET programs.

Personally I found mono-complete is useful, but someone said wine-mono is easier.

CODE

sudo apt-get install mono-complete

Then I run mono followed by program name to execute .NET programs.

It is intriguing that wine-mono is a MSI (Windows installer) that installs into Wine, not Linux.
(https://wiki.winehq.org/Mono)

Does anyone have attempted to use wine-mono?

Screenshot: (Sambal.exe is .NET 4.7.2 program, but myapp2.txt.EXE is Win32 program)

Pangsapuri Puncak Baiduri - Original Brochures

FlierMate — Mon, 25 Apr 2022 01:20:06 +0800

How did they create wait cursor?

FlierMate — Thu, 17 Mar 2022 04:36:43 +0800

I will be the last one to know.

We have seen a variety of graphical wait cursor from hourglass to spinning circle.

But what about console mode.... Is this a thing?

More pattern is welcome.

Why food expiry date differs?

FlierMate — Wed, 23 Feb 2022 19:06:53 +0800

[attachmentid=11099212]

I notice the Aug 2021 batch can only lasts 1 year.
But another batch from Dec 2021 can last until Feb 2023.

Does anybody know why two months longer? Did Oldtown add more preservative?

Cannot connect to international websites

FlierMate — Mon, 14 Feb 2022 11:20:43 +0800

Lately, I have been experiencing difficulty browsing international websites like apple.com, microsoft.com, amazon.com and flatassembler.net.

Worth noting is, while I can't connect to microsoft.com, I can open docs.microsoft.com which is strange.

No matter on Linux (Debian 11) with Firefox v78 or latest version of Chrome, or on Windows 10 with latest version of Chrome (on the same old laptop), I got this error:

CODE

This site can’t be reachedCheck if there is a typo in microsoft.com.
If spelling is correct, try running Windows Network Diagnostics.
DNS_PROBE_FINISHED_NXDOMAIN

However, using the same Wi-Fi, my mobile phone can connect to abovesaid websites without any issue.

The PC browsing issue might be lifted in the afternoon, which means it is not consistent, sometimes I can connect, but sometimes cannot.

Any idea how to solve? Is it only me who have this issue in Malaysia?

A Win32dlg comparison between ASM and C++

FlierMate — Sun, 13 Feb 2022 23:55:45 +0800

This side-by-side comparison was created solely for Lowyat.Net Codemaster forum in Malaysia. I am newbie to both C++ and Win32Dlg, some code demonstrated in ASM and CPP might not be professional. This shows how small is the asm version, but at the same time more work needed in asm version as well. C++ version is fair in term of size and development speed.

dlgtestasm - written in fasm 1
109 lines ASM

2560 bytes EXE

Dependency: Kernel32.dll, User32.dll

dlgtestcpp - written in visual c++ (2022)
59 lines CPP
3 lines H
5090 bytes RES

14,336 bytes EXE (Release x64)

Dependency: VCRuntime140.dll, Kernel32.dll, User32.dll

You can download the source code and executable for both comparison from: https://github.com/wd4018b/dlgtest

What do you think?

As a side note: @yeohhs from Malaysia is an expert in creating Win32dlg from pure assembly language. Hats off to him.

Where to throw UPS (battery)

FlierMate — Thu, 27 Jan 2022 09:40:15 +0800

I have two bad UPS (battery), bought them two years ago, but now can no longer sustain more than 10 seconds after power trip.
(UPS is used as backup battery for equipment that needs 240V AC power, in case of power failure at home or in office.)

Can somebody tell me where to throw them properly? Because throwing them at waste bin is a no-no, I afraid the garbage collector will "kena electric shock" if they accidentally touch the circuit inside or through the power socket outside.

"Thank You" to LYN helpdesk

FlierMate — Mon, 24 Jan 2022 20:18:27 +0800

I would like to thank LYN helpdesk for their diligence in restoring my account.

Although my forum account was associated with wrong e-mail address, they patiently ask for my other proof of ownership of this user account.

What impressed me, is that the LYN helpdesk reply e-mail's wording are soft, and actively offering help. They even work on Sunday!

Online source code beautifer

FlierMate — Thu, 06 Jan 2022 21:47:27 +0800

QUOTE

Posted byu/HelloWorldzik
1 year ago
Does online ASM formatter exist?
General

I cannot find any.

https://www.reddit.com/r/asm/comments/joh28...ormatter_exist/

I too looking for such online tool, but not found any. If someone want to create a Web project, perhaps this is a software project idea for you.

My posts got reported and reminder still there

FlierMate — Sat, 01 Jan 2022 11:16:28 +0800

I have one post got reported by someone for racial/religious issue in 25 Dec 2021, and another post reported by myself for deletion in 21 Dec 2021, but so far the red reminder is still there (at the beginning of the post).

Will there be action taken against my posts, or is moderating team currently busy?