541 lines
38 KiB
Markdown
541 lines
38 KiB
Markdown
# Reverse Engineering Field Notes
|
||
|
||
Detailed quick notes that support [`SKILL.md`](SKILL.md). Read this file after triage, not before.
|
||
|
||
## Table of Contents
|
||
|
||
- [Binary Types](#binary-types)
|
||
- [Python .pyc](#python-pyc)
|
||
- [WASM](#wasm)
|
||
- [Android APK](#android-apk)
|
||
- [Flutter APK (Dart AOT)](#flutter-apk-dart-aot)
|
||
- [.NET](#net)
|
||
- [Packed (UPX)](#packed-upx)
|
||
- [Tauri Packed Desktop Apps](#tauri-packed-desktop-apps)
|
||
- [Anti-Debugging Bypass](#anti-debugging-bypass)
|
||
- [Specialized Patterns](#specialized-patterns)
|
||
- [S-Box / Keystream Patterns](#s-box--keystream-patterns)
|
||
- [Custom VM Analysis](#custom-vm-analysis)
|
||
- [Python Bytecode Reversing](#python-bytecode-reversing)
|
||
- [Signal-Based Binary Exploration](#signal-based-binary-exploration)
|
||
- [Malware Anti-Analysis Bypass via Patching](#malware-anti-analysis-bypass-via-patching)
|
||
- [Expected Values Tables](#expected-values-tables)
|
||
- [x86-64 Gotchas](#x86-64-gotchas)
|
||
- [Iterative Solver Pattern](#iterative-solver-pattern)
|
||
- [Unicorn Emulation (Complex State)](#unicorn-emulation-complex-state)
|
||
- [Multi-Stage Shellcode Loaders](#multi-stage-shellcode-loaders)
|
||
- [Timing Side-Channel Attack](#timing-side-channel-attack)
|
||
- [Unstripped Binary Information Leaks](#unstripped-binary-information-leaks)
|
||
- [Custom Mangle Function Reversing](#custom-mangle-function-reversing)
|
||
- [Rust serde_json Schema Recovery](#rust-serde_json-schema-recovery)
|
||
- [Position-Based Transformation Reversing](#position-based-transformation-reversing)
|
||
- [Hex-Encoded String Comparison](#hex-encoded-string-comparison)
|
||
- [CTF Case Notes](#ctf-case-notes)
|
||
- [Embedded ZIP + XOR License Decryption](#embedded-zip--xor-license-decryption)
|
||
- [Stack String Deobfuscation (.rodata XOR Blob)](#stack-string-deobfuscation-rodata-xor-blob)
|
||
- [Prefix Hash Brute-Force](#prefix-hash-brute-force)
|
||
- [Mathematical Convergence Bitmap](#mathematical-convergence-bitmap)
|
||
- [RISC-V Binary Analysis](#risc-v-binary-analysis)
|
||
- [Kernel Module Maze Solving](#kernel-module-maze-solving)
|
||
- [Multi-Threaded VM with Channels](#multi-threaded-vm-with-channels)
|
||
- [CVP/LLL Lattice for Constrained Integer Validation](#cvplll-lattice-for-constrained-integer-validation)
|
||
- [Decision Tree Function Obfuscation](#decision-tree-function-obfuscation)
|
||
- [Android JNI RegisterNatives Obfuscation](#android-jni-registernatives-obfuscation)
|
||
- [Multi-Layer Self-Decrypting Binary](#multi-layer-self-decrypting-binary)
|
||
- [GLSL Shader VM with Self-Modifying Code](#glsl-shader-vm-with-self-modifying-code)
|
||
- [GF(2^8) Gaussian Elimination for Flag Recovery](#gf28-gaussian-elimination-for-flag-recovery)
|
||
- [Z3 for Single-Line Python Boolean Circuit](#z3-for-single-line-python-boolean-circuit)
|
||
- [Sliding Window Popcount Differential Propagation](#sliding-window-popcount-differential-propagation)
|
||
- [Ruby/Perl Polyglot Constraint Satisfaction](#rubyperl-polyglot-constraint-satisfaction)
|
||
- [Verilog/Hardware RE](#veriloghardware-re)
|
||
- [Custom binfmt Kernel Module with RC4 Flat Binaries](#custom-binfmt-kernel-module-with-rc4-flat-binaries)
|
||
- [Hash-Resolved Imports / No-Import Ransomware](#hash-resolved-imports--no-import-ransomware)
|
||
- [ELF Section Header Corruption for Anti-Analysis](#elf-section-header-corruption-for-anti-analysis)
|
||
- [Brainfuck Character-by-Character Static Analysis](#brainfuck-character-by-character-static-analysis)
|
||
- [Brainfuck Side-Channel via Read Count Oracle](#brainfuck-side-channel-via-read-count-oracle)
|
||
- [Brainfuck Comparison Idiom Detection](#brainfuck-comparison-idiom-detection)
|
||
- [Backdoored Shared Library Detection](#backdoored-shared-library-detection)
|
||
- [Go Binary Reversing](#go-binary-reversing)
|
||
- [Go Binary UUID Patching for C2 Enumeration](#go-binary-uuid-patching-for-c2-enumeration)
|
||
- [D Language Binary Reversing](#d-language-binary-reversing)
|
||
- [Rust Binary Reversing](#rust-binary-reversing)
|
||
- [Frida Dynamic Instrumentation](#frida-dynamic-instrumentation)
|
||
- [Frida Firebase Cloud Functions Bypass](#frida-firebase-cloud-functions-bypass)
|
||
- [angr Symbolic Execution](#angr-symbolic-execution)
|
||
- [Qiling Emulation](#qiling-emulation)
|
||
- [VMProtect / Themida Analysis](#vmprotect--themida-analysis)
|
||
- [Binary Diffing](#binary-diffing)
|
||
- [Advanced GDB (pwndbg, rr)](#advanced-gdb-pwndbg-rr)
|
||
- [macOS / iOS Reversing](#macos--ios-reversing)
|
||
- [Embedded / IoT Firmware RE](#embedded--iot-firmware-re)
|
||
- [Kernel Driver Reversing](#kernel-driver-reversing)
|
||
- [Swift / Kotlin Binary Reversing](#swift--kotlin-binary-reversing)
|
||
- [INT3 Patch + Coredump Brute-Force Oracle](#int3-patch--coredump-brute-force-oracle)
|
||
- [Signal Handler Chain + LD_PRELOAD Oracle](#signal-handler-chain--ld_preload-oracle)
|
||
- [Font Ligature Exploitation](#font-ligature-exploitation)
|
||
- [Instruction Counter as Cryptographic State](#instruction-counter-as-cryptographic-state)
|
||
- [Burrows-Wheeler Transform Inversion](#burrows-wheeler-transform-inversion)
|
||
- [FRACTRAN Program Inversion](#fractran-program-inversion)
|
||
- [Opcode-Only Trace Reconstruction](#opcode-only-trace-reconstruction)
|
||
- [Thread Race Signed Integer Overflow](#thread-race-signed-integer-overflow)
|
||
- [ESP32/Xtensa Firmware Reversing](#esp32xtensa-firmware-reversing)
|
||
- [Custom VM Bytecode Lifting to LLVM IR](#custom-vm-bytecode-lifting-to-llvm-ir)
|
||
- [SIGFPE Signal Handler Side-Channel](#sigfpe-signal-handler-side-channel)
|
||
- [Batch Crackme Automation via objdump](#batch-crackme-automation-via-objdump)
|
||
- [Android DEX Runtime Bytecode Patching](#android-dex-runtime-bytecode-patching)
|
||
- [Fork + Pipe + Dead Branch Anti-Analysis](#fork--pipe--dead-branch-anti-analysis)
|
||
- [Web/CTF Auth Bypass Case Notes](#webctf-auth-bypass-case-notes)
|
||
- [Signed Cookie Key Reuse: access token to admin_session](#signed-cookie-key-reuse-access-token-to-admin_session)
|
||
- [Web Phishing Infrastructure](#web-phishing-infrastructure)
|
||
- [Phishing Panel: {domain_a} / {domain_b}](#phishing-panel-domain_a--domain_b)
|
||
|
||
## Binary Types
|
||
|
||
### Python .pyc
|
||
Disassemble with `marshal.load()` + `dis.dis()`. Header: 8 bytes (2.x), 12 (3.0-3.6), 16 (3.7+). See [languages.md](languages.md#python-bytecode-reversing-disdis-output).
|
||
|
||
### WASM
|
||
```bash
|
||
wasm2c checker.wasm -o checker.c
|
||
gcc -O3 checker.c wasm-rt-impl.c -o checker
|
||
|
||
# WASM patching (challenge binaries):
|
||
wasm2wat main.wasm -o main.wat # Binary → text
|
||
# Edit WAT: flip comparisons, change constants
|
||
wat2wasm main.wat -o patched.wasm # Text → binary
|
||
```
|
||
|
||
### Android APK
|
||
`apktool d app.apk -o decoded/` for resources; `jadx app.apk` for Java decompilation. Check `decoded/res/values/strings.xml` for flags. See [tools.md](tools.md#android-apk).
|
||
|
||
### Flutter APK (Dart AOT)
|
||
If `lib/arm64-v8a/libapp.so` + `libflutter.so` present, use [Blutter](https://github.com/worawit/blutter): `python3 blutter.py path/to/app/lib/arm64-v8a out_dir`. Outputs reconstructed Dart symbols + Frida script. See [tools.md](tools.md#flutter-apk-blutter).
|
||
|
||
### .NET
|
||
- dnSpy - debugging + decompilation
|
||
- ILSpy - decompiler
|
||
|
||
### Packed (UPX)
|
||
```bash
|
||
upx -d packed -o unpacked
|
||
```
|
||
If unpacking fails, inspect UPX metadata first: verify UPX section names, header fields, and version markers are intact. If metadata looks tampered or uncertain, review UPX source on GitHub to identify likely modification points.
|
||
|
||
### Tauri Packed Desktop Apps
|
||
Tauri embeds Brotli-compressed frontend assets in the executable. Find `index.html` xrefs to locate asset index table, dump blobs, Brotli decompress. Reference: `tauri-codegen/src/embedded_assets.rs`.
|
||
|
||
## Anti-Debugging Bypass
|
||
|
||
Common checks:
|
||
- `IsDebuggerPresent()` / PEB.BeingDebugged / NtQueryInformationProcess (Windows)
|
||
- `ptrace(PTRACE_TRACEME)` / `/proc/self/status` TracerPid (Linux)
|
||
- TLS callbacks (run before main — check PE TLS Directory)
|
||
- Timing checks (`rdtsc`, `clock_gettime`, `GetTickCount`)
|
||
- Hardware breakpoint detection (DR0-DR3 via GetThreadContext)
|
||
- INT3 scanning / code self-hashing (CRC over .text section)
|
||
- Signal-based: SIGTRAP handler, SIGALRM timeout, SIGSEGV for real logic
|
||
- Frida/DBI detection: `/proc/self/maps` scan, port 27042, inline hook checks
|
||
|
||
Bypass: Set breakpoint at check, modify register to bypass conditional. pwntools patch: `elf.asm(elf.symbols.ptrace, 'ret')` to replace function with immediate return. See [patterns.md](patterns.md#pwntools-binary-patching-crypto-cat).
|
||
|
||
For comprehensive anti-analysis techniques and bypasses (30+ methods with code), see [anti-analysis.md](anti-analysis.md).
|
||
|
||
## Specialized Patterns
|
||
|
||
### S-Box / Keystream Patterns
|
||
**Xorshift32:** Shifts 13, 17, 5
|
||
**Xorshift64:** Shifts 12, 25, 27
|
||
**Magic constants:** `0x2545f4914f6cdd1d`, `0x9e3779b97f4a7c15`
|
||
|
||
### Custom VM Analysis
|
||
1. Identify structure: registers, memory, IP
|
||
2. Reverse `executeIns` for opcode meanings
|
||
3. Write disassembler mapping opcodes to mnemonics
|
||
4. Often easier to bruteforce than fully reverse
|
||
5. Look for the bytecode file loaded via command-line arg
|
||
|
||
See [patterns.md](patterns.md#custom-vm-reversing) for VM workflow, opcode tables, and state machine BFS.
|
||
|
||
**Sequential key-chain brute-force:** When a VM validates input in small blocks (e.g., 3 bytes = 2^24 candidates) with each block's output key feeding the next, brute-force each block sequentially with OpenMP parallelization. Compile solver with `gcc -O3 -march=native -fopenmp`. See [patterns-ctf-3.md](patterns-ctf-3.md#vm-sequential-key-chain-brute-force-midnight-flag-2026).
|
||
|
||
### Python Bytecode Reversing
|
||
XOR flag checkers with interleaved even/odd tables are common. See [languages.md](languages.md#python-bytecode-reversing-disdis-output) for bytecode analysis tips and reversing patterns.
|
||
|
||
### Signal-Based Binary Exploration
|
||
Binary uses UNIX signals as binary tree navigation; hook `sigaction` via `LD_PRELOAD`, DFS by sending signals. See [patterns.md](patterns.md#signal-based-binary-exploration).
|
||
|
||
### Malware Anti-Analysis Bypass via Patching
|
||
Flip `JNZ`/`JZ` (0x75/0x74), change sleep values, patch environment checks in Ghidra (`Ctrl+Shift+G`). See [patterns.md](patterns.md#malware-anti-analysis-bypass-via-patching).
|
||
|
||
### Expected Values Tables
|
||
Locate with `objdump -s -j .rodata binary | less` — look near comparison instructions, size matches flag length.
|
||
|
||
### x86-64 Gotchas
|
||
Sign extension and 32-bit truncation pitfalls. See [patterns.md](patterns.md#x86-64-gotchas) for details and code examples.
|
||
|
||
### Iterative Solver Pattern
|
||
Try each byte (0-255) per position, match against expected output. **Uniform transform shortcut:** if one input byte only changes one output byte, build 0..255 mapping then invert. See [patterns.md](patterns.md) for full implementation.
|
||
|
||
### Unicorn Emulation (Complex State)
|
||
`from unicorn import *` -- map segments, set up stack, hook to trace. **Mixed-mode pitfall:** 64-bit stub jumping to 32-bit via `retf` requires switching to UC_MODE_32 and copying GPRs + EFLAGS + XMM regs. See [tools.md](tools.md#unicorn-emulation).
|
||
|
||
### Multi-Stage Shellcode Loaders
|
||
Nested shellcode with XOR decode loops; break at `call rax`, bypass ptrace with `set $rax=0`, extract flag from `mov` instructions. See [patterns.md](patterns.md#multi-stage-shellcode-loaders).
|
||
|
||
### Timing Side-Channel Attack
|
||
Validation time varies per correct character; measure elapsed time per candidate to recover flag byte-by-byte. See [patterns.md](patterns.md#timing-side-channel-attack).
|
||
|
||
### Unstripped Binary Information Leaks
|
||
**Pattern:** Debug info and file paths leak author identity. Quick checks: `strings binary | grep "/home/"` (home dirs), `file binary` (stripped?), `readelf -S binary | grep debug` (debug sections).
|
||
|
||
### Custom Mangle Function Reversing
|
||
Binary mangles input 2 bytes at a time with running state; extract target from `.rodata`, write inverse function. See [patterns.md](patterns.md#custom-mangle-function-reversing).
|
||
|
||
### Rust serde_json Schema Recovery
|
||
Disassemble serde `Visitor` implementations to recover expected JSON schema; field names in order reveal flag. See [languages-platforms.md](languages-platforms.md#rust-serdejson-schema-recovery).
|
||
|
||
### Position-Based Transformation Reversing
|
||
Binary adds/subtracts position index; reverse by undoing per-index offset. See [patterns.md](patterns.md#position-based-transformation-reversing).
|
||
|
||
### Hex-Encoded String Comparison
|
||
Input converted to hex, compared against constant. Decode with `xxd -r -p`. See [patterns.md](patterns.md#hex-encoded-string-comparison).
|
||
|
||
## CTF Case Notes
|
||
|
||
### Embedded ZIP + XOR License Decryption
|
||
Binary with named symbols (`EMBEDDED_ZIP`, `ENCRYPTED_MESSAGE`) in `.rodata` → extract ZIP containing license, XOR encrypted message with license bytes to recover flag. No execution needed. See [patterns-ctf-2.md](patterns-ctf-2.md#embedded-zip-xor-license-decryption-metactf-2026).
|
||
|
||
### Stack String Deobfuscation (.rodata XOR Blob)
|
||
Binary mmaps `.rodata` blob, XOR-deobfuscates, uses it to validate input. Reimplement verification loop with pyelftools to extract blob. Look for `0x9E3779B9`, `0x85EBCA6B` constants and `rol32()`. See [patterns-ctf-2.md](patterns-ctf-2.md#stack-string-deobfuscation-from-rodata-xor-blob-nullcon-2026).
|
||
|
||
### Prefix Hash Brute-Force
|
||
Binary hashes every prefix independently. Recover one character at a time by matching prefix hashes. See [patterns-ctf-2.md](patterns-ctf-2.md#prefix-hash-brute-force-nullcon-2026).
|
||
|
||
### Mathematical Convergence Bitmap
|
||
**Pattern:** Binary classifies coordinate pairs by Newton's method convergence (e.g., z^3-1=0). Grid of pass/fail results renders ASCII art flag. Key: the binary is a classifier, not a checker — reverse the math and visualize. See [patterns-ctf.md](patterns-ctf.md#mathematical-convergence-bitmap-ehax-2026).
|
||
|
||
### RISC-V Binary Analysis
|
||
Statically linked, stripped RISC-V ELF. Use Capstone with `CS_MODE_RISCVC | CS_MODE_RISCV64` for mixed compressed instructions. Emulate with `qemu-riscv64`. Watch for fake flags and XOR decryption with incremental keys. See [tools.md](tools.md#risc-v-binary-analysis-ehax-2026).
|
||
|
||
### Kernel Module Maze Solving
|
||
Rust kernel module implements maze via device ioctls. Enumerate commands dynamically, build DFS solver with decoy avoidance, deploy as minimal static binary (raw syscalls, no libc). See [patterns-ctf.md](patterns-ctf.md#kernel-module-maze-solving-dicectf-2026).
|
||
|
||
### Multi-Threaded VM with Channels
|
||
Custom VM with 16+ threads communicating via futex channels. Trace data flow across thread boundaries, extract constants from GDB, watch for inverted validity logic, solve via BFS state space search. See [patterns-ctf.md](patterns-ctf.md#multi-threaded-vm-with-channel-synchronization-dicectf-2026).
|
||
|
||
### CVP/LLL Lattice for Constrained Integer Validation
|
||
Binary validates flag via matrix multiplication with 64-bit coefficients; solutions must be printable ASCII. Use LLL reduction + CVP in SageMath to find nearest lattice point in the constrained range. Two-phase pattern: Phase 1 recovers AES key, Phase 2 decrypts custom VM bytecode with another linear system (mod 2^32). See [patterns-ctf-2.md](patterns-ctf-2.md#cvplll-lattice-for-constrained-integer-validation-htb-shadowlabyrinth).
|
||
|
||
### Decision Tree Function Obfuscation
|
||
~200+ auto-generated functions routing input through polynomial comparisons. Script extraction via Ghidra headless rather than reversing each function manually. Constraint propagation from known output format cascades through arithmetic constraints. See [patterns-ctf-2.md](patterns-ctf-2.md#decision-tree-function-obfuscation-htb-wondersms).
|
||
|
||
### Android JNI RegisterNatives Obfuscation
|
||
`RegisterNatives` in `JNI_OnLoad` hides which C++ function handles each Java native method (no standard `Java_com_pkg_Class_method` symbol). Find the real handler by tracing `JNI_OnLoad` → `RegisterNatives` → `fnPtr`. Use x86_64 `.so` from APK for best Ghidra decompilation. See [languages-platforms.md](languages-platforms.md#android-jni-registernatives-obfuscation-htb-wondersms).
|
||
|
||
### Multi-Layer Self-Decrypting Binary
|
||
N-layer binary where each layer decrypts the next using user-provided key bytes + SHA-NI. Use oracle (correct key → valid code with expected pattern). JIT execution with fork-per-candidate COW isolation for speed. See [patterns-ctf-2.md](patterns-ctf-2.md#multi-layer-self-decrypting-binary-dicectf-2026).
|
||
|
||
### GLSL Shader VM with Self-Modifying Code
|
||
**Pattern:** WebGL2 fragment shader implements Turing-complete VM on a 256x256 RGBA texture (program memory + VRAM). Self-modifying code (STORE opcode) patches drawing instructions. GPU parallelism causes write conflicts — emulate sequentially in Python to recover full output. See [patterns-ctf-3.md](patterns-ctf-3.md#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026).
|
||
|
||
### GF(2^8) Gaussian Elimination for Flag Recovery
|
||
**Pattern:** Binary performs Gaussian elimination over GF(2^8) with the AES polynomial (0x11b). Matrix + augmentation vector in `.rodata`; solution vector is the flag. Look for constant `0x1b` in disassembly. Addition is XOR, multiplication uses polynomial reduction. See [patterns-ctf-2.md](patterns-ctf-2.md#gf28-gaussian-elimination-for-flag-recovery-apoorvctf-2026).
|
||
|
||
### Z3 for Single-Line Python Boolean Circuit
|
||
**Pattern:** Single-line Python (2000+ semicolons) with walrus operator chains validates flag as big-endian integer via boolean circuit. Obfuscated XOR `(a | b) & ~(a & b)`. Split on semicolons, translate to Z3 symbolically, solve in under a second. See [patterns-ctf-3.md](patterns-ctf-3.md#z3-for-single-line-python-boolean-circuit-bearcatctf-2026).
|
||
|
||
### Sliding Window Popcount Differential Propagation
|
||
**Pattern:** Binary validates input via expected popcount for each position of a 16-bit sliding window. Popcount differences create a recurrence: `bit[i+16] = bit[i] + (data[i+1] - data[i])`. Brute-force ~4000-8000 valid initial 16-bit windows; each determines the entire bit sequence. See [patterns-ctf-3.md](patterns-ctf-3.md#sliding-window-popcount-differential-propagation-bearcatctf-2026).
|
||
|
||
### Ruby/Perl Polyglot Constraint Satisfaction
|
||
**Pattern:** Single file valid in both Ruby and Perl, each imposing different constraints on a key. Exploits `=begin`/`=end` (Ruby block comment) vs `=begin`/`=cut` (Perl POD) to run different code per interpreter. Intersect constraints from both languages to recover the unique key. See [languages-platforms.md](languages-platforms.md#rubyperl-polyglot-constraint-satisfaction-bearcatctf-2026).
|
||
|
||
### Verilog/Hardware RE
|
||
**Pattern:** Verilog HDL source for state machines with hidden conditions gated on shift register history. Analyze `always @(posedge clk)` blocks and `case` statements to find correct input sequences. See [languages-platforms.md](languages-platforms.md#veriloghardware-reverse-engineering-srdnlenctf-2026).
|
||
|
||
### Custom binfmt Kernel Module with RC4 Flat Binaries
|
||
**Pattern:** Kernel module registers binfmt handler for encrypted flat binaries. Reverse the `.ko` to find RC4 key (in `movabs` immediates), decrypt the flat binary, import at the fixed virtual address from the module's `vm_mmap` call. See [patterns-ctf.md](patterns-ctf.md#custom-binfmt-kernel-module-with-rc4-flat-binaries-bsidessf-2026).
|
||
|
||
### Hash-Resolved Imports / No-Import Ransomware
|
||
**Pattern:** Binary with zero visible imports resolves APIs via symbol name hashing at runtime. Skip the hash reversing — hook OpenSSL functions via `LD_PRELOAD` in Docker to capture AES keys directly. See [patterns-ctf.md](patterns-ctf.md#hash-resolved-imports-no-import-ransomware-bsidessf-2026).
|
||
|
||
### ELF Section Header Corruption for Anti-Analysis
|
||
**Pattern:** Corrupted section headers crash analysis tools but program headers are intact so binary runs normally. Patch `e_shoff` to zero or use `readelf -l` (program headers only). Flag hidden after corrupted sections with magic marker + XOR. See [patterns-ctf.md](patterns-ctf.md#elf-section-header-corruption-for-anti-analysis-bsidessf-2026).
|
||
|
||
### Brainfuck Character-by-Character Static Analysis
|
||
**Pattern:** BF programs validating input have `,` (read char) followed by `+` operations whose count = expected ASCII value. Extract increment counts per input position to recover expected input without execution. See [languages.md](languages.md#brainfuck-character-by-character-static-analysis-bsidessf-2026).
|
||
|
||
### Brainfuck Side-Channel via Read Count Oracle
|
||
**Pattern:** BF input validators read more bytes when a character is correct. Count `,` operations per candidate — highest read count = correct byte. Character-by-character recovery. See [languages.md](languages.md#brainfuck-side-channel-via-read-count-oracle-bsidessf-2026).
|
||
|
||
### Brainfuck Comparison Idiom Detection
|
||
**Pattern:** Compiled BF uses fixed idioms for equality checks (`<[-<->] +<[>-<[-]]>[-<+>]`). Instrument interpreter to detect patterns and extract comparison operands (expected flag bytes). See [languages.md](languages.md#brainfuck-comparison-idiom-detection-bsidessf-2026).
|
||
|
||
### Backdoored Shared Library Detection
|
||
Binary works in GDB but fails when run normally (suid)? Check `ldd` for non-standard libc paths, then `strings | diff` the suspicious vs. system library to find injected code/passwords. See [patterns-ctf.md](patterns-ctf.md#backdoored-shared-library-detection-via-string-diffing-hacklu-ctf-2012).
|
||
|
||
### Go Binary Reversing
|
||
Large static binary with `go.buildid`? Use GoReSym to recover function names (works even on stripped binaries). Go strings are `{ptr, len}` pairs — not null-terminated. Look for `main.main`, `runtime.gopanic`, channel ops (`runtime.chansend1`/`chanrecv1`). Use Ghidra golang-loader plugin for best results. See [languages-compiled.md](languages-compiled.md#go-binary-reversing).
|
||
|
||
### Go Binary UUID Patching for C2 Enumeration
|
||
**Pattern:** Go C2 client with UUID from `-ldflags -X`. Binary-patch UUID bytes (same length), register with C2, enumerate clients/files via API. See [languages-compiled.md](languages-compiled.md#go-binary-uuid-patching-for-c2-client-enumeration-bsidessf-2026).
|
||
|
||
### D Language Binary Reversing
|
||
D language binaries have unique symbol mangling (not C++ style). Template-heavy, many function variants. Look for `_D` prefix in symbols. See [languages-compiled.md](languages-compiled.md#d-language-binary-reversing-csaw-ctf-2016).
|
||
|
||
### Rust Binary Reversing
|
||
Binary with `core::panicking` strings and `_ZN` mangled symbols? Use `rustfilt` for demangling. Panic messages contain source paths and line numbers — `strings binary | grep "panicked"` is the fastest approach. Option/Result enums use discriminant byte (0=None/Err, 1=Some/Ok). See [languages-compiled.md](languages-compiled.md#rust-binary-reversing).
|
||
|
||
### Frida Dynamic Instrumentation
|
||
Hook runtime functions without modifying binary. `frida -f ./binary -l hook.js` to spawn with instrumentation. Hook `strcmp`/`memcmp` to capture expected values, bypass anti-debug by replacing `ptrace` return value, scan memory for flag patterns, replace validation functions. See [tools-dynamic.md](tools-dynamic.md#frida-dynamic-instrumentation).
|
||
|
||
### Frida Firebase Cloud Functions Bypass
|
||
**Pattern:** Android app validates via Firebase Cloud Functions. Post-login Frida hook constructs valid payload (UID + value + timestamp) and calls Cloud Function directly, bypassing QR/payment validation. See [languages-platforms.md](languages-platforms.md#frida-firebase-cloud-functions-bypass-bsidessf-2026).
|
||
|
||
### angr Symbolic Execution
|
||
Automatic path exploration to find inputs satisfying constraints. Load binary with `angr.Project`, set find/avoid addresses, call `simgr.explore()`. Constrain input to printable ASCII and known prefix for faster solving. Hook expensive functions (crypto, I/O) to prevent path explosion. See [tools-dynamic.md](tools-dynamic.md#angr-symbolic-execution).
|
||
|
||
### Qiling Emulation
|
||
Cross-platform binary emulation with OS-level support (syscalls, filesystem). Emulate Linux/Windows/ARM/MIPS binaries on any host. No debugger artifacts — bypasses all anti-debug by default. Hook syscalls and addresses with Python API. See [tools-dynamic.md](tools-dynamic.md#qiling-framework-cross-platform-emulation).
|
||
|
||
### VMProtect / Themida Analysis
|
||
VMProtect virtualizes code into custom bytecode. Identify VM entry (pushad-like), find handler table (large indirect jump), trace handlers dynamically. For CTF, focus on tracing operations on input rather than full devirtualization. Themida: dump at OEP with ScyllaHide + Scylla. See [tools-advanced.md](tools-advanced.md#vmprotect-analysis).
|
||
|
||
### Binary Diffing
|
||
BinDiff and Diaphora compare two binaries to highlight changes. Essential when challenge provides patched/original versions. Export from IDA/Ghidra, diff to find vulnerability or hidden functionality. See [tools-advanced.md](tools-advanced.md#binary-diffing).
|
||
|
||
### Advanced GDB (pwndbg, rr)
|
||
pwndbg: `context`, `vmmap`, `search -s "flag{"`, `telescope $rsp`. GEF alternative. Reverse debugging with `rr record`/`rr replay` — step backward through execution. Python scripting for brute-force and automated tracing. See [tools-advanced.md](tools-advanced.md#advanced-gdb-techniques).
|
||
|
||
### macOS / iOS Reversing
|
||
Mach-O binaries: `otool -l` for load commands, `class-dump` for Objective-C headers. Swift: `swift demangle` for symbols. iOS apps: decrypt FairPlay DRM with frida-ios-dump, bypass jailbreak detection with Frida hooks. Re-sign patched binaries with `codesign -f -s -`. See [platforms.md](platforms.md#macos-ios-reversing).
|
||
|
||
### Embedded / IoT Firmware RE
|
||
`binwalk -Me firmware.bin` for recursive extraction. Hardware: UART/JTAG/SPI flash for firmware dumps. Filesystems: SquashFS (`unsquashfs`), JFFS2, UBI. Emulate with QEMU: `qemu-arm -L /usr/arm-linux-gnueabihf/ ./binary`. See [platforms.md](platforms.md#embedded-iot-firmware-re).
|
||
|
||
### Kernel Driver Reversing
|
||
Linux `.ko`: find ioctl handler via `file_operations` struct, trace `copy_from_user`/`copy_to_user`. Debug with QEMU+GDB (`-s -S`). eBPF: `bpftool prog dump xlated`. Windows `.sys`: find `DriverEntry` → `IoCreateDevice` → IRP handlers. See [platforms.md](platforms.md#kernel-driver-reversing).
|
||
|
||
### Swift / Kotlin Binary Reversing
|
||
Swift: `swift demangle` symbols, protocol witness tables for dispatch, `__swift5_*` sections. Kotlin/JVM: coroutines compile to state machines in `invokeSuspend`, `jadx` with Kotlin mode for best decompilation. Kotlin/Native: LLVM backend, looks like C++ in disassembly. See [languages-compiled.md](languages-compiled.md#swift-binary-reversing).
|
||
|
||
### INT3 Patch + Coredump Brute-Force Oracle
|
||
Patch `0xCC` (INT3) after transform output, enable core dumps, brute-force each input character by extracting computed state from coredump via `strings`. Avoids full reverse of transformation. See [patterns.md](patterns.md#int3-patch-coredump-brute-force-oracle-pwn2win-2016).
|
||
|
||
### Signal Handler Chain + LD_PRELOAD Oracle
|
||
Binary uses signal handler chains for per-character password validation. Hook `signal()` via LD_PRELOAD -- the call to install the next handler confirms the current character is correct. See [patterns.md](patterns.md#signal-handler-chain-ldpreload-oracle-nuit-du-hack-2016).
|
||
|
||
### Font Ligature Exploitation
|
||
Custom OpenType font maps multi-character ligature sequences to single glyphs; reverse the GSUB table to decode hidden messages. See [patterns-ctf-3.md](patterns-ctf-3.md#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016).
|
||
|
||
### Instruction Counter as Cryptographic State
|
||
**Pattern:** Hand-written assembly uses a dedicated register (e.g., `r12`) as an instruction counter incremented after nearly every instruction. The counter feeds into XOR/ROL/multiply transformations on input bytes, making transformation path-dependent. Byte-by-byte brute force with Unicorn emulation recovers the flag. See [patterns-ctf-3.md](patterns-ctf-3.md#instruction-counter-as-cryptographic-state-metactf-flash-2026).
|
||
|
||
### Burrows-Wheeler Transform Inversion
|
||
Invert BWT without terminator character by trying all possible row indices. Standard `bwtool` or manual column-sorting reconstruction. See [patterns-ctf-3.md](patterns-ctf-3.md#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016).
|
||
|
||
### FRACTRAN Program Inversion
|
||
Esoteric language using iterated fraction multiplication. Invert by swapping numerator/denominator in fraction table, run output backward. I/O encoded as prime factorization exponents. See [languages.md](languages.md#fractran-program-inversion-boston-key-party-2016).
|
||
|
||
### Opcode-Only Trace Reconstruction
|
||
Execution traces with only opcodes (no data) still leak info through branch decisions. Sorting algorithm comparisons reveal element ordering. Reconstruct by deduplicating trace, splitting into basic blocks. See [tools-dynamic.md](tools-dynamic.md#opcode-only-trace-reconstruction-0ctf-2016).
|
||
|
||
### Thread Race Signed Integer Overflow
|
||
Combat-simulation binary with thread-unsafe skill lock. Race between skill selection and damage calculation; `cdqe` sign-extends 0xFFFFFFFF to -1 (signed), causing HP overflow on subtraction. See [patterns-ctf-3.md](patterns-ctf-3.md#thread-race-condition-with-signed-integer-overflow-codegate-2017).
|
||
|
||
### ESP32/Xtensa Firmware Reversing
|
||
No IDA support — use radare2 + ESP-IDF ROM linker script (`esp32.rom.ld`) for symbol resolution. Cross-reference with public ESP-IDF HTTP server examples to identify app logic. See [patterns-ctf-3.md](patterns-ctf-3.md#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017).
|
||
|
||
### Custom VM Bytecode Lifting to LLVM IR
|
||
Transpile custom VM bytecode to LLVM IR, then use `opt -O3` to simplify (inlining, constant folding, dead code elimination). Reduces 1300 lines to ~150 lines, revealing the underlying algorithm. See [tools-advanced.md](tools-advanced.md#custom-vm-bytecode-lifting-to-llvm-ir-google-ctf-2017).
|
||
|
||
### SIGFPE Signal Handler Side-Channel
|
||
SIGFPE signal handlers create implicit control flow invisible to static analysis. Count SIGFPE signals via `strace -e signal=SIGFPE` per candidate character -- correct characters produce more signals. See [anti-analysis.md](anti-analysis.md#sigfpe-signal-handler-side-channel-via-strace-counting-plaidctf-2017).
|
||
|
||
### Batch Crackme Automation via objdump
|
||
Mass crackme challenges (100s of binaries) with identical structure: script `objdump` to extract CMP immediates and add/sub arithmetic sequences, then reverse-compute keys algebraically without execution. See [patterns-ctf-3.md](patterns-ctf-3.md#batch-crackme-automation-via-objdump-pattern-extraction-def-con-2017).
|
||
|
||
### Android DEX Runtime Bytecode Patching
|
||
Native JNI library patches Dalvik bytecode in memory via `/proc/self/maps` + `mprotect` + XOR. Static APK analysis alone is insufficient -- extract XOR key and offsets from the native `.so` to reconstruct the runtime DEX. See [languages-platforms.md](languages-platforms.md#android-dex-runtime-bytecode-patching-via-procselfmaps-google-ctf-2017).
|
||
|
||
### Fork + Pipe + Dead Branch Anti-Analysis
|
||
Fork/pipe IPC where parent writes data and exits, child reads and continues. Real validation hidden in a dead branch (always-false comparison). `strace` reveals the fork/pipe pattern; patch the comparison constant to reach hidden code. See [patterns-ctf-3.md](patterns-ctf-3.md#fork-pipe-dead-branch-anti-analysis-rctf-2017).
|
||
|
||
## Web/CTF Auth Bypass Case Notes
|
||
|
||
### Signed Cookie Key Reuse: access token to admin_session
|
||
|
||
**Case:** `class.pangbaoba.me` CTF homework system. Public `/access/<token>` route set a signed `student_gate`; the same access token also worked as the HMAC key for `admin_session`, allowing direct admin API access by forging the exact session payload shape.
|
||
|
||
**Core pattern:** A visible invite/access token is reused as a server-side signing secret. If one signed cookie can be validated offline, test whether sibling auth cookies use the same signing scheme and key.
|
||
|
||
**Triage workflow:**
|
||
1. Capture `Set-Cookie` from the gated entry route, especially cookies shaped like `<base64url-json>.<base64url-signature>`.
|
||
2. Decode the first segment; identify compact JSON payloads such as `{"access":"student"}`.
|
||
3. Recompute `HMAC-SHA256(payload_b64, candidate_key)` using visible route tokens, invite codes, reset tokens, or frontend constants as candidate keys.
|
||
4. If the signature matches, enumerate *payload shape*, not passwords: try likely authorization claims on the correct cookie name (`admin_session`, `session`, `auth`, etc.).
|
||
5. Verify with read-only endpoints first (`/api/admin/me`, settings/status/list routes) before any write action.
|
||
|
||
**Important lesson:** The first obvious payload may fail. In this case `{"access":"admin"}`, `{"role":"admin"}`, and `{"access":"student","isAdmin":true}` failed, while the backend actually checked:
|
||
|
||
```json
|
||
{"admin":true}
|
||
```
|
||
|
||
**Minimal PoC shape:**
|
||
|
||
```python
|
||
import base64, hashlib, hmac, json
|
||
|
||
def b64u(data: bytes) -> str:
|
||
return base64.urlsafe_b64encode(data).decode().rstrip("=")
|
||
|
||
access_token = "<token from /access/<token>>"
|
||
payload_b64 = b64u(json.dumps({"admin": True}, separators=(",", ":")).encode())
|
||
sig_b64 = b64u(hmac.new(access_token.encode(), payload_b64.encode(), hashlib.sha256).digest())
|
||
print(f"admin_session={payload_b64}.{sig_b64}")
|
||
```
|
||
|
||
**Validation signals:**
|
||
- `GET /api/admin/me` changes from `401 {"error":"unauthorized"}` to `200 {"admin":true}`.
|
||
- Other read-only admin endpoints return real data with the forged cookie.
|
||
- A JSON-cookie value like `admin_session=j:{}` causing `500` suggests Express/cookie-parser type confusion and confirms fragile cookie parsing; it is not required for the bypass but helps identify the stack and parsing assumptions.
|
||
|
||
**What to avoid:** Do not brute-force admin passwords or enumerate unrelated user IDs when a signed-cookie structure is visible. Work offline on signatures and use low-frequency read-only verification.
|
||
|
||
**Fix guidance:** Never use public route/access tokens as HMAC secrets. Use server-only cookie signing secrets, separate student/admin secrets, server-side sessions for admin identity, strict cookie type checks, and return `401` on parse/verify failure instead of `500`.
|
||
|
||
## Web Phishing Infrastructure
|
||
|
||
### Phishing Panel: {target_domain_a} / {target_domain_b}
|
||
**完整分析**: [phishing-case-study.md](phishing-case-study.md)
|
||
|
||
Two-server phishing infrastructure impersonating a government agency. Full victim control system with server-driven status code redirection.
|
||
|
||
**Architecture:**
|
||
- `{target_domain_a}` — Presentation layer (phishing pages, JS polling client)
|
||
- `{target_domain_b}` — Data layer (PHP+MySQL backend, admin panel)
|
||
- Both behind NAT ({internal_ip} internal), nginx, SSL-only
|
||
- Web root: `/www/wwwroot/{target_domain_b}/`
|
||
|
||
**Victim Flow:** Landing page (fake subsidy quotas) → 1.html (ID/bank card form → `submit.php`) → 4.html (PIN → `get-ayment.php`) → server-controlled staged pages (9-16) via 1-second `status_check.php` polling.
|
||
|
||
**Key Findings:**
|
||
- Admin panel at `register.php` → `qichuang.php` (login form), `list.php` (dashboard template)
|
||
- Auth via PHP session (`PHPSESSID`); `login.php` and `check_login_ajax.php` removed (404)
|
||
- **Data leak**: `db.php` returns victim name list without auth (49+ records, **no bank details** — only id/username/note/description fields)
|
||
- **No-auth write**: `save_note.php` accepts data without authentication
|
||
- `backend.php` gives SQL error suggesting admin registration endpoint (broken)
|
||
- Rate limiting on `submit.php` (multi-factor), no SQLi or session bypass found
|
||
- Status code system: admin sets 1-16, victim browser auto-redirects to `N.html`
|
||
|
||
**Infrastructure:**
|
||
| Domain | Public IP | Role |
|
||
|--------|-----------|------|
|
||
| {target_domain_1} | {target_ip_1} | Backend + Admin |
|
||
| {target_domain_2} | {target_ip_2} | Frontend (phishing pages) |
|
||
|
||
|
||
|
||
---
|
||
|
||
## 分析前预判：文件伪装与名字欺骗
|
||
|
||
### 文件后缀不可信
|
||
|
||
**核心原则：永远用 `file` 命令或 magic bytes 判断文件类型，不要相信后缀名。**
|
||
|
||
常见伪装手法：
|
||
|
||
| 伪装后缀 | 实际类型 | 目的 |
|
||
|---------|---------|------|
|
||
| `.sh` | ELF 二进制 | 让人以为是脚本，降低警惕 |
|
||
| `.txt` | PE/ELF | 绕过简单的文件类型过滤 |
|
||
| `.jpg`/`.png` | 可执行文件或压缩包 | 隐藏在图片中 |
|
||
| `.dll` | 实际是 .NET assembly | 混淆分析方向 |
|
||
| `.so` | 实际是加密 payload | 需要先解密 |
|
||
| 无后缀 | 任何类型 | Linux 下常见 |
|
||
|
||
```bash
|
||
# 正确做法：用 file 命令
|
||
file suspicious_file.sh
|
||
# 输出: ELF 64-bit LSB executable, ARM aarch64...
|
||
|
||
# 用 xxd 看 magic bytes
|
||
xxd suspicious_file.sh | head -1
|
||
# 7f454c46 = ELF magic
|
||
```
|
||
|
||
### 文件名不可信
|
||
|
||
**"DriverLoader" 不一定加载驱动，"Updater" 不一定更新。**
|
||
|
||
常见名字欺骗：
|
||
|
||
| 文件名暗示 | 实际行为 |
|
||
|-----------|---------|
|
||
| `DriverLoader` | 可能是 ptrace 注入器 / 进程 hook |
|
||
| `SystemService` | 可能是后门 / C2 agent |
|
||
| `Updater` / `Update` | 可能是 dropper / 下载器 |
|
||
| `Helper` / `Assistant` | 可能是提权工具 |
|
||
| `lib*.so` | 可能是注入 payload |
|
||
|
||
**分析时应该：**
|
||
- 忽略文件名暗示，按实际代码行为判断
|
||
- 关注 `mmap`、`ptrace`、`/proc/self/mem` 等系统调用
|
||
- 如果看到"加载驱动"但没有 `insmod`/`init_module` 调用，说明名不副实
|
||
|
||
### 静态分析不够时的动态补充
|
||
|
||
纯静态分析只能看到代码骨架。以下场景必须配合动态分析：
|
||
|
||
| 场景 | 推荐动态方法 |
|
||
|------|-------------|
|
||
| 代码有解密/解压逻辑 | 在解密后下断点，dump 明文 |
|
||
| 大量间接调用（函数指针表） | strace/ltrace 跟踪实际调用 |
|
||
| 疑似反调试 | 先 strace 看 ptrace 调用 |
|
||
| 内嵌 shellcode/payload | QEMU 用户态模拟执行 |
|
||
| 网络通信协议未知 | tcpdump/Wireshark 抓包 |
|
||
|
||
```bash
|
||
# strace 跟踪系统调用（重点关注）
|
||
strace -f -e trace=open,mmap,ptrace,execve,connect ./binary
|
||
|
||
# ltrace 跟踪库函数调用
|
||
ltrace -f ./binary
|
||
|
||
# QEMU 用户态模拟（不需要真实设备）
|
||
qemu-aarch64 -strace ./binary_arm64
|
||
|
||
# 检查反调试：看是否 ptrace 自追踪
|
||
strace ./binary 2>&1 | grep ptrace
|
||
# 如果看到 ptrace(PTRACE_TRACEME, ...) 说明有反调试
|
||
```
|
||
|
||
### 进程注入/保护壳类样本的常见模式
|
||
|
||
这类样本（如 `LinYuDriverLoader`）通常：
|
||
|
||
1. **不是真正加载内核驱动**（需要 root 权限，大多数场景没有）
|
||
2. **实际行为是进程注入**：
|
||
- `ptrace` attach 到目标进程
|
||
- 通过 `/proc/<pid>/mem` 读写目标内存
|
||
- `mmap` 映射 shellcode 到目标进程空间
|
||
3. **内嵌加密 payload**：
|
||
- 运行时解密一段 shellcode
|
||
- 解密后的 payload 才是真正的 hook 代码
|
||
4. **反调试保护**：
|
||
- `ptrace(PTRACE_TRACEME)` 自追踪
|
||
- 时间检测（`clock_gettime` 前后对比）
|
||
- `/proc/self/status` 检查 TracerPid
|
||
|
||
**分析策略**：
|
||
```text
|
||
1. file 命令确认真实类型
|
||
2. strings 看有没有明显的路径/库名/错误信息
|
||
3. rabin2 -I 看架构/编译器/保护
|
||
4. 静态找 mmap/ptrace/open 调用
|
||
5. 如果有解密逻辑 → 动态跑到解密后 dump
|
||
6. 如果有反调试 → 先 patch 掉或用 LD_PRELOAD 绕过
|
||
```
|