diff options
| author | Jakob L. Kreuze <zerodaysfordays@sdf.org> | 2024-07-13 17:55:47 -0400 |
|---|---|---|
| committer | Jakob L. Kreuze <zerodaysfordays@sdf.org> | 2024-07-13 17:55:47 -0400 |
| commit | 7f37518e4792f040a753a5d8d68d51e76cc0b2be (patch) | |
| tree | af2c8dc358f97094a6c7e10a0aadcc21ad8a5cc5 /haunt/posts/reverse-engineering-babbys-first-archive-format.org | |
| parent | 5474f016ddec56542999f8ee6c0d6c887dee75e8 (diff) | |
Initial migration to org-reader
Long-term I would like to merge the =posts-assets= and =posts= directories but
currently Haunt will crash if something exists in the =posts= directory that
can't be processed by a reader
Diffstat (limited to 'haunt/posts/reverse-engineering-babbys-first-archive-format.org')
| -rw-r--r-- | haunt/posts/reverse-engineering-babbys-first-archive-format.org | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/haunt/posts/reverse-engineering-babbys-first-archive-format.org b/haunt/posts/reverse-engineering-babbys-first-archive-format.org index 1f69b5a..d817e30 100644 --- a/haunt/posts/reverse-engineering-babbys-first-archive-format.org +++ b/haunt/posts/reverse-engineering-babbys-first-archive-format.org @@ -24,7 +24,7 @@ editor and went at it, with the [[https://github.com/vn-tools/arc_unpacker/blob/ it. #+CAPTION: A hex dump of the XP3 header. -[[./xp3-header.png]] +[[./reverse-engineering-babbys-first-archive-format-xp3-header.png]] The first section of the archive is the header. It begins with an 11-byte "magic number," used by whatever program is opening it as a sanity check. It's @@ -59,7 +59,7 @@ Huffman Coding, so let's use zlib! I proceeded to inflate the archive contents according to the header and dumped it so that I could view it in my hex editor. #+CAPTION: Sections in the hexdump of the decompressed payload with the corresponding constants in the Arc source code. -[[./binary-dump.png]] +[[./reverse-engineering-babbys-first-archive-format-binary-dump.png]] Every entry has a header containing a 32-bit magic number (underlined in red), followed by a 64-bit unsigned integer representing the size of the entry. It's a @@ -80,7 +80,7 @@ a compressed and decompressed size, and what seems to be an MD5 hash of the file. #+CAPTION: A screenshot of my terminal, showing the output of a bare-bones parser for the format. -[[./basic-parsing.png]] +[[./reverse-engineering-babbys-first-archive-format-basic-parsing.png]] Now we run into the problem of the files' contents being encrypted. I began by getting a debugger setup going to reverse engineer the binary. x64dbg isn't my @@ -89,7 +89,7 @@ was really able to get working. Of course, using the debugger alone is a little primitive. We have other tools to make reverse engineering easier. #+CAPTION: A screenshot of procmon alongside x32dbg, logging Windows syscalls that read files. -[[./catching-file-reads.png]] +[[./reverse-engineering-babbys-first-archive-format-catching-file-reads.png]] Enter procmon. It's reminiscent of strace, but it's meant for Windows and has a nice stack trace feature which helps us to locate the code that decrypts the |