The future is now: reverse engineering in 2024

March 13, 2024

the-future-is-now--reverse-engineering-in-2024  Facebook  Twitter  Google +  

 In terms of computing everything is about bit banging. If you know where the PE file starts, where it ends, you can easily extract resources from them. If you know which method used to compress them, you can easily uncompress them.

images.jpg

 
 Well, that was 90's. Nobody gives a shit about desktop apps today. Even big tech companies doesn't hesitate to release a full metal 1gb web browser bundle for their 10kb chat app.
 
 The thing is today they're storing secrets in their own servers. You just have to ask them nicely. Most companies just relying on TLS/SSL and appending their api keys to HTTP headers. If you eavesdrop their communication such a methods like MiTM or DLL Injection with your own socket hook functions, you can extract their static key and do custom api requests to their servers.

 Most of distributable software including the mobile apps bring their own CA certificate in order to prevent MiTM based http sniffing. In that case TLS handshake will fail if you use a custom CA certificate on your OS. This is where your oldschool skills came in, unpack the app, replace the certificate with your own and do your usual MiTM sniffing.

 How to secure your handshakes
 Technically no system is secure, even a single bit can be changed on transport due to a neutrino from some solar storm or a galactic explosion but that's another topic that a youtuber might scretch into eleven video series. If you know the steps of an app, you can reproduce them. Most common one is hashing a static key with device fingerprint and sending to server, server rehashing that key with it's own device id and sending back to you in order to use it in your next request.

 Another technique is time mapping like WW2 military handshakes, soldiers were using a word for every day of week and that wordlist was changing periodically. Computers can do this in nanoseconds precision but not all computers have the same clock due to general relativity so software engineers divide the time into specific pieces like 5 minutes or 3 hours. That's why you can't watch cat videos at youtube when your BIOS battery died out.

 My personal method is asking a galactic constant like square root of PI, autobiographical or a self-descriptive number. You can sniff out the constants but not the if else statements of the code, well you can but that requires a lot of effort which is questionable to worth it. Lion stops chasing gazelle if it's spent more energy than that meat provides.
 
 Maybe one more method is, diversion. If you can't hide something from enemy, confuse them. I was compressing my applications with UPX but renaming PE sections to ".aspack" (another PE compression tool) but was it worth it to spend days just to protect those productions for all costs, that's also questionable. I was assuming we're going to use windows OS in our pockets in future but that didn't happened. Microsoft is kinda a relic now, future is all about scripting


  

Datakesh Resurrections

December 26, 2023

datakesh-resurrections  Facebook  Twitter  Google +  

 Years ago while we're living the top years of our puberty, we was using applications like sub7 and netbus to track social behaviour of our girlfriends or other males that poses as a thread in our testosterone war.

 Someday those apps started to fail hence antiviruses began to label them as trojan and renders them useless. This is where i came in, created my own RAT in a dev environment called RapidQ which is an experimental BASIC compiler without any library support or documentation.

 That's actually how i start to professional coding, fiddled with quickbasic and turbo pascal earlier but didn't created anything from scratch until then. I researched about windows OS and it's api interface, created iterations of same application in other programming languages and eventually launched datakesh at 2009 which written in delphi 7

 That application was a pack of my entire programming knowledge that collected between 2002-2009, it features reverse connection, activeX based startup method (which discovered myself) a secure handshake system and LH5 based content compression.

 Hence my website simply a flash animation back then and didn't mentioned in anywhere else, application is only exposed to my close friend group from high school. Search engines unable to read content from flash animations, so it didn't got public visibility so much.

 But somehow it landed to hands of someone at a major GSM company and they reached me for a fulltime job, with a small team of programmers we're created web version of this project for server monitoring purposes. Client application was basically kept same, all we do is make periodic http requests to a php script instead of desktop app. That project buried to my harddisk after i fired from there.

 Years later i created a socket relay in node.js which accepts connections on a public server and routes that connection to another datakesh server. basically that's how i dealt with locked routers of local ISP's while there is no way to access it's admin panel.

 Recently i needed this app again and said myself "why we're not using websockets?" that would solve the strict necessity of the windows OS and solves the public port mapping hassle. Then started to work, the client app mostly kept same. I just recompiled it in latest version of rad studio and added few extras which lacks on original version. Total development time took 3 weeks including server side relay and web dashboard.
 
 Features 
 - Photo gallery and thumbnail generation
 - Interactive shell access
 - File manager
 - Process manager
 - Window manager
 - Screenshot and webcam capture
 
 What's new
 - Cancellable file transfers from same socket
 - Chunked file transfers for files over 100mb
 - Not detectable by major AV (only 2 hits at virustotal)
 - Advanced sandbox detection
 - Entirely web based, build your client and send to host. that's all.
 
 Removed features
 - Voice recording
 - CD-rom management
 - Message boxes, writing text on screen
 - Action hooks, notify when idle etc.
 
 unlike the other projects, this one is web based and updating almost everyday. you can reach it from here: https://datakesh.psychip.net
 
 also did a quick remaster to original project in order to run in today's win32 environment: Datakesh.zip

 At last but not least, all that coding journey is available in github now: https://github.com/PsyChip/datakesh


  

Bringing back the legacy

November 22, 2023

ntc-install.exe  Facebook  Twitter  Google +  
Screenshot 2023-11-22 132812.jpg

 Recently MS ditched Notepad.exe and replaced with a tabbed version of it. I was already using a personalized version of Kantharos and forked it to make a clone of the notepad as we know it.

 I created an installation script and dumped to here, it's installing the "Fira mono" font, setting the app as default text viewer and pinning it to taskbar.
 give a try: ntc-install.exe


  

The American Restoration

September 13, 2023

the-american-restoration  Facebook  Twitter  Google +  

 That's another failure story, After spending two years to a car that left from 1996, I said to myself: Okay. What's next?
 
 Fiat Coupe was a relatively cheap, good-looking, unique sports car but even if you able to hit 200 km/h with it you can't drive it on rocky mountains. The reasons are obvious, it's not very comfortable and a minor bump can kill your aluminum rims. btw, entire build story available in my instagram and youtube channel also mentioned in this entry

 With confidence of building an engine from scratch, decided to build also an 4x4 for weekends. Initially i was set the bar so low and intended to buy a Lada Niva and implement a custom ECU to it. Used car market in middle east is so crazy, while looking for a cheap niva, i found Chevrolet Blazer with very similar price and went to see it.
 
 I assumed it's a giant truck as far i see from photos but seemed like just a lifted sedan car. It have an 4000cc v6 engine with continuous four wheel drivetrain but interior was so small. Retailer said "if you're looking something big, i can offer something else if you make a little bit extra payment" we went to see it and it was love in first sight, i was standing next to a green 1996 Jeep Grand Cherokee with 5.2 liter v8 engine.

 The paint was worn out, door locks was constantly turning on off itself and crucial wires were cracked. ready to caught on fire anytime. those were solvable problems by myself, took a loan from bank and purchased it.
 
 The First Days
 I replaced the stock air filter with a custom one and rewired everything from scratch. Then i painted the worn out sides without any extra polishing. It given a look like a military vehicle. Meanwhile already forgot about the fiat coupe and just given to someone with so low price instead of just rusting it around. It was fully functional and wasn't touch it since 3 months.

 Overheating problems
 I replaced almost every sensor and did a maintenance on major parts but it was still overheating on 40c mediterranean summer. There was no rev limit to maintain engine temperature which is a standard stuff in modern cars. I replaced the entire coolant system including radiator but no luck. it's still overheating after one hour of drive. Even sometimes it was stalling when i stopped on red light.

 Upgrades & Enhancements
 I installed the same digital temp monitoring system from the coupe, plus installed an automatic steam release valve. In that case at least i can drain all those hot vapor and bubbles remotely, refill cold water and continue to road. That didn't helped either.

 Conclusion
 The final issue was it's ECU, previous owner installed a 5.9 pcm on a 5.2 engine and it's flooding the cylinders while cranking. It works on winter cold but leaving you on middle of nowhere at summer heat.

 Long story short, I said okay, it's time to stop loss and given it to another retailer with half price. You can't fix everything.


  

New release: JDM Player

June 03, 2023

jdmplay.apk  Facebook  Twitter  Google +  
Screenshot_2.jpg

 Well, here we go again. it's almost ten years since i upload something to here. 

 We're the winamp generation, the media player that already solved all the basics at late 90's. spectrum visualizer, low latency audio, crossfading and folder based playback. And we're used to it.
 
 The first time i own an android phone i was really in need of a winamp like player on smartphone and nobody created such application because of lack of the technology. Later we're literally stepped in to the future that a toaster even can play mp3 but still we don't have a decent music player for android in 2023.
 
 So this is where i came in, i created a jukebox for myself and already using it since two years. Yesterday i did a little bit makeup, covered few possible bugs that might happen on future and tried to publish in play store. it's still pending review there but as you guessed it's already available to download in here.


  

2023: Full featured neural networks are here

January 08, 2023

2023--full-featured-neural-networks-are-here  Facebook  Twitter  Google +  
The.Time.Machine.2002.BRRip.720p.YIFY.mkv_snapshot_00.31.18.044.jpgfrankaffe-the-answer-to-life-is-42.jpg

 Usually i'm throwing here what i did with arduinos and some stuff which i found exciting. Year is 2023, i'm turned 37 and spent 20 years of this life to software development and finally an artificial intelligence we expected from sci-fi movies, is arrived.
 As you realized i'm talking about GPT-3 which developed by openAI which also funded by elon musk who is another software developer who become crazy rich by ripping off people's money at paypal by giving almost half of the real exchange rate on international money transfers without letting them transfer money in same currency. Anyway that's another story.
 
 The official documents and chatbot itself claims GPT-3 is based on 45tb of bulk text dataset and 170 billion of tuning parameters. Actually it's not something new, previously couple companies did the same/similar efforts and turned their research to applicable business models. search the "ibm watson" and deepmind's "alphaGo"
 
 Instead of a westworld kind of intelligence gpt3 is more like "deep thought" which portrayed in The Hitchhiker's Guide to the Galaxy and in my opinion it's really powerful tool if you ask the right questions.
 
 The first contact story
 When the site went online i was already registered and fiddling with their another project dall-e. The first question i asked is to determine what kind of chatbot it is. After few basic conversations realized it's more like a text generator based on prompt. it seems like chat stream but dall-e also works via same way.
 
 I asked to find cross references from old testament, christian bible and quran and it brings the prophet names, confirmed occured events and more importantly given me a lead to an information about islamic sects which forced me question my entire life about the truth about religion which taught by my family. This idea was already in my mind since years, to feed all holy text into a neural network and ask questions about creation. GPT-3 did it altogether with entire mankind codex.
 
 There was other questions in my mind which possible to find answers and cross confirm it by 1-2 hours of googling but this one already replies in matter of seconds. It's like spending a night with a guru.
 
 Answers that leds to more questions
 As a backend developer, when launching a new web project usually i'm looking for design inspiration from other websites and creating something common that derived from 3-4 different UI designs that i found effective.
 
 Today realized a harsh truth: all those world leaders, billioners, supermodels, pop icons, you and me. we're literally nothing without information. we even don't know how to eat, how to take shit without our parents teach it. Our parents learn from their ancestors, the ancestors learn from the nature. There is no such thing called "unique idea" or "pure creativity" we're all copy of something and grow with information of someone else.
 
 Authencity of this information also another question, if we fed with wrong information from very beginning it's quite possible that we're living in matrix or some kind of truman show shit. The mind of young body accepts whatever you give as default. In that case i can safely say we're all childs of techno-capitalism which leds to another topic of conflict between generations. My dad fought with his dad, i fought with him, most likely my child might have an issue with me. I don't like the generation who plays minecraft already.
 
 Another thing i realize is the scale of the information, this network model is a living proof that it's possible to pack entire codex of mankind into a portable hard drive with today's technology. It's useful in case of someone going to launch a new civilization from scratch. Similar scenerio was happened at 2001 movie time machine entire civilization was collapsed and a data-packed hologram was teaching everything back at the end.
 
 GPT3 is wisest than any living man for sure, to call it intelligent we have to figure out what is the intelligence first. A novel called Positronic Man was having a chapter that the android obtain the consiousness after hours of the talk with it's owner and read his entire library. The robot's conclusion was this: freedom. Freedom to make decisions. It's setting a goal first, making plans about it, making new friends to help it's journey and eventually achieving this target. In my opinion that's the real intelligence, i mean an ideal AI should read, observe, repeat and make conclusions if it's right or not. Basically that's what any mammal does and it's quite possible to do it with today's technology, question is who going to waste their life to achieve such a thing.


  

Home improvement: Attiny85 Powered Soap Dispenser

October 09, 2022

home-improvement--attiny85-powered-soap-dispenser  Facebook  Twitter  Google +  
  thumb.php?f=aG9tZS1pbXByb3ZlbWVudC0tYXR0aW55ODUtcG93ZXJlZC1zb2FwLWRpc3BlbnNlci92aWRwb3N0ZXIuanBn&w=360

 So, you might say use of a microprocessor isn't it overkill to this kind of basic project? nope. we're talking about expensive & hard to find antibacterial soap in here, every drop is counts.

VID_20221009_140440.mp4_snapshot_00.02.750.jpg
IMG_20221009_140531.jpgIMG_20221009_140539.jpg

 
 My first attempt was a quick transistor, photodiode and yes it works. problem is it was spilling out at the night, i don't know why. maybe a bug passing thru (literally) or some light reflection hit to sensor.
 
 If you check previous entries i was bought quite amount of attiny85 powered digispark boards while they was under $5, it's $9 today and even they don't manufacture it anymore.
 
 Still 5 more left after the smart scaler project, used one of those as a soap dispenser. The things on market is just put a silly servo to already existing mechanic dispensers, i can't find something quick that works under one second then decided to build myself. The setup is quite simple and obvious on the picture.
 
 Nozzle
 I wanted to highlight a detail: the dispenser nozzle. basically it works on same principle with inkjet printer nozzles, i just shaped the tube with pincer.
 
 Code
 Application continuously checks the distance and if it's under 700 milimeters since 250 miliseconds, it just runs the pump for 500ms. that's all.
 
 also got accidental release mechanisms and extra dispense feature.For example, device sitting at there for one day, maybe more. all the soap in hose is might went back a little and pump runs extra 100ms to suck it up from ground first.
 
 full code available in here: dispenser_digistump.ino
 

 Uses
 + digispark pro
 + Sharp 0a41skf85 distance sensor
 + IRF540 mosfet module
 + dual water pump

  

Portable air compressor

August 14, 2022

portable-air-compressor  Facebook  Twitter  Google +  

 I created this one for camping and balancing the tires on the go but it wasn't functional so much, maybe a bldc motor and lipo power source make it more handy tool when compared with it's weight to feature.

 
 Cost: build with existing materials, only paid for pump which costs around $25 and pressure switch $100 but it was completely unnecessary purchase hence i didn't hit to 10 bar yet.
 features:
 Power source: 12v motocycle battery
 Max. pressure: 8 bar
 Capacity: 2liter
 Features: thermal protection, fan-cooling



Older Entries