360trev
Full Member
Karma: +66/-2
 Offline
Posts: 235
|
 |
« Reply #120 on: January 05, 2013, 06:44:57 AM »
|
|
|
nyet, In my quest to get proper signature matching working i've started to re-write Andy's ME7 IDA Plug-in, close to having something now that could be used to match signatures without recompiling any code. See the IDA Plugin thread here; http://nefariousmotorsports.com/forum/index.php?topic=35.msg29602#newThis got me thinking though, and the best way to do signatures is via (you've guessed it) an external config file. This way it can also identify map locations too so later we can integrate all of these functions into an ME7 'busybox' style tool which can also do map editing, reversing of functions, etc. fully self contained from the xterm. Its ambitious but it wouldn't be too much of a stretch to get this working brilliantly for multiple purposes. T |
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #121 on: January 05, 2013, 12:27:28 PM »
|
|
|
Yea i've actually already started to put the matching stuff into a separate module but it isn't really ready for prime time.
I was hoping to get a few more matching signatures first so i can make sure the module can handle a variety of different things... in particular, it needs to be able to handle extracting a bunch of different kinds of information from the patterns, eg
xxx LL LL HH HH
and
xxx LL LL xx xx HH HH
and
xxx LL LL xx xx Sx etc.
|
|
|
|
|
Logged
|
|
|
|
360trev
Full Member
Karma: +66/-2
Offline
Posts: 235
|
|
« Reply #122 on: January 05, 2013, 03:37:58 PM »
|
|
|
nyet, Watch this space on masking  I have been experimenting and you can make 'automatic' masks based on a big instruction table being defined of all valid instructions with all relative addresses being masked in the table so every time it identifies a menomic it knows what mask to apply by looking it up in the table! this means any byte sig will work with it unmodified as it knows where to apply masks automatically! |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #123 on: January 05, 2013, 05:33:39 PM »
|
|
|
I have been experimenting and you can make 'automatic' masks based on a big instruction table being defined of all valid instructions with all relative addresses being masked in the table so every time it identifies a menomic it knows what mask to apply by looking it up in the table! this means any byte sig will work with it unmodified as it knows where to apply masks automatically! I wanted to do this a long time ago. Keep going  |
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #124 on: January 05, 2013, 09:38:24 PM »
|
|
|
So two things are holding me back right now: detecting CRC offsets in those allroad files (AA, R, S) and the ferrari bin
Also, any opinions on detecting the position of the EPK, software/hardware revisions, etc? should i just search for known strings?
eg:
EPK - sesarch for ME7.x
PartNUmber - search for 551 (wont work for ferrari)
EngineId - search for 2.7l (wont work for ferrari)
SWversion - ?? just offset from EngineID?
HWnumber/SWnumber - search for 1037
obviously a more generalizable way is preferable... or is it just not important?
Also, at this point it would be really great to get a few testers on board, preferably people who can use git and know how to compile... I dont think im ready to post .exes...
or should i?
|
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #125 on: January 05, 2013, 09:48:36 PM »
|
|
|
I'm all for testing, but my knowledge on compiling is next to nothing right now. If you post an .exe, I will put every bin I have, or can find through it and post the ones that don't work, along with a summary of those that do.
I wish I could do more, you guys are really moving on this.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
nyet
|
|
« Reply #126 on: January 05, 2013, 11:40:52 PM »
|
|
|
v0.0.4 WARNING! BACK UP ALL BINARIES BEFORE USING THIS  http://nyet.org/cars/files/me7sum-v0.0.4.zipETA: v0.0.3 had a bad bug. please dload v0.0.4 .. |
|
|
|
« Last Edit: January 06, 2013, 11:55:07 PM by nyet »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #127 on: January 06, 2013, 07:27:18 AM »
|
|
|
Why are SW version, Engine ID and so on important for calculating a checksum?
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #128 on: January 06, 2013, 12:35:11 PM »
|
|
|
If i am going to make a database of exception patterns, and i can more reliably and generally find the ids/versions than I can find, say CRC offsets, then I can use the result of that pattern match to look up the id in a database to tell me either what pattern to use for that id, or what hardcoded offsets to use.
Also, if i need to make a whitelist or a blacklist.
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #129 on: January 10, 2013, 10:01:21 AM »
|
|
|
And while we're working on ME7.1.1, anybody want to help take a stab at me7.5? It is pretty similar to 7.1.1 .. i can find the crc blocks but not the crc value offsets.
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #130 on: January 21, 2013, 08:16:50 PM »
|
|
|
based on the files posted here: http://nefariousmotorsports.com/forum/index.php?topic=1002.0There appear to be two differences that are new to me there is a large block at 16a8a-16b09 (128 bytes). i guess thats the RSA stuff he talks about there is a LL HH pair at aa46e and aa472 that is changed... must be a crc location, but its different from ME7.1 because its split into two short words rather than contiguous LLHH Unfortunately, i'd need a file that is changed in more places to see if there are patterns (i.e more than one CRC is "wrong") PLEASE, i'd love to get more help either way its a dead end until somebody has access to a version of winols (or checksum fixer) that can do BEL and can help me .. basically, change a bunch more stuff and see what the checksum routines try to fix. |
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #131 on: January 21, 2013, 08:18:10 PM »
|
|
|
Post up whatever BEL file you want, I'll change the sh@# out of it and post both versions before and after checksum correction.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
AARDQ
|
|
« Reply #132 on: January 21, 2013, 08:34:33 PM »
|
|
|
based on the files posted here: http://nefariousmotorsports.com/forum/index.php?topic=1002.0There appear to be two differences that are new to me there is a large block at 16a8a-16b09 (128 bytes). i guess thats the RSA stuff he talks about there is a LL HH pair at aa46e and aa472 that is changed... must be a crc location, but its different from ME7.1 because its split into two short words rather than contiguous LLHH Unfortunately, i'd need a file that is changed in more places to see if there are patterns (i.e more than one CRC is "wrong") PLEASE, i'd love to get more help either way its a dead end until somebody has access to a version of winols (or checksum fixer) that can do BEL and can help me .. basically, change a bunch more stuff and see what the checksum routines try to fix. Have a go at this. It's fairly significantly changed from the CS corrected file I run. Let me know if you need still more changes. |
|
|
|
« Last Edit: January 21, 2013, 08:41:40 PM by AARDQ »
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #133 on: January 21, 2013, 08:48:44 PM »
|
|
|
These are the blocks that suspect are checked by crc (S box though, not sure its same R box, ill have to check)
0) Adr: 0x018446-0x018455
1) Adr: 0x010002-0x013FFE
2) Adr: 0x014382-0x017F4E
3) Adr: 0x018192-0x01FBDC
4) Adr: 0x026A00-0x02FFFC
changing one byte in each one independently should be sufficient (i hope) to figure out where the resulting crc changes are...
|
|
|
|
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #134 on: January 21, 2013, 08:56:57 PM »
|
|
|
Here's range No. 4. I hope, anyway.
|
|
|
|
|
Logged
|
|
|
|
|
