From 6e9017393b7b0be52ab1fd9291db436ac1a12464 Mon Sep 17 00:00:00 2001 From: Val Date: Wed, 1 Mar 2023 23:43:02 -0600 Subject: [PATCH] Hollywood: Add first impressions (yikes!) --- 19-Hollywood/notes.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/19-Hollywood/notes.md b/19-Hollywood/notes.md index e69de29..770061b 100644 --- a/19-Hollywood/notes.md +++ b/19-Hollywood/notes.md @@ -0,0 +1,14 @@ +# Chernobyl + +### First impressions: +- Location-independent (my god these relative jumps) +- Copies itself around in memory + - Tries to be cheeky, and overwrites the original memory + - Sucks for it, my disassembler is so bad the instructions are wrong anyway + - A top-down disassembly is not possible here. +- Does long jumps by calculating large pc-relative offsets, pushing pc, and BR'ing them + - Never used Ghidra before, but it really doesn't like this. It crashed so hard. +- Decrypts_one_byte a lot -- and there's a blob of garbage in RAM. How fun. + - Do I need to find an inverse of the encryption algorithm? + +#### TL;DR: Everybody knows it sucks