DavidBuchanan314

from magic_numbers import FORTY_TWO, SIXTY_NINE, FOUR_HUNDRED_AND_TWENTY
from magic_numbers import ONE_THOUSAND_THREE_HUNDRED_AND_TWELVE

print(f"{FORTY_TWO = }")
print(f"{SIXTY_NINE = }")
print(f"{FOUR_HUNDRED_AND_TWENTY = }")
print(f"{ONE_THOUSAND_THREE_HUNDRED_AND_TWELVE = }")

DavidBuchanan314

# https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md

import re
import base64

PHC_STRING_RE = re.compile(r"""
	\$(?P<id>[a-z0-9-]{1,32})
	(\$v=(?P<version>[0-9]+))?
	(\$(?P<params>[a-z0-9-]{1,32}=[a-zA-Z0-9/+.-=,]*))? # NOTE: full param parse happens later, this just checks at least one param exists
	(

DavidBuchanan314

[
	(try_except := (lambda fn, exception_callback:
		type("mycontext", (__import__("contextlib").ContextDecorator,), {
			"__enter__": lambda self: self,
			"__exit__": lambda self, a, b, c: (a and exception_callback(a, b, c)) or True
		})()(fn)()
	)),

	(throw := lambda e:
		(_ for _ in ()).throw(e)

DavidBuchanan314

(
	solve := lambda data: sum(
		abs(a - b) for a, b in
		zip(*map(sorted,zip(*(
			map(int, line.split())
			for line in data.split("\n")
		))))
	),

	example := """\

DavidBuchanan314

#!/bin/bash
# SPDX-License-Identifier: GPL-2.0-only

shopt -s extglob

unshare=0
keepresolvconf=0

#!/hint/bash
# SPDX-License-Identifier: GPL-2.0-only

DavidBuchanan314

Awesome Merkle Search Trees

Various MST implementations. Paper: https://inria.hal.science/hal-02303490/document

atproto docs: https://atproto.com/specs/repository

atproto-flavour

https://github.com/bluesky-social/atproto/tree/main/packages/repo/src/mst typescript "reference implementation"

DavidBuchanan314

I looked at a JAR file protected using JNIC, version jnic.dev v3.6.0. I haven't written a full-auto deobfuscater yet, but these notes should be useful for anyone reversing it.

The first layer is a LZMA2 compressed .dat file, from which a native library is extracted into a temp dir, and then loaded using System.load.

The sample I looked at had 4 different library versions (for different platforms/architectures), and the script I wrote to extract them looks like this:

import lzma

# from JNICLoader.java

DavidBuchanan314

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

KEY = bytes.fromhex("5c0e349a27dc46034c7b6744a378bd17")
IV = bytes.fromhex("a0b0924686447109f2d51dcddc93458a")

img = open("gz_a.bin", "rb")
img.seek(4)
length = int.from_bytes(img.read(4), "little")
img.seek(0x34)
offset = int.from_bytes(img.read(4), "little")

DavidBuchanan314

Unofficial Rabbit R1 APK Changelog

Executive Summary

The APK is stored in the firmware system partition, and gets updated as a side-effect of OTA firmware updates. Thus, a certain OS version implies a particular APK version. The OS version numbers are more compact, so I'll use them to identify APK versions below.

v0.8.50 seems like a pre-prod version that accidentally got shipped on some early devices. Like all future versions, it sends the device's IMEI during account activation.

v0.8.67 is the "launch day" firmware. It sets the OS-Version and App-Version HTTP headers. It also sends the device's IMEI during authentication.

DavidBuchanan314

Docs/Notes:

• R1 Boot Notes (notes on the boot process, and also a WIP "jailbreak" tool)
• R1 API Docs
• OTA API Notes
• APK Changelog
• zShield APK Protector Notes

Scripts: