So, how do I begin with it? I asked claude. To be honest, I’m having doubts because a robot??? How do I test that and oh, before the test part how do I freaking acquire a robot, that’s sounds expensive. So, instead of just giving up, I just directly ask Claude to give me resources and how do I begin. So while discussing with Claude some alternatives, he suggest me a robot arm and some expensive stuff but the good thing about Claude is that, you tell him you’re poor and he will suggest an alternative and that’s where we decided to start with ROS2 on Ubuntu VM.

Now that I know ROS2 is where I should start with. I createad a virtual machine running Ubuntu 22.04. After that, I installed the necessary stuff needed for ROS2.

# Step 1 — Locale setup
sudo apt update && sudo apt install locales -y
sudo locale-gen en_US en_US.UTF-8
sudo update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8

# Step 2 — Add universe repo
sudo apt install software-properties-common -y
sudo add-apt-repository universe

# Step 3 — Add ROS2 GPG key
sudo apt update && sudo apt install curl -y
sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key \
  -o /usr/share/keyrings/ros-archive-keyring.gpg

# Step 4 — Add ROS2 repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null

# Step 5 — Install
sudo apt update
sudo apt install ros-humble-desktop -y

Once done with the steps above, I proceed to confirm that ros2 is running by executing the command

ros2 -h

If running ros2 is not working, try adding ros2 to the source.

echo "source /opt/ros/humble/setup.bash" >> ~/.bashrc
source ~/.bashrc

Now that everything is already setup, we are proceeding on trying to do the ROS2 Topic Injection Attack. In all honesty, this is pretty new to me so I may be wrong or not but hey, I’m just documenting my progress.

So before everything else, what is ROS2 by the way? ROS2 is Robot Operating System Framework, ROS2 helps program/nodes to talk to each other through publish/subscribe model. So for this blog, I will be creating a talker and listener. Talker is the publisher where it will share information and publishes message to a named topic “/chatter”. The publisher does not care who listens, it will just keep on broadcasting. Next is the Listener or subscriber. It will subscribe to “/chatter” and does not care who send it, it will just listen to it and receive all message published there. The topic “/chatter” is just a named channel. Like a radio frequency, anyone can tune on it.

If we will convert it to a robot equivalent, a camera program/node publishes a message in /camera/image topic or a gps node where it publishes message on /location topic. So basically, each of this nodes, talk together through topics constantly. That’s where Topic Injection came to place, ROS2 by default has no concept of identity or trust and that what I’m going to show below.

To begin, we will need to setup a “talker”

ros2 run demo_nodes_cpp talker

Now, we are able to publish hello world message on /chatter. Next is we setup the listener, where it should be able to receive a message that is publish.

ros2 run demo_nodes_cpp listener

Running the command allows us to listen to messages publish on the /chatter and we can see base on the screenshot that it is saying “I heard”. Now that we are able to setup the talker and listener, it is now time to attempt to inject a message on the /chatter topic.

ros2 topic pub /chatter std_msgs/msg/String "data: 'YadoreZ'"

The command shows now that we are sending data to the /chatter topic. Then if we check our listener tab, we should be able to see our injected message.

Based on this screenshot, we are able to confirm that our message ‘YadoreZ’ is published on the /chatter and the listener was able to acquire or received the message. In robotics, a good scenario that I can think of is if the /location was somehow an attacker is able to provide a fake location to where a robot should go.

So that was it. My first attempt to study and blog my robotics hacking journey!

I’m following GuidedHacking Game Hacking Bible (Again) since I stopped with Game Hacking to pursue certifications stuff but this time, I promise to focus on Game Hacking instead and less certification for this year.

Since, I just came back, I decided to redo all the Guided Hacking tutorial and now, I’m on Step 5 “Cheat Engine Tutorial Video Guide”

I’ll skipped all the other process and just put my solution here.

alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(enemy)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
cmp [ebx+10],1
jne enemy
fldz
jmp originalcode+5

enemy:
mov [ebx+04],0
fldz
jmp exit

originalcode:
mov [ebx+04], eax
fldz

exit:
jmp returnhere

"Tutorial-i386.exe"+29D8D:
jmp newmem
returnhere:

This is my code injection and using this, I was able to solve the last part that should instakill the 2 enemy but will keep my 2 player alive.

So far this is the crackme that took me a while to solve. Not Verry easy (for me), since it took me a lot of time to solve this but overall, it is great! It will teach you a lot of stuff in performing reverse engineering.

Here’s the detail of the Crackme made by NoName_vs

Running the executable would display a MessageBox that says “anti nga protection”. Its confusing at first since there is no debugger or disassembler running on the background so my initial thought was maybe because this executable is able to detect that I am running it on a Virtual Machine. I find this cool as this executable is able to implement defense mechanism and I’ll be able to try to bypass those in order to properly understand how the executable works.

So before running this on x64dbg, I have everything set in mind that this executable has a lot of defensive mechanism in place!

I always disable DLL can move in CFF explorer to ensure that my breakpoints would be reliable and also I want to make sure I can see the address in Ghidra as well. If I won’t disable ASLR, the address could be different everytime I load it on x64dbg.

Ok, hear me out, initially I mentioned that I have set in mind that this executable has a lot of defensive mechanism in place so when I saw the TLS Callback on the breakpoint I was like damn there’s a TLS callback. I might as well search for it but before I took my time here I just run this on PE-Bear and CFF explorer and saw that TLS Callback do not have a value and that is where I realized that it is on gdi32full.dll not on my executable. I had to use both PE-Bear and CFF Explorer to confirm and once I confirmed, I return to x64dbg and damn I was noob haha!

Anyways, I run the executable until I am at the Entry Point of the executable. After that, I went on to perform “Search For > Current Region > String References”. Since we know the error message after running the executable which is the “anti nga protection” we can search for that.

Now, I follow the string in the disassembler.

Following in the disassembler, I was able to see some pointers loaded to RDX before a CALL instruction and the contents are strings like VMware, VBox, etc. After the CALL instruction it will perform test rax, rax then run the JNE instruction.

I noticed the Jump Not Equal instruction to be jumping to the string “anti nga protection” if condition not met. So what I did, I patched this executable simply changing the test eax, eax to xor eax, eax from all the checks that I feel relevant for me such as IsDebuggerPresent, VMWare, Microsoft, x64dbg. Once I am able to run the executable in debugger without encountering the error “anti nga protection” then I’m all good.

After patching, I run the executable again in the debugger. This time, instead of receiving an error prompt, I was able to see a string “Login:” in the prompt.

I tried inputting password such as “zerodaygamer” and received a “Wrong!” response but I noticed that the debugger does not seem to react or change? I’m not sure what happen but it feels like this prompt is not happening within the executable. Then I thought to myself there must be something wrong with I did, so I restart the executable within the debugger then input the same password “zerodaygamer” again. This time I was able to see my input in the CPU region or disassembler.

As you can see on the CPU region, there is zerodaygamer on 0x1400020B9 and 0x1400020DC. One is to store my input in rbp while the other is to clear my inputs from r15 by xor. Knowing that at 0x1400020B9, the pointer to my input is accessed then storing that to rbp, I set a hardware breakpoint on that address. Then this time I tried using “zerodaygamer” as Login creds then nothing happens. I removed the hardware breakpoint and tried setting a normal breakpoint but this time, after setting a breakpoint, the R15 on register appears to have a value which is my input zerodaygamer.

I right click the value in R15 and select follow in dump, once in dump, I select breakpoint > Hardware, Access > Byte. The reason for this is that it should hit a breakpoint whenever the application tries to access my input.

Yes, I did it! I am now somewhere in memory where the executable is accessing my inputs, probably to compare? Not yet sure.

Since I am already here and not sure what to look for next, I did what a beginner like me would do, without any idea of what’s going on. Click step over and hope that I would stumble on something. Then nothing, I reached the “Login:” prompt again without seeing something that interest me. So, rerun again! This time I look closely!

I saw a loop, but since I have step over this one earlier, I now know that this one is counting the character in my inputs but not sure why though. So this time, I copy the address and look it up on Ghidra and maybe from there I can clearly understand this part.

Upon checking the address on Ghidra, I was able to see on the decompiler that there is a check if the string contains 8 characters. Since zerodaygamer is longer than 8 character, I thought to myself, what if the length of my input is also 8 character, that’s where I thought of using ‘password’ as my input.

There’s a difference between stepping over using ‘zerodaygamer’ and ‘password’ as inputs. This time, I felt like it takes a little longer before “Wrong!” is displayed on the prompt so I keep on clicking F8 and then I reach a part of the memory where I was able to see “Access Granted” on the CPU region. This feels like I’m getting somewhere.

After hitting the call at the memory address 0x1400027B0, I saw the string letmein in my Registers and found this a little fishyyyy!! Is this what I’m looking for??? So before I try this one, I set a breakpoint on the CALL instruction then copy that address and look it up on Ghidra.

In Ghidra, I was planning on going inside the Call to FUN_140001fb0 but saw that above it, on the address 0x14000277f, there is a DATA address with value 003B3C3038213039h. I double clicked that one to go directly to it. There I right click DAT_14002f9b0 and select Data > string.

After converting it to string, it looked gibberish to me but feels like it was obfuscated since after the call I was able to see letmein on the Registers.

I now proceeded to go inside the function and when I checked the decompiler, I saw the string 0x55 and thought to myself instantly that is the XOR key for this, is gotta be it, right?

So without hesitating, I quickly open Cyberchef and then voila. I was able to see the function that deobfuscate the hex string and also saw the correct credential “letmein”

I was able to solve it but there’s something wrong. The password is correct but the author mentioned that if I’m correct, it will open a website but this one does not. I decided to redo everything but still using the ‘password’ as my password since that’s where it got me to where I am and probably see where are the other checks I overlook.

I saw another string in my register and this time it is ‘aikmnioi’. After stepping over on 0x1400028C4, that string shows up on my register. Continuing stepping over, I was not able to hit anything that would tell me how aikmnioi was deobfuscated.

I open Ghidra again and this time go directly to 0x1400028C4, from there I right clicked local_2f8 and shows references to that variable. I selected the first one which is 0x140002641.

On the Listing view, on memory address 0x14000262b, there seems to be a hex character which looks like the same like ‘letmein’. I clicked it and select convert > Character Sequence

Now that the value is change, we can see a CALL to FUN_140001fb0, which is the function that is called also in order to deobfuscate ‘letmein’ earlier. With that in mind, we can also deobfuscate tha character sequence using 0x55 as XOR key

And there it is, I was able to see and confirmed that the second password is aikmnioi, it is in reverse in the screenshot probably because of LIFO structure.

Inputting the password ‘aikmnioi’ shows an error but with string “Access Granted”.

Clicking the ‘Ok’ button will open the website the author mentioned.

That was it, finally able to solve another CrackMe. This is tougher that what I thought it would be since the tile says “Verry Easy”.

How I solve crackme is, if I got the correct password then it’s done. As long as I’m able to get the correct one then I conclude that the challenge is over. I’m not sure if this is the way but I figure that since it only ask for the password and if I provided it correctly then the challenge is done.

Running the executable would ask you to enter a password, wrong password will result to a string response of “noob” and the executable closes.

I opened this on Ghidra right away to see some symbols worth noting or even strings so I can see where I can start to look.

I tried searching for the string “noob” but was not able to see it on Defined Strings. This could mean that the string is obfuscated in some way then maybe it is deobfuscated in some point to compare the user input to the correct password then print “noob” if it is incorrect.

Since that is the theory I thought of, I opened x64dbg. Before I open the executable on x64dbg, I make sure to uncheck the “DLL can move” using CFF explorer so that the address will be the same with the one in Ghidra since ASLR randomize the Memory Address when it runs.

After loading the executable on x64dbg, I run it once to make sure it will pause on the Entry Point of the executable. Once it is on the Entry Point, I search for intermodular calls / API calls on the current region.

These are some of the intermodular calls in the memory region. I thought of setting a breakpoint on one of the iostream but I opted to manually step over and watch the registers to see if there is something interesting happening.

While I manually step over, I noticed a loop starting on address “0000000140005513”. Then a call on “0000000140005516”.

Allowing the loop to run, we can see that the registers display the unobfuscated version of the correct password which is “thisisverysecret”

If we try to input “thisisverysecret” without x64dbg, simply input it on the executable, we won’t see anything and it just closes but this time without the word “noob”.

I run this again on debugger to check if that is normal, then I saw that there is another loop that occurs starting from the memory address “0000000140005637”. If we allow the executable to run or execute this loop.

We can see that it prints or outputs “wow so pro”.

My first crackme was “Simple crackme by ionchad”. You can try it or download it here.

Solution:

After downloading and unzipping the file, it contains an exe file named “WinUtilsHelper.exe”

If you run the executable, it will prompt you to enter a license key. Inputting an incorrect value will pop a message that says invalid license.

With that information, I thought of the Windows’ API that is used to display an error message and that is the Windows’ MessageBox.

I open Ghidra and created a new project for this executable. On Ghidra, I go to “Windows > Symbol References” and Search for “Message”.

There will be 3 Location from where the MessageBoxA is referenced. I clicked on the memory address 140001031. Clicking on that Memory Address automatically update the listing view in Ghidra so that you are on that specific Memory Address.

Here we can see that the first Call to MessageBoxA was used to display the message “Debugger Detected” so we know that this executable has its own defense mechanism to prevent it from being debugged.

Now, we go to the second memory location from where the MessageBoxA was referenced. The memory location is 1400017f2.

As we can see on the Listing View in Ghidra, clicking on that memory location shows the string “Invalid License” which is the string we see upon inputting a string on the executable’s enter license key prompt.

I’m no expert in Reverse Engineering so by getting to this specific part of the function I can’t easily determine who calls who. So to try to understand it, I scroll up the listing view until I see the beginning of the function.

I saw the banner FUNCTION so I now know that I’m at the beginning of the function. This function accepts the three parameters and a lot of local variables. Like I said, I’m no expert so my thinking is maybe one of this local variable holds or store information about the license key then this value on this variable is used to compare it to user input.

I checked what value is passed on that local variable by clicking on the memory location in the XREF field on the right side of the local variable.

On local_e0 we can see that it was referenced 3 times. I clicked 1400016c0 to go to that memory address.

Here we can see the value that uses or references local_e0. One thing that stood out of the rest is the value 0x5a57494b. So technically, 0x5a57494b is placed on the stack and Ghidra placed the label local_e0 to easily determine on how many bytes it needed to add from RSP to go to that specific address in the stack.

Now if we hover the mouse in that hex value we can see that the character is ZWIK and since the stack is a LIFO structure I concluded that the license key is KIWZ.

I’m not sure if how I solve this is correct or my thought process is correct but that’s how I came up with the answer. I’m still learning and I believe I’ll improve more on how to reverse engineer stuff!

My background prior taking the exam are not that good in terms of Malware Analysis and Reverse Engineering. Although, I don’t have experience with those, I did take the TCM PMRP (Practical Malware Research Professional) prior taking the course and passed that one. My experience in cybersecurity is focus on Application Security, I do perform penetration testing of Web, Mobile and APIs but never I performed Reverse Engineering before. Since I wanted to work as a reverse engineer or have a career in reverse engineering, I decided to follow a path or rather I create a path that I will work on and that is why I enrolled on the course like TCM’s PMRP and GREM.

I enrolled on FOR610 course this January 3, 2025. My background with TCM’s PMRP do help since I already know the basic of Malware Analysis. Although, I do acquire knowledge from PMRP, the GREMs contain some topics that were never discussed on the PMRP course. Lenny, the course instructor, really do a great job at teaching the topics. I learned a lot. By the way, this is an on-demand course which meant that it is a self paced course and I get to decide when and where I will study.

After doing the course and labs, I took my first practice test on February 2025. I did the practice test with stock knowledge thinking I could easily ace this, oh boy I was wrong. I finished the exam with 63% score 10% below the passing mark of 73%. After taking my first practice test, I realized the importance of indexing. My theoretical skills or knowledge is not good, I easily forget the meaning of something but when it comes to labs / cyberlive there were no big issues at all so my focus was creating a good index and redo everything from the beginning. After a month of reviewing and creating an index, I was able to score 81% on my second practice test which is 1 week prior my exam schedule. I feel confident now and decided that I would go take the exam even though I only score 8% higher than the passing mark. My confidence is mainly because I know that I won’t have problem with Cyberlive, only with the theoretical questions.

During the exam, the first question, a theoretical one, would make my heart sink. I mean that question is something I did not encounter on the practice exam it was way different, the only think I can think of is “Dang, I rushed the exam and have not studied enough”. It took me 5-10minutes before I came up with the decision of skipping that haha. After skipping that one, I took a deep breath, calm myself and then continue with the rest of the exam. The exam is harder compare to the practice exam but like I said, cyberlive won’t be a problem to me since I also make sure that I am completely familiar with the tools and how to navigate through them. My only problem is the theoretical one, I just thought of no matter how I index, some questions are just tough. After finishing the cyberlive, I comeback to the question I skipped, I believe that I just guess those since I really don’t know anymore.

The result is 91% way higher than what I thought. I am thankful that I got this score, it was worth it. The FOR610 course is great, it taught me a lot of things I needed to be good in Malware Analysis. I am planning on being great with reverse engineering so I will continue learning whether it is enrolling on some course or reading books.

The course overall is great, from basic to advance, he will teach you all the stuff you needed in order to perform a malware analysis. He will show you how you should approach a malware, how you should contain it, and what are the stuff to lookout for. From basic to advance analysis are all taught in the course, aside from that he will also teach you on how to setup your own lab and how to check what are the services the malicious program is looking for, and what should we use in order to properly identify the behavior of this program. For me, the module is enough in order to ace the exam, the exam is great! It provides you a malware sample and then analyse it and create a report, not a multiple choice exam instead you do your own analysis.

The exam result on my end took more than a week before I received it. The reason for that is because they are currently on tight schedule with limited people at that time but some received their result earlier. I took the exam once and good thing I passed it on first try, the only thing I would recommend for the exam is to make sure you can do everything on the lab on your own and confidently create a report of your analysis. If you’re good with that, then everything should workout fine.