reko VS x64dbg

In the zip are 3 firmwares, NXP, PD and Scalar. NXP is the USB microcontroller that's used to update the scalar firmware, and PD is for USB-C stuff. The scalar firmware's name was 28MQ780_MSTAR_MST9W00V4_V3.3.0_0x12FBF031_shad4015bb_220317.bin, which already gave me a few more data points, specifically the chip that's used, the MStar MST9W00V4. Eventually I found this extremely annoying post which had the compiler used for the chip and this page telling me that my scalar's CPU architecture was proprietary, but based on OpenRisc. It turned out that the stars had aligned or something and there were no less than 3 people interested in this particular ISA in the last 3 weeks, because someone else had asked about it and apparently a niche disassembler added partial support for it.

Reko has the ambition of supporting decompilation of various processor architectures and executable file formats with minimal user intervention. For a complete list, see the supported binaries page.

For some examples of hand-written parsers in C#, take a look at my project https://github.com/reko. There is both a C and a Pascal parser, located at https://github.com/uxmal/reko/tree/master/src/Core/CLanguage and https://github.com/uxmal/reko/tree/master/src/Core/Pascal, respectively. DM me if you're curious, I be glad to tutor.

I have never heard anyone say anything good about the Visual Studio debugger before. Now, I'm not a Windows person but I'm not gonna argue for gdb or lldb here. RemedyBG and x64dbg are the two debuggers I've heard good things about though I've never used them because, again, not a Windows person.

[1] https://remedybg.handmade.network/

[2] https://x64dbg.com/

I'd help you out but because of circumstances I have no laptop with me. You need x86/x64 debugger to do this. This one for example Find a registration procedure and look for possible brenching to other parts of code in assembly. It's probably somewhere in the beginning. Exclude code validation and export new program version.

One interesting thing you can do is download an app like https://x64dbg.com/ or cheat engine, which will let you see the memory. You can look at the process for something you’ve made and explore it. Log a memory address from your app then go find it in the tool and interpret the bytes as an integer. Find a string and see how that works. Find a pointer, read the address it’s pointing then go look at that address. You start to see how different containers store data. I find it fascinating.

If you want to also do dynamic analysis (debugging) you can use https://x64dbg.com.

close origin and download this debugger https://github.com/x64dbg/x64dbg/releases

.exe is a complex format and not something you're going to extract raw instructions from using a hexdump. What you need is a "disassembler". For Windows I'd recommend x64dbg.

Patch the DayZServer_x64.exe, change "test al, al" to "cmp al, 2". i used x64dbg (https://x64dbg.com) a good video for the whole process: https://drive.google.com/file/d/1F1A0lpumREPXtVeoTMq1HiEnvaZp-NUU/view