New Transformers are Crazy Hard

When I was ten, Transformers where not that hard to transform.

Meet modern Bumblebee,

This transformer was crazy hard to transform, in the couple of days I was visting with the 4 year old owner, the head “popped off” multiple times, and I couldn’t get it back on without feeling I was going to break the toy. Lucky said child’s mother had the magic touch.

But transforming challenge aside, it was a pretty cool model/toy. Just not like the Starscream or Optimus Prime of my days gone by….

Expectation Stress

Wow, since doing the easy work of decrypting the newer Nikon firmware, I’ve felt an immense pressure to pull another rabbit from the hat, when in reality the last reversing engineering project I worked on took years (2-5), and thus I feeling real burnt out. a) due to trying to find the next “cool” insight, and 2) wanting to be part of the action, and keep up with others are finding.  (the index scheme is an insiders joke)

To this end, I point would-be-helpers to nikonhacker.com, I’ve been contributing there, as best I can.

It’s very addictive having such large inflows of traffic to your site/blog, that I was reluctant to redirect it, but I have also felt since November a presure not to post stupid stuff like I used too, or am about to post, thus have been silent (besides the travel and working on things that are not up for chatter).

So there’s my Nikon update…. I have been having a good family holiday..

Monopoly Deal

The family was given Monopoly Deal for Christmas, and it’s a fantastic game.

My first game was a six person double deck game, which was slower, and very brutal. Since then I have played many a game with Jacob (single player) and it’s fast and fun.

In fine to twenty minutes, you can compact all the fun and rage of the full 4 hour game, but it’s done, and you can move on so much quicker. It has stealing, ripping people off, double crossing, saying no (it’s a card, but it the best feeling in the game rejecting a big play, just watch out for the reverse no,back at you…).

It’s a very fun game, and while there it can have all the rage of the original it, also can be started and finished within 30 minutes.. so many hands can be played giving the “balance” missing from Monopoly.

IDA Script: Fixing 16bit pushed data segment references

A good friend has started reversing an old 16bit Borland C++ (3.1?) program, and had lots of stack push data segment offsets that were not correctly cross referencing.

After telling him the shortcuts for manually fixing the issue (press O for the data segment, or Alt-R for any segment offset), he wrote an IDC script to do it en mass.

Thus (made up example code)


push ds;

mov ax, 0x1234;

push ax

should look like:


push ds;

mov ax, ds:dword_1234;

push ax

Here’s his script:

#include <idc.idc>

static main()
{
    auto seg, loc;
    auto movloc, movtarget;
    auto xref;
    auto dsegbase;

    dsegbase = SegByName("dseg") * 16;
    Message("dsegbase=%x\n", dsegbase);

    Message("========================================\n");
    seg = FirstSeg();

    while(seg != BADADDR )
    {
        Message("----------------------------------------\n");

        loc = SegStart(seg);

        if( Byte(loc) != 0xCD || Byte(loc+1) != 0x3F)
        {
            Message("Fixing indirect push [ds:xx] refs from %s\n", SegName(seg));

            while(loc != BADADDR && loc < SegEnd(seg))
            {
                if (GetMnem(loc) != "push" || GetOpnd(loc, 0) != "ds")
                {
                    loc = NextHead(loc, BADADDR);
                    continue;
                }
                loc = NextHead(loc, BADADDR);

                if (GetMnem(loc) != "mov" || GetOpType(loc, 1) != o_imm)
                {
                    loc = NextHead(loc, BADADDR);
                    continue;
                }
                movloc = loc;
                movtarget = GetOpnd(movloc, 0);
                loc = NextHead(loc, BADADDR);

                if (GetMnem(loc) != "push" || GetOpnd(loc, 0) != movtarget)
                {
                    continue;
                }

                // At this point, we know we're pushing a [ds:x] combo.
                //Message("%x: mov %s, %s\n", movloc, movtarget, GetOpnd(movloc, 1));

                // Abort if there already exists a Dxref
                xref = Dfirst(movloc);
                if (xref != BADADDR)
                {
                    continue;
                }

                Message("  Updating %s:%04x\n", SegName(seg), (movloc - seg) & 0xffff);
                OpOff(movloc, 1, dsegbase);
            }
        }

        seg = NextSeg(seg);
    }
}