Capstone

Reversing in open wide public, on Twitter

1. Introduction

CEbot is a tool that lets you disassemble binary code from your own Twitter!

How? Do this in 2 simple steps:


Few examples on tweets accepted by CEbot:


Readers might already noted that CEbot is flexible with format of the input hex-string: it is perfectly legal to have space, quote, double-quote, comma or even plus sign (+) inside the code.

For now, 8 architectures are supported: Arm, Arm64, Mips, PowerPC, Sparc, SystemZ, XCore & X86. See section 3 below for further details.


2. Real-life example

A blog entry on BostonKeyParty CTF 2014 has this PowerPC shellcode:

  shellcode_read_exec = "\x38\xa0\x04\x03"+
                      "\x30\x05\xfb\xff"+
                      "\x7c\x24\x0b\x78"+
                      "\x44\x00\x00\x02"+
                      "\x69\x69\x69\x69"+
                      "\x7c\x29\x03\xa6"+
                      "\x4e\x80\x04\x21"

The author never explained this shellcode, but we can find out by just copying its content, putting “ppc” in front, then tweet it like below (actually with one plus sign removed to fit everything in a tweet).

ppc "\x38\xa0\x04\x03""\x30\x05\xfb\xff"+"\x7c\x24\x0b\x78"+"\x44\x00\x00\x02"+
"\x69\x69\x69\x69"+"\x7c\x29\x03\xa6"+"\x4e\x80\x04\x21" #2ce

In under 2 seconds, we get back a tweet from @ceb0t with the assembly of the shellcode inside.

	li r5, 0x403
	addic r0, r5, -0x401
	mr r4, r1
	sc 0
	xori r9, r11, 0x6969
	mtctr r1
	bctrl

3. Tweet syntax for CEbot

CEbot only serves requests with proper content: the accepted syntax is simple & intuitive, as followings.

[@ceb0t] <arch> [mode1 mode2 ...] [syntax] <hex-string> [#2ce|#cebot]


This means to send the tweet directly to @ceb0t, put its Twitter ID at the front. Then, the first word in the hex-string must indicate the hardware architecture. Next part specifies the hardware modes, assembly syntax, then the input hex-string. It is possible to combine more than one modes, like when we want to reverse Mips code in 64-bit & big-endian mode. But if the modes & syntax are missing, the default modes & default syntax will be used.

Note that the hashtag #2ce (or #cebot, but only one of them is needed) can be put anywhere in the tweet, not necessarily at the end. Moreover, if we tweet directly to @ceb0t, hashtag is not required. Vice versa, mass-tweet would need hashtag, but not @ceb0t in front.

Finally, to shorten the tweet contents, CEbot supports alias, which combines arch & modes. Example: x32 is actually the alias of x86 32 (32-bit X86), m64 is the alias of mips 64 (64-bit Mips)

At the moment, CEbot supports 8 architectures with the following setup.


X86

FieldValueMeaning
archx86X86 architecture
mode16
32
64
16-bit
32-bit (default mode)
64-bit
syntaxintel
att
Intel assembly syntax (default syntax)
AT&T assembly syntax
aliasx16
x32
x64
x86 16
x86 32
x86 64

ARM

FieldValueMeaning
archarmARM architecture
modele
be
thumb
Little endian (default endian)
Big-endian
Thumb mode

Thumb (ARM)

FieldValueMeaning
archthumbThumb mode of ARM architecture
modele
be
Little endian (default endian)
Big-endian

Arm64

FieldValueMeaning
archarm64Arm64 (or Aarch64/ArmV8) architecture
modele
be
Little endian (default endian)
Big-endian
aliasa64arm64

Mips

FieldValueMeaning
archmipsMips architecture
mode32
64
le
be
32-bit (default mode)
64-bit
Little endian (default endian)
Big-endian
aliasm32
m64
mips 32
mips 64

PowerPC

FieldValueMeaning
archppcPowerPC architecture
mode-No mode specified is needed

Sparc

FieldValueMeaning
archsparcSparc architecture
modev9Sparc V9
aliasspv9sparc v9

SystemZ

FieldValueMeaning
archsyszSystemZ architecture
mode-No mode specified is needed

XCore

FieldValueMeaning
archxcoreXCore architecture
mode-No mode specified is needed
aliasxcxcore

4. FAQ