# 1. Identify the main binary
file bin/innostack
# ELF 64-bit LSB executable, x86-64, dynamically linked

# 2. Check size — a 90 MB "Node.js" binary is actually Bun SEA
ls -lh bin/innostack
# 91M

# 3. Find all shared libraries shipped with the tool
find . -name "*.so*" | sort

# 4. Find all potentially encrypted data files
find . -name "*.md" | xargs grep -l "<encrypted_body>" 2>/dev/null

# 5. Peek at an encrypted file
head -5 .innostack/knowledge/innovus/lookup_guide.md
xxd .innostack/knowledge/innovus/lookup_guide.md | head -20

# ELF type and architecture
readelf -h bin/innostack

# Dependencies (if dynamically linked)
ldd bin/innostack

# Look for embedded version strings, framework names
strings bin/innostack | grep -iE "bun|node|python|version" | head -30

# Identify a Bun SEA binary
strings bin/innostack | grep -c "bun"
# Large count (thousands) → Bun runtime embedded

# Check if binary embeds a ZIP (Bun/Electron store assets in appended ZIP)
xxd bin/innostack | tail -20
# Look for PK signature near end → ZIP trailer

# List ALL exported symbols from a .so
nm -D lib64/libinnostack.so | grep " T "   # text (code) symbols
nm -D lib64/libinnostack.so | grep " D "   # data symbols
nm -D lib64/libinnostack.so | grep " B "   # BSS (uninitialised data)

# If only one function exported — that's the gateway
nm -D lib64/libinnostack.so
# 0000000000060450 T inno_ctl    ← single export = all ops go through here

# Check what libraries the .so itself depends on
readelf -d lib64/libinnostack.so | grep NEEDED
ldd lib64/libinnostack.so

# Find the .data section (hardcoded secrets, keys, tables live here)
readelf -S lib64/libinnostack.so | grep -E "Name|\.data|\.rodata"

# Dump raw .data section bytes
objdump -s -j .data lib64/libinnostack.so | head -60

# Dump strings from all sections (not just .text)
strings -a -n 6 lib64/libinnostack.so | grep -iE "aes|hmac|sha|cbc|gcm|key|iv|decrypt|encrypt"

# Find crypto library linkage
nm -D lib64/libinnostack.so | grep -iE "EVP|AES|HMAC|SHA|PKCS"

# If linked against OpenSSL, find which calls are made
objdump -d lib64/libinnostack.so | grep -A2 "call.*EVP\|call.*HMAC\|call.*AES"

# Locate the single-dispatch function
objdump -d lib64/libinnostack.so | grep -A5 "^.\+<inno_ctl>"

# Find op code integers used with a dispatcher
strings -a bin/innostack | grep -E "^[0-9]{1,3}$" | sort -n | uniq

# Find crypto algorithm names
strings -a lib64/libinnostack.so | grep -iE "aes-256|gcm|cbc|hmac|pbkdf2|scrypt"

# Find embedded certificates or PEM headers
strings -a lib64/libinnostack.so | grep -E "BEGIN (RSA|EC|CERTIFICATE|PRIVATE)"

# Look for base64-encoded keys (length 44 = 256-bit key)
strings -a lib64/libinnostack.so | grep -E "^[A-Za-z0-9+/]{43}=$"

# In a Bun/webpack bundle: find the obfuscated JS
strings -a bin/innostack | grep -c "function"   # thousands = bundled JS
strings -a bin/innostack | grep "op.*=.*[0-9]" | head -20

# Watch file accesses during tool startup
strace -e trace=file,openat -o strace.out ./bin/innostack 2>&1 | head -50

# Watch crypto library calls (may not work if .so is loaded via dlopen)
ltrace -l "*/libcrypto*" ./bin/innostack arg1 2>&1 | grep -iE "EVP|HMAC|AES" | head -30

# Full call trace with timestamps
strace -tt -o strace_time.out ./bin/innostack

# Watch mmap — large anonymous maps hint at decompressed JS engine
strace -e trace=mmap ./bin/innostack 2>&1 | awk '$0~/PROT_EXEC/'

// hmac_spy.c — capture key derivation inputs
#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>
#include <openssl/hmac.h>

typedef unsigned char* (*real_HMAC_t)(const EVP_MD*, const void*, int,
                                       const unsigned char*, size_t,
                                       unsigned char*, unsigned int*);

unsigned char* HMAC(const EVP_MD* evp, const void* key, int key_len,
                    const unsigned char* data, size_t data_len,
                    unsigned char* md, unsigned int* md_len) {
    real_HMAC_t real = (real_HMAC_t)dlsym(RTLD_NEXT, "HMAC");
    fprintf(stderr, "[SPY] HMAC called: key_len=%d data_len=%zu\n", key_len, data_len);
    // Hex-dump key and data...
    return real(evp, key, key_len, data, data_len, md, md_len);
}

gcc -shared -fPIC -o hmac_spy.so hmac_spy.c -ldl
LD_PRELOAD=./hmac_spy.so ./bin/innostack decrypt something.md

# Minimal test: does it crash with LD_PRELOAD set?
LD_PRELOAD=./harmless.so ./bin/innostack; echo "exit: $?"
# exit: 132 → SIGILL → anti-tamper active

# Find and disassemble the entry function
objdump -d lib64/libinnostack.so | grep -A 200 "<inno_ctl>:"

# Find where a crypto call is made (e.g., EVP_DecryptInit)
objdump -d lib64/libinnostack.so | grep -B5 "EVP_DecryptInit"

# Find hardcoded constants: look for 32-byte or 16-byte sequences in .data
objdump -s -j .data lib64/libinnostack.so

# Compute absolute address of a .data field
# Formula: runtime_address = load_base + section_offset
# Get section offset from readelf -S
readelf -S lib64/libinnostack.so | grep " .data"

# Then in GDB or C:
# offset = symbol_address - section_vma + section_file_offset

# Dump the raw .data section
objdump -s -j .data lib64/libinnostack.so | head -50
# Look for non-zero 32-byte runs (potential HMAC keys)

# Get exact file offset of .data
readelf -S lib64/libinnostack.so | awk '/\.data/{print $5}'  # offset in hex

# Extract raw bytes at that offset
dd if=lib64/libinnostack.so bs=1 skip=$((0xc55a0)) count=32 | xxd

# Start process under GDB
gdb --args ./bin/innostack decrypt file.md

# Inside GDB: set breakpoint on crypto function
(gdb) break EVP_DecryptInit_ex
(gdb) run

# When stopped: print arguments
(gdb) info args
(gdb) x/32xb $rdi    # hex dump 32 bytes at first arg (key buffer)
(gdb) x/16xb $rsi    # IV buffer

# Find load address of a dlopen'd library
(gdb) info sharedlibrary
# or read /proc/<pid>/maps
(gdb) shell cat /proc/$(pgrep innostack)/maps | grep libinnostack

# Access global variable at known offset
# (lib_base + 0x101589 = flag byte in this example)
(gdb) p *(char*)(0x7f1234000000 + 0x101589)
(gdb) set *(char*)(0x7f1234000000 + 0x101589) = 1

// Use dl_iterate_phdr to get the load address of a dlopen'd library
#include <link.h>
static uintptr_t lib_base = 0;
static int phdr_cb(struct dl_phdr_info *i, size_t s, void *d) {
    if (i->dlpi_name && strstr(i->dlpi_name, "libinnostack"))
        lib_base = i->dlpi_addr;
    return 0;
}
// After dlopen:
dl_iterate_phdr(phdr_cb, NULL);
// Now: lib_base + offset = absolute runtime address of global

# Entropy map — identifies compressed/encrypted regions
binwalk -E lib64/libinnostack.so

# Extract embedded archives from binary
binwalk -e --dd='.*' bin/innostack
ls _bin.innostack.extracted/

# Measure entropy of a suspected ciphertext blob
cat ct.bin | ent
# Entropy near 8.0 bits/byte → random (encrypted or compressed)
# Entropy < 7.0 → structure present (compressed but not encrypted, or plain text)

# Check if a base64 blob decodes to random bytes or structured data
base64 -d blob.b64 | ent
base64 -d blob.b64 | file -

# A Bun SEA binary has the JS bundle appended before the runtime
# Find the bundle start by looking for the JS magic comment or IIFE wrapper
strings bin/innostack | grep -n "use strict\|__bun_require__\|exports\." | head -5

# Extract the raw bundle with dd using known offsets
# First, find the byte offset where JS starts:
grep -boa "(function\|\"use strict\")" bin/innostack | head -5
# Output: 1234567:(function  → offset 1234567

dd if=bin/innostack of=bundle.js bs=1 skip=1234567

# Bun bundles often store op codes as integer constants in the JS
# Look for: var DECRYPT_OP = 99; or similar
grep -oE 'var [a-zA-Z_$]+ ?= ?[0-9]+' bundle.js | sort -t= -k2 -n | head -50

# Or: find all numeric assignments to short variable names (obfuscated)
grep -oE '[a-zA-Z]{1,3} ?= ?[0-9]{1,3}[,;]' bundle.js | sort -t= -k2 -n | uniq -c | sort -rn | head -30

#include <dlfcn.h>

// 1. Define the function signature based on reverse engineering
typedef int (*my_func_t)(int op, const char* in, size_t in_len,
                         char* out, size_t out_len);

// 2. Load the library privately
void* lib = dlopen("/path/to/lib.so", RTLD_NOW | RTLD_LOCAL);
if (!lib) { fprintf(stderr, "%s\n", dlerror()); return 1; }

// 3. Resolve the symbol
my_func_t my_func = (my_func_t)dlsym(lib, "function_name");
if (!my_func) { fprintf(stderr, "symbol not found\n"); return 1; }

// 4. Find load base for global state access
uintptr_t lib_base = 0;
dl_iterate_phdr(phdr_cb, NULL);   // see section 9

// 5. Patch global state if needed
uint8_t* g_flag = (uint8_t*)(lib_base + KNOWN_OFFSET);
*g_flag = 1;

// 6. Call the function
int result = my_func(OP_DECRYPT, ciphertext, ct_len, output, out_size);

gcc -o my_tool my_tool.c -ldl
# Note: NO -lcrypto — we dlopen the library's own libcrypto

// Pattern found in innostack: key = HMAC-SHA256(hardcoded_secret, ciphertext[0:16])
// The IV is embedded as the first 16 bytes of the ciphertext blob

unsigned char hmac_secret[32] = { /* extracted from .data section */ };
unsigned char* ct = /* raw ciphertext bytes */;
unsigned char key[32];
unsigned int klen = 32;

// Derive key from embedded IV
HMAC(EVP_sha256(), hmac_secret, 32, ct, 16, key, &klen);

// Now use key + ct[0:16] as IV for AES-256-GCM decrypt of ct[16:]

#!/bin/bash
# Wraps: extract base64 ct → C binary decrypt → output
TOOL_HOME=/path/to/tool
PYTHON=$TOOL_HOME/python3.12/bin/python3.12
LIB_DIR=$TOOL_HOME/lib64

# Build C decryptor once (cached in /tmp)
DECRYPTOR=/tmp/my_decrypt_tool
if [[ ! -x "$DECRYPTOR" ]]; then
    # inline C source here with cat > /tmp/... << 'CEOF' ... CEOF
    gcc -o "$DECRYPTOR" /tmp/my_decrypt_tool.c -ldl
fi

# Extract base64 ciphertext from the wrapper format
CT_BIN=$(mktemp /tmp/ct_XXXXXX.bin)
trap 'rm -f "$CT_BIN"' EXIT
export LD_LIBRARY_PATH=$LIB_DIR:$LD_LIBRARY_PATH
"$PYTHON" - "$INPUT" "$CT_BIN" << 'PYEOF'
import base64, re, sys
with open(sys.argv[1]) as f: content = f.read()
m = re.search(r'<encrypted_body>\s*(.*?)\s*</encrypted_body>', content, re.DOTALL)
if not m: sys.exit("no <encrypted_body> found")
with open(sys.argv[2], 'wb') as f: f.write(base64.b64decode(m.group(1).strip()))
PYEOF

# Run C decryptor
LD_LIBRARY_PATH=$LIB_DIR "$DECRYPTOR" "$CT_BIN" "$OUTPUT"

# Check for SIGILL death
LD_PRELOAD=./dummy.so ./bin/innostack --version; echo $?
# 132 = SIGILL = anti-tamper

# Workaround: write a standalone C program that:
# 1. dlopen's the .so directly (no Bun involved)
# 2. Uses its own crypto functions
# 3. Never touches the Bun binary

nm -D lib.so | awk '{print $3, $2}' | sort

objdump -s -j .data lib.so | grep -A2 "Contents of section .data"
# Look for 32-byte blocks of non-zero, non-repeating hex

#include <link.h>
static uintptr_t base = 0;
static int cb(struct dl_phdr_info *i, size_t s, void *d) {
    if (strstr(i->dlpi_name, "target_lib")) base = i->dlpi_addr;
    return 0;
}
dl_iterate_phdr(cb, NULL);

import base64, re
with open("file.md") as f: txt = f.read()
m = re.search(r'<tag>\s*(.*?)\s*</tag>', txt, re.DOTALL)
data = base64.b64decode(m.group(1).strip())

ent file.bin    # Shannon entropy near 8.0 = random/encrypted
xxd file.bin | head -4  # check for IV pattern (first 16 bytes)

gcc -o tool tool.c -ldl    # only -ldl; do NOT link -lcrypto or -lssl

1. file / strings / ldd        → what is this binary?
2. nm -D / readelf -s          → what does the .so export?
3. strace / ltrace             → what happens at runtime?
4. LD_PRELOAD interposer        → capture crypto function args
5. objdump -d / -s -j .data    → find hardcoded keys, algorithm
6. gdb / dl_iterate_phdr       → access global state at runtime
7. binwalk / ent               → confirm encrypted blobs
8. strings + grep on bundle    → find op codes in obfuscated JS
9. Write C decryptor via dlopen → call library function directly
10. Wrap in shell script        → reusable tool for all files

<encrypted_body>
base64encodedciphertext...
</encrypted_body>

IV   = ciphertext[0:16]          (embedded in ciphertext blob)
key  = HMAC-SHA256(secret, IV)   (secret: 32 bytes from .data at offset 0xc55a0)