BC MACHINE LEARNING
Saved by @Mollyycolllinss

Okay, doing my first baby steps with r2frida (which combines the power of @radareorg and @fridadotre).

Gonna share my progress in this thread (live, so keep calm).

The goal: Runtime inspection of data sent out by TikTok !!before!! it gets encrypted

1/many

 First of all, we do not start from zero. I got some prior knowledge from past reversing attempts and want to share some important facts.

TikTok's (log data) encryption is accomplished by a native library. The Android Java code just serves as proxy function to the native function
The decompiled code for the respective native JNI function of an older TikTok version looks something like this, but in this example I use the most current TT version (no statical analysis done, yet)
In case you never reversed native libraries which were build to interface with Android Java layer via JNI, I highly suggest the entry level introduction on the topic by @maddiestone

https://t.co/T63vo3N4fw
Before we start, I want to pinpoint some important aspects (which are also covered by Maddie's videos).

1) Unlike raw C-functions, JNI functions like the one showcased above, receive pointers to complex Java objects .

F.e. a function receiving a String on the Java layer...
... would receive a pointer to a 'jstring' on the native layer (not a zero-terminated C-String).

In order to retrieve a C-String, to go on working with it in the native code, some translation functionality is required. This functionality is provided by the ...
JNI (Java Native Interface). The JNI environment is passed in to JNI functions as first parameter.

If you look at the example screenshot again, you see exactly this. Functions provided by the 'env' pointer are used to parse the Java function arguments (f.e. jByteArrays) ...
Once the raw data is converted to a more C-ish form, it gets passed to a inner function 'ss_encrypt' in my example. The inner function, in this case, is a pure C function and thus receives only C-style parameters (also no 'env' parameter, so it would not be able to access JNI)
A 2nd important aspect on JNI libraries, covered by @maddiestone

2) There are two ways to expose JNI methods from a native library:

a) export them with proper naming convention, so that JNI could recognize same on library load
b) use the JNI functionality 'registerNatives'...
... to register the JNI functions once the library gets loaded.

The second method of registering methods is wel suited for obfuscated code, as the methods neither have to follow naming convention, nor do they have to be exported.
As you might expect, TikTok uses the 'registerNative' approach. The screenshot below shows log output from a custom tool, which monitors JNI methods registered by instrumented Android apps (TikTok's encryption method in the example)
If you would decompile the Java part of the TikTok apk, the encryption functionality (on an older version) would look something like this:
The Java method 'm18421a' receives a Java 'byte[]' and a Java 'int' as parameters and returns a 'byte[]', again.

Internally, this data is forwarded to the native JNI method 'ttEncrypt'.
The important aspect about this, is that the native 'ttEncrypt' JNI method has to accept those exact parameter types and thus has to "register" with a proper method signature.

We already saw this signature in a previous screenshot
The last line from the screenshot above, shows 3 things the native code has to provide for each method, when calling register natives:

1) the call address of the native function implementation (0x7d70d1d5 in example)
2) The function name (ttEncrypt)
...
3) The method signature, which is '([BI)[B' in this case and translates to:

'(' start of parameters
'[B' byte[]
'I' int
')' end of parameters
'[B' byte[] (return value)
So we keep this in mind: Even if the native library does not export the encryption method, it has to store the 1) funtion address, 2) name and 3) signature in a data structure, in order to provide it to 'registerNatives' once the library gets loaded by JNI
We now know almost everything we need, in order to head over to r2frida, except some important facts on my test setup:

- the app is inspected on a physical device, running Android 9
- the device uses a !!32bit!! ARM application core
As I am new to r2frida, chances are high that things could be achieved in an easier ways.

Now to get started, I already have the latest @fridadotre server running on my USB connected android device and 'frida-ls-device' shows it being ready-for-action
So let's spawn a fresh TikTok instance with r2frida, using the following command
The command 'launch'es the process, on the attached frida 'usb' device with the device id '4c197256' and the process's package name, of course is 'com.zhiliaoapp.musically'

Instead of 'launch', two other options could be used:
- 'attach' (would attach to an already running process, given by name or PID)
- 'spawn' (like 'launch', but the process would not be resumed automatically after attaching)
So for the warm up, let us use the Frida functionality, which alllows enumerating loaded Java classes. This nicely combines with the r2 syntax (concatenation of single-letter commands, '~' for grep)

Important: commands targeting the r2frida plugin have to be prefixed with '\'
The r2frida command to list classes is '\ic' (note the backslash prefix). The unfiltered result would be a bit overwhelming ...
... so we grep for classes including the term "crypt"
The '\ic ' command lists the !Java! methods of the respective class
The signature of the static method 'EncryptorUtil.a' should look familiar to us (if you read the first tweets). It represents the Java layer of the encryption method and is called 'a' in this version
Note: The information above would be enough, to Intercept the method from the Java layer (f.e. with @fridadotre or Xposed), in order to inspect the call arguments (the byte[] parameter represents the plain data before encryption)
... but we are here for the native layer and to inspect data at runtime, right?

So lets search the whole address space for our native method name 'ttEncrypt'

Note: If you'd use r2's ascii search nothing would happen, you have to use the '\' prefix to search with r2frida
The search ends with two hits:
The screenshot below shows, that the attempt to print a hexdump from the address of the first hit fails with r2, while r2frida (backslash prefix) works.

Reason: The memory region was not populated when r2 was started (encryption library was loaded after process launch)
I solved this issue like this:
1) Quit r2
2) Open r2 with r2frida, again, but this time **attach** to the already running process

et voila ... the memory offset is mapped and dumpable with 'px' (without backslash prefix)
Note: The last step is not necessary for a data hexdump, as you could still use '\px', but it turned out to be useful when it comes to printing the disassembly of "late loaded" code regions. This is because I sometimes struggled with '\pd', but 'pd' worked (+ various r2 views)
Having a closer look at the first hit of out string search for 'ttEncrypt', we notice that it is directly followed by a C-string with our method signature.

So chances are high, that this data is part of the structure which gets handed in to 'registerNatives'
Reminder: in order to register the 'ttEncrypt' method to JNI, the 'registerNatives' method requires a structure containing
- method name (C-string)
- method signature (C-string)
- method pointer (native pointer)
So the next step would be to search the process memory space for cross references to the address of this method name string (0x8448b74c). As I haven't applied any auto analysis, I use a simple hex search for this (in my case the byte order of the address has to be reversed ...
... to account for the architecture endianess).

The result is promising: Only one hit, for a search across the whole address space:
Printing the first 12 bytes from this XREF offset, reveals 3 pointers again (reversed endianess):

- 0x8448b74c (expected, method name pointer)
- 0x8448b756 (ptr to signature string, yay)
- 0x8448b1d5 (likely pointer to JNI method implementation)
So the layout of the 3 pointers from above speaks a clear language. Very likely this is the data struct passed in to 'registerNatives' and thud 0x8448b1d5 points to the native implementation of 'ttEncrypt'
Sorry, before going on I have to insert a small excurse on adressing/instruction sets on arm 32 (specific to my test setup). Anyways it is crucial:

Arm 32 supports two instruction sets "ARM mode" (32bit) and "Thumb mode" (16bit) which could be used interchangebly
In order to distinguish if a function call target (branch) should be interpreted as ARM or THUMB, the least significant bit (LSB) of the function address is taken into account

For ARM the LSB is 0 (even address)
For THUMB the LSB is 1 (odd address)
The actual instruction ALWAYS resides on an odd address.

This means the function address 0x8448b1d5 homes code in THUMB mode (16bit), while the first instruction resides at 0x8448b1d4

(sorry if it gets a bit complicated, will be clear in a second)
So if we print the disassembly at the (assumed) 'ttEncrypt' address, things look a bit weird
... this is because instructions are interpreted in ARM mode (32bit).

Lets fix this:
... looks much better, still the first instruction is off-by-one 🤣

No seriously, as explained, on arm32 we have to disassemble at [THUMB mode address - 1] = 0x8448b1d4
Nice, this looks like a proper function stub (note how the callee stores reg values on the stack, before moving on).

Now to get a feeling on how often this function is called, lets use 'r2frida' power to trace it.

Important: The thumb address has to be used here!!!
The resulting output of the '\dt' command, which places the trace hook also indicates that the function address maps to an offset in 'https://t.co/fxhDnQke2o' ... let us call this a "nice confirmation"

Some actions in the TikTok app ... trace logs for ttEncrypt-calls arrive
... cigarette break ... stay tuned (if the app crashes meanwhile, I'll start from scratch)
Let's remove the trace hook for now, with '\dt-*'
Remember my screenshot of a decompiled 'ttEncrypt' function from an older TT version. We traced the corresponding functions.

Trying to runtime-parse the function parameters, which represent Java object instances would be insane (maybe impossible)
... luckily, at least the old implementation, internally called a method 'ss_encrypt' which received a c-style byte array pointer and an integer representing the length as first two parameters.
It would be way easier to runtime-inspect these
Lets take a closer look on the disassembly of our assumed 'ttEncrypt' function, by seeking to its offset with 's 0x8448b1d5' and switching to a more suitable r2 view with uppercase 'V' command (press 'p' till the view changes to disassembly)
The view from above allows scrolling through the functions code with cursor keys. Most important: calls to other code parts (branches) are printed bold and suffixed with [1], [2] ...

Hitting [alt+1] moves us straight to the marked branch offset:
The code above looks not like a legit inner function (we do not care for alignment and inspect the next branch).

Hitting 'u' returns us to the parent function, followed by [alt+2] which brings us into the 2nd branch
The 2nd branch at 0x84483aa4 looks better (proper function stub). We could easily drift back to the static analysis world, to find further evidence for it being the inner 'ss_encrypt' function. But hey, we are working with instrumentation, so let us just inspect the calls
Remember: While we disassembled at 0x84483aa4, the code is THUMB mode. Thus the proper tracing address would be 0x84483aa5 (LSB set to 1), unlike you like crashes (restarting here would not be funny, 'cause thanks to ASLR all function offsets would differ)
In contrast to our first tracing attempt, we use the beautiful command for formatted tracing, which allows us to print out function parameters for each call in a predefined format.

Command syntax:
The screenshot below shows how I placed my trace hook. The 'pppp' means that the first 4 function parameters should be printed as hex values (pointers) for each call.

Ultimately 2 calls get logged

More from Machine learning

Pratham Prasoon
Pratham Prasoon
@PrasoonPratham
There are several skills needed for learning machine learning that no one talks about.

Here are some of them.
(from what I've learned over the past two years)
🧵👇

This thread aims to introduce to you some of the skills often ignored for learning machine learning but are actually very important.

These skills will enable you to learn concepts quickly and more efficiently in this field.

(2 / 9)

1⃣ Reading

Probably one of the most underrated skills on this list.

In machine learning, you HAVE to read a lot of articles, papers, documentation, and whatnot.

It is mostly due to the theoretical nature of this field that reading is an important skill to have.

(3 / 9)

2⃣ Strong fundamentals in programming

Machine learning is just a lot of programming mixed with math and data.

Having clear programming fundamentals is crucial for this field.

I highly suggest you learn about these if you are using Python for machine learning.👇

(4 / 9)

- Object oriented programming in Python :Classes, Objects, Methods
- Lists & List functions
- Dunder Methods
- List comprehension
- List slicing
- String formatting
- List, Dictionaries & Tuples
- *args,**kwargs

(5 / 9)
MACHINE LEARNING
Fionna O'Leary, \U0001f56f\U0001f1ea\U0001f1fa
Fionna O'Leary, 🕯🇪🇺...
@fascinatorfun
Thanks for this incredibly helpful analysis @dgurdasani1

Two questions. 1/ Does this summarise the AZ published data :
The plan is to extend the time interval for all age groups despite it being largely untested on the over 55yrs, although the full data is not yet published


Do we have the actual numbers of over 55yr olds given a 2nd dose at c12 weeks and the accompanying efficacy data?

Not to mention the efficacy data of the full first dose over that same period?

I’d quite like to know whether I am to be a guinea pig & the ongoing risks to manage

You attached photos of excerpts from a paper. Could you attach the link?

Re Pfizer. As I understand it the most efficacious interval for dosing was investigated at the start of the trial.


Here’s the link to the

I’ve got to say that this way of making and announcing decisions is not inspiring confidence in me and I am very pro vaccination as a matter of principle, not least because my brother caught polio before vaccinations available.
MACHINE LEARNING
Advertisement
Alejandro Piad Morffis
Alejandro Piad Morffis
@AlejandroPiad
This is a Twitter series on #FoundationsOfML.

❓ Today, I want to start discussing the different types of Machine Learning flavors we can find.

This is a very high-level overview. In later threads, we'll dive deeper into each paradigm... 👇🧵

Last time we talked about how Machine Learning works.

Basically, it's about having some source of experience E for solving a given task T, that allows us to find a program P which is (hopefully) optimal w.r.t. some metric


According to the nature of that experience, we can define different formulations, or flavors, of the learning process.

A useful distinction is whether we have an explicit goal or desired output, which gives rise to the definitions of 1️⃣ Supervised and 2️⃣ Unsupervised Learning 👇

1️⃣ Supervised Learning

In this formulation, the experience E is a collection of input/output pairs, and the task T is defined as a function that produces the right output for any given input.

👉 The underlying assumption is that there is some correlation (or, in general, a computable relation) between the structure of an input and its corresponding output and that it is possible to infer that function or mapping from a sufficiently large number of examples.
MACHINE LEARNING
Pratham Prasoon
Pratham Prasoon
@PrasoonPratham
Which libraries do you really need to get started with Machine Learning and why?

🧵👇

First and foremost, make sure that you have nailed the fundamental concepts of Python because machine learning requires a lot of programming!

(2 / 19)

If you know these topics, then you are good to go with machine learning in Python

- Object-oriented programming in Python:Classes,Objects,Methods
- Lists & List functions
- List comprehension
- List slicing
- String formatting
- List,Dictionaries & Tuples

(3 / 19)

Now, let's understand what popular python machine learning libraries do.

We will talk about👇
- TensorFlow (+ Keras)
- PyTorch
- Pandas
- Numpy
- Matplotlib
- SciKit Learn
- Seaborn

(4 / 19)

Now let's cover the libraries that you have to learn (at least the basics) for machine learning

1. Pandas

Pandas is a python library that allows you to store and read data from spreadsheets ( .csv, .xlsv files ) in structures called Dataframes.

(5 / 19)
MACHINE LEARNING
Prashant \U0001f4da
Prashant 📚
@capeandcode
Ever heard of Autoencoders?

The first time I saw a Neural Network with more output neurons than in the hidden layers, I couldn't figure how it would work?!

#DeepLearning #MachineLearning
Here's a little something about them: 🧵👇


Autoencoders are unsupervised neural networks whose architecture you can picture as two funnels connect from the narrow ends.

These networks are primary focus for compression tasks of data in Machine Learning.

We feed them the data so that they can learn the most important features, a smaller representation while keep the integrity of the data.

Later when someone needs, can just take that small representation and recreate the original, just like a zip file.📥

Being unsupervised, they require no labels.
Our inputs and outputs are same and a simple euclidean distance can be used as a loss function for measuring the reconstruction.

Of course, we wouldn't expect a perfect reconstruction.

We can think of an autoencoder having two components, encoder and decoder, represented by the below equations:

We are just trying to minimize the L here. All the backpropagation rules still hold.
MACHINE LEARNING

You May Also Like

Liz (Welsh) Beechinor \U0001f605
Liz (Welsh) Beechinor ...
@LizTweetsTech
My dad led an organization of over 300,000 employees.

When I took on my biggest marketing & events team to date (35 employees) I asked him how the *heck* he did it. Here's what he said and what helped me every day. 🧵

Remember you're leading all the employees under you, but you're not *managing* them all. You're managing your direct reports, which should be 5-7 individuals max. Focus on them.

When you interact with the employees you don't manage directly, get to know them as people first, that'll be the most valuable information in leading them. Remembering everything you learn about them is hard, but doing so will make you a superhero.

If you're not going to empower the managers under you, why do you have them? If you see room for improvement, let the manager know and let them make the change on their teams and come to you with questions/concerns. This will save you SO much time.

If you're the smartest person in any room - you're doing it wrong. As a leader, your job is bringing together the best people to get the job done - your skillset is identifying those people, not being one of them.
ALL , WORK , A CATAGORY
Anshul Pandey
Anshul Pandey
@Anshulspiritual
THE NOTICEABLE SIGNS OBSERVED ON IMPENDING DEATH(मृत्यु के संकेत या चिन्ह)

As per Skanda Puran, Kartikeya had narrated to Muni Agastya about the signs of the coming death. This is as per this ancient scripture.


If one experiences the air coming out of right nostril continuously then it is observed that the person dies within three years. If the breathing is continuous towards upper side from both the nostrils, then the person can die within two three days.

If the breathing is through the mouth instead of the nostrils then the person may live only for two days. The person should take into coignance these signs of the occurance of any sudden death.

As per astrology when the Surya is in the 7th house and Chandrama is in its own house and the breathing is only through the right nostril then the danger exists. If you see a yellow black coloured figure who becomes invisible immediately then the life span is limited to 2 years.

If any person sneezes, passes urine, stool and semen all together he has only a year more to live. If a person sees blue coloured snakes flying in the sky then he has only six more months to live. If a person sees any thing opposite to its real self like colours
RELIGION
Advertisement
\u0939\u0920\u092f\u094b\u0917\u0940
हठयोगी...
@hathyogi31
#3/thread on Angkor wat

Christianity and islam may be the largest religion of today’s world but Sanatan dharm has the largest religious monument in the world in the form of Angkor wat. It is situated in combodia and spread across over 400 acres / 1.6 km².


It was listed as a UNESCO World Heritage Site in 1992, which encouraged an international effort to save the complex.
It was originally built as a Hindu temple dedicated to the god Vishnu. In Khmer, the Cambodian language, Angkor means "city" and Wat means "temple grounds".


So Angkor Wat means "Temple City". Its original name was Vrah Vishnuloka or Parama Vishnuloka, meaning the sacred dwelling of Vishnu in Sanskrit.
But, it gradually turned into a Buddhist temple towards the end of the 12th century & is still used for worship today.


Angkor Wat was initially designed and constructed in the first half of the 12th century, during the reign of Suryavarman II, as the king’s state temple and capital city. It was built without the aid of any machinery, as there was no machinery available at that time.


Evidence for these dates comes in part from inscriptions, which are vague, but also from the architectural design and artistic style of the temple and its associated sculptures.

Another aspect is that the five central towers of Angkor Wat symbolize the peaks of Mount Meru,
HISTORY
Gareth Harney
Gareth Harney
@OptimoPrincipi
1) The Temple of the Divine Claudius was a vast temple complex on Rome's Caelian Hill, overlooking the valley that would later be occupied by the Colosseum. Though almost nothing now remains of the structure, its scale and grandeur once rivalled anything in the city.. #LostRome


2) The 'Claudium' was intended as a sacred complex to revere Claudius and the imperial cult. Construction began soon after the death and deification of the emperor in 54 AD, initiated by his widow Agrippina who was likely responsible for his supposed death by poisoning. #LostRome


3) The sprawling temple complex sat on a gigantic podium that spread across the Caelian Hill, measuring 180 x 200 metres; with towering retaining walls of travertine that raised the structure 20 metres above the valley below. #LostRome


4) The elevated sacred area was likely entered by steps facing the temple on the west side. The temple itself had a projecting hexastyle porch and was surrounded by gardens and a grand portico, probably the 'porticus Claudia' mentioned in Martial's 'On the Spectacles'. #LostRome


5) Statues of both Agrippina and Claudius’ ill-fated young son Britannicus, sculpted in sumptuous dark Egyptian greywacke, were discovered among the ruins on the Caelian Hill in 1651 – and had almost certainly been displayed in the temple precinct. #LostRome
HISTORY
SK
SK
@sk_diary1
#sculpture #story -

Chandesha-Anugraha Murti - One of the Sculpture in Brihadeshwara Temple at Gangaikonda Cholapuram - built by Raja Rajendra Chola I

This Sculpture depicts Bhagwan Shiva along with Devi Paravathi blessing Chandeshwara - one of the 63 Nayanmars.

#Thread


Chandeshwara/Chandikeshwara is regarded as custodian of Shiva Temple's wealth&most of Shiva temples in South India has separate sannathi for him.

His bhakti for Bhagwan Shiva elevated him as one of foremost among Nayanmars.
He gave importance to Shiva Pooja&protection of cows.


There are series of paintings, illustrating the #story of Chandikeshwar in the premises of
Sri Sathiyagireeswarar #Temple at Seinganur,near Kumbakonam,TN

Chandikeshwara's birth name
is Vichara sarman.He was born in the village of Senganur on the banks of River Manni.


His Parent names were Yajnathatan and Pavithrai.
Vichara Sarman was a gifted child and he learnt Vedas and Agamas at a very young age.
He was very devout and would always think about Bhagwan Shiva.

One day he saw a cowherd man brutally assaulting a cow,Vichara Sarman could not tolerate this. He spoke to cowherd: ‘Do you not know that the cow is worshipful & divine? All gods & Devas reside in https://t.co/ElLcI5ppsK it is our duty to protect cows &we should not to harm them.
ALL