<?xml version="1.0" encoding="utf-8" standalone="yes" ?>
<rss version="2.0" 
  xmlns:content="http://purl.org/rss/1.0/modules/content/" 
  xmlns:dc="http://purl.org/dc/elements/1.1/" 
  xmlns:atom="http://www.w3.org/2005/Atom" 
  xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" 
  xmlns:media="http://search.yahoo.com/mrss/">
  <channel>
    <title>Writeup on The Owlgorithm</title>
    <link>http://theowlgorithm.com/en/categories/writeup/</link>
    <description>Recent content in Writeup on The Owlgorithm</description>
    <generator>Hugo -- gohugo.io</generator>
    <language>en</language>
    <copyright>&amp;copy;{year}, All Rights Reserved</copyright>
    <lastBuildDate>Wed, 02 Sep 2026 20:57:00 +0000</lastBuildDate>
    
        <atom:link href="http://theowlgorithm.com/en/categories/writeup/index.xml" rel="self" type="application/rss+xml" />
    
    
    
      <item>
        <title>ABB encode.exe SRE</title>
        <link>http://theowlgorithm.com/en/posts/abb_encode/</link>
        <pubDate>Wed, 02 Sep 2026 20:57:00 +0000</pubDate>
        
        <atom:modified>Wed, 02 Sep 2026 20:57:00 +0000</atom:modified>
        <guid>http://theowlgorithm.com/en/posts/abb_encode/</guid>
        <description>&lt;h1 id=&#34;abb-encodeexe-static-reverse-engineering&#34;&gt;ABB encode.exe static reverse engineering&lt;/h1&gt;
&lt;p&gt;This post examines an old .exe available on the ABB forums that encodes RAPID modules.  It never makes any claims of encryption, for good reason.  The encoding is unreadable to a human, but entirely reversible once loaded into an ABB robot controller, which is what made me interested in it in the first place.  We will begin with a short preface, then dive into static reverse engineering, explain how the encoding works along the way, and unfortunately end with a note on why I can&amp;rsquo;t share a script to restore encoded modules.&lt;/p&gt;</description>
        
        <dc:creator>Aidan</dc:creator>
        <media:content url="http://theowlgorithm.com//images/ghidra.png" medium="image"><media:title type="html">featured image</media:title></media:content>
        
        
        
          
            
              <category>re</category>
            
          
        
        
          
            
              <category>writeup</category>
            
          
        
        
          
            
              <category>Misc</category>
            
          
        
      </item>
    
      <item>
        <title>picoCTF Riscy Writeup</title>
        <link>http://theowlgorithm.com/en/posts/riscy/</link>
        <pubDate>Sat, 15 Feb 2025 14:12:00 +0000</pubDate>
        
        <atom:modified>Sat, 15 Feb 2025 14:12:00 +0000</atom:modified>
        <guid>http://theowlgorithm.com/en/posts/riscy/</guid>
        <description>&lt;h1 id=&#34;riscy&#34;&gt;Riscy&lt;/h1&gt;
&lt;p&gt;Analysis and solution of picoCTF&amp;rsquo;s RE Hard question &lt;a href=&#34;https://play.picoctf.org/practice/challenge/219&#34;&gt;Riscy&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;first-contact&#34;&gt;First contact&lt;/h2&gt;
&lt;p&gt;First thing was to run file on the provided binary, which yields the following:&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;div class=&#34;chroma&#34;&gt;
&lt;table class=&#34;lntable&#34;&gt;&lt;tr&gt;&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code&gt;&lt;span class=&#34;lnt&#34;&gt;1
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;riscy: ELF 64-bit LSB executable, UCB RISC-V, RVC, double-float ABI, version &lt;span class=&#34;m&#34;&gt;1&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;(&lt;/span&gt;SYSV&lt;span class=&#34;o&#34;&gt;)&lt;/span&gt;, statically linked, stripped
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;As expected based on the title, RISC-V.  Just a few points of interest, &lt;code&gt;RVC&lt;/code&gt; means we can expect to see compressed instructions, which are the same but smaller.  e.g. &lt;code&gt;li&lt;/code&gt; can become &lt;code&gt;c.li&lt;/code&gt;, using half the size for the instruction at the cost of supporting smaller values to load.  It&amp;rsquo;s statically linked, so no external libraries needed, but also that means that&amp;rsquo;s not a method to attack it.  Finally, it&amp;rsquo;s stripped, which isn&amp;rsquo;t the end of the world, an ELF will always give us &lt;code&gt;entry&lt;/code&gt;.&lt;/p&gt;</description>
        
        <dc:creator>Aidan</dc:creator>
        <media:content url="http://theowlgorithm.com//images/riscv_logo.jpg" medium="image"><media:title type="html">featured image</media:title></media:content>
        
        
        
          
            
              <category>re</category>
            
          
        
        
          
            
              <category>writeup</category>
            
          
        
        
          
            
              <category>CTF</category>
            
          
        
      </item>
    
  </channel>
</rss>