The Owlgorithm

ABB encode.exe SRE

Aidan — Wed, 02 Sep 2026 20:57:00 +0000

ABB encode.exe static reverse engineering

This post examines an old .exe available on the ABB forums that encodes RAPID modules. It never makes any claims of encryption, for good reason. The encoding is unreadable to a human, but entirely reversible once loaded into an ABB robot controller, which is what made me interested in it in the first place. We will begin with a short preface, then dive into static reverse engineering, explain how the encoding works along the way, and unfortunately end with a note on why I can’t share a script to restore encoded modules.

Debugger breakpoint detection

Aidan — Thu, 10 Apr 2025 17:45:00 +0000

Overview

This article goes over a method to detect debuggers by looking for breakpoints in executable machine code loaded in memory.
It’s naive because the notion that a program’s .text section will only contain 0xCC when there’s a breakpoint is not true.
Regardless, this is a decent starting point to illustrate the concept of breakpoint detection.

Code

#include <stdio.h>
#include <stdbool.h>

bool check_method(void* method, unsigned char start[], unsigned char stop[]);

#define BP_CHECKABLE(func_name) __attribute__((noinline, section(func_name "_bounds")))
#define BP_CHECK_PRE(func) \
    extern unsigned char __start_##func##_bounds[]; \
    extern unsigned char __stop_##func##_bounds[];
#define BP_CHECK(func) check_method(func, __start_##func##_bounds, __stop_##func##_bounds)

// True if there's a breakpoint
bool check_method(void* method, unsigned char start[], unsigned char stop[])
{
	void* start_ptr = (void *)start;
	void* stop_ptr = (void *)stop;
	size_t size = stop_ptr - start_ptr;
	for (long bytecode = (long)start_ptr; bytecode < (long)stop_ptr; bytecode++)
	{
		unsigned char op = *((unsigned char* )bytecode);
		if (op == 0xCC)
		{
			return true;
		}
	}
	return false;
}

BP_CHECKABLE("checkme") void checkme()
{
	printf("I'm doing something\n");
}

BP_CHECKABLE ("main") int main()
{
	BP_CHECK_PRE(checkme);
	if (BP_CHECK(checkme))
	{
		printf("Breakpoints found in checkme\n");
	} else {
		printf("No breakpoints found in checkme\n");
	}

	BP_CHECK_PRE(main);
	if (BP_CHECK(main))
	{
		printf("Breakpoints found in main\n");
	} else {
		printf("No breakpoints found in main\n");
	}
}

Explanation

Macro weirdness

There are 3 macros, BP_CHECKABLE, BP_CHECK_PRE, and BP_CHECK.

picoCTF Riscy Writeup

Aidan — Sat, 15 Feb 2025 14:12:00 +0000

Riscy

Analysis and solution of picoCTF’s RE Hard question Riscy

First contact

First thing was to run file on the provided binary, which yields the following:

`1`	`riscy: ELF 64-bit LSB executable, UCB RISC-V, RVC, double-float ABI, version 1 (SYSV), statically linked, stripped`

As expected based on the title, RISC-V. Just a few points of interest, RVC means we can expect to see compressed instructions, which are the same but smaller. e.g. li can become c.li, using half the size for the instruction at the cost of supporting smaller values to load. It’s statically linked, so no external libraries needed, but also that means that’s not a method to attack it. Finally, it’s stripped, which isn’t the end of the world, an ELF will always give us entry.

Password cracking on Beoshock

Aidan — Thu, 06 Feb 2025 17:51:00 +0000

Password Cracking on Beoshock with Hashcat and John

Getting on Beoshock

Applying

https://wichita.teamdynamix.com/TDClient/1907/Portal/Requests/ServiceDet?ID=41427
List your intended use as something like “NCL Password Cracking” and your academic advisor as Sergio’s email (omitted for web).

Connecting

You’ll ssh into the head node at first, this is where most of the prep happens.
Use ssh a123b456@hpc-login.wichita.edu with your actual student ID. This should work anywhere on-campus, it’s whitelisted.
When it’s time to crack, use an srun or sbatch to use the actually powerful nodes (we’ll cover that in a following section).

Radar scope

Aidan — Mon, 16 Sep 2024 12:31:00 +0000

Overview

This project aimed to be a weekend project, to create a system that can display nearby aircraft. The system will consist of a Raspberry Pi, a software defined radio (SDR), and a display. The SDR will be used to receive ADS-B signals from aircraft, and the Raspberry Pi will process and display the data. The ADS-B signals are sent to FlightRadar24, a public service that tracks aircraft and displays them on a map.

EVE Online Logistics Depot Placement

Aidan — Wed, 28 Feb 2024 08:31:00 +0000

The source code for this article can be found at https://github.com/jamd315/EVE_Depot_Placement

The problem

I heard an interesting problem recently that I though I’d informally explore. How could you place logistics depots around mainland highsec space such that a wormhole with a highsec static will always be within a few jumps of a depot? A few important questions follow, like what is “a few”? How many depots would you have to manage? What systems qualify for depot placement at all? All of these factors are tradeoffs and effect each other.

Looking at ping pong balls

Aidan — Wed, 30 Aug 2023 08:31:00 +0000

Overview

For the ping pong project, it’s important to know precisely where the ping pong ball is and at what time, so that we can predict its future position. Let’s look over how we can do that.

ART

The ART system has cameras that emit IR light. They sell a passive marker that can then reflect that light back to the camera. A passive marker is just a sphere that has been made retroreflective by ART, with a threaded rod to attach to your part. With many of these passive markers, you can get a 6DOF position for your part, but with one all we can get is a 3DOF position. 3DOF is all we need, so that’s fine.

Hello World

Aidan M. — Tue, 29 Aug 2023 23:31:00 +0000

Hello World! This is a new post that I’m writing. It needs just a little bit more padding so bear with me. Alright this should be enough.