00:07 <flowriser> steev, how does one reverse engineer those drivers? Are you using Ghidra or something else?

00:08 <steev> flowriser: i have it open in ghidra, yeah, but aside from looking at it... i have no idea what is going on (nor do i even know the proper architecture for whatever that ecb.bin file is)

00:09 <steev> https://paste.debian.net/1228647/ are the strings in it

00:13 <steev> there is also https://github.com/snare/ida-efiutils if you have ida, but i do not

08:53 <flowriser> steev, I don't have ida either; I first used Ghidra a some months ago in the google ctf competion and was blown away with how good it was

08:54 <steev> yep, and 10.1 enabled arm64 native as well, which is nice

08:59 <flowriser> steev, does it also give you some C code with arm64 binaries?

08:59 <steev> flowriser: you have to build the decompiler and such yourself, they only build the x86_64 ones

09:00 <steev> unless you mean, does the decompile... in which case... that i don't know, i haven't built them

09:00 <flowriser> steev, yeah the decompile thingy that gives you some semblance of readable C code

09:03 <steev> haven't tested, mostly because i don't wanna install gradle on that box

10:05 <flowriser> If, in theory I find the .inf files in windows can I use Ghidra on them? Are there any resources around that can maybe teach me what to look for in them? :D

10:06 <flowriser> I have no ideea how windows drivers and binaries work

10:07 <flowriser> Only used Linux for the past 10+ years so I'm a noob for anything related to Windows

10:12 <flowriser> Also, in cased you missed this great piece of writing from Alyssa: https://www.collabora.com/news-and-blog/blog/2022/01/27/writing-an-open-source-gpu-driver-without-the-hardware/

10:23 <steev> not the inf files, the bin/mbn (maybe)

10:24 <steev> all the drivers and such all live in Windows\System32\DriverStore\FileRepository\

10:55 <flowriser> I will check to see what I have when I get free from the web dev work

11:11 <flowriser> steev, what I'm scared is about the "reverse engineer" policy in most sdks/apis; I had to rewrite my undergrad project because of this :D

11:12 <flowriser> so that is why I mostly stayed away from reverse engineering drivers and such