Closed featherbear closed 2 years ago
CK
is not compressed. It's Chunk
BUT WHAT DO I DOOO WITH THAT
<function at address+16>(address)
Probably some library lookup
pointer.
--
Desktop app has some import to bcrypt
Maybe look for how Synchronize is called
Try break point for when CK is visible, and see how it parses it?
0x673f1f
of libucremoteapp.so (SHA-1 C1739D16E333C2ACAFBB16A78AA59753DADC38D6)