---
# System prepended metadata

title: defcon parallel-af

---

# defcon parallel-af

1. program 相關
2. syscall 相關
3. opcode / ALU ,  sub_1700 好像是 memory 相關的
4. console output
5. flow control (?


```C
// status in emulate
struct __attribute__((packed)) __attribute__((aligned(1))) VM
{
  int pair_low;
  _BYTE gap4[4];
  __int64 arg1;
  __int64 arg3;
  int pair_high;
  _BYTE gap1C[4];
  __int64 arg_c;
  __int64 arg3_;
  char more_msg;
};

// binary file structure
struct S40
{
  int opcode;
  int field_4;
  int field_8;
  int field_C;
  __int64 arg1;
  __int64 arg2;
  int field_20;
  int field_24;
};

// parse_file -> syscall -> opcode
struct msg30
{
  __int64 arg1;
  __int64 arg2;
  int opcode;
  int field_14;
  __int64 arg3;
  __int64 some_pair;
  int idx;
  char field_2C;
  char field_2D;
  char field_2E;
  char field_2F;
};

// opcode -> flow
struct msg18
{
  int op;
  int field_4;
  __int64 arg1;
  __int64 arg3;
};

// flow -> parse_file
struct msg30_2
{
  int field_0;
  int field_4;
  __int64 field_8;
  __int64 field_10;
  int field_18;
  int field_1C;
  __int64 field_20;
  __int64 field_28;
};
```

* 0x16C0: send_msg (in emulate)
* 0x1700: maybe memory
* 0x21F0: run_emulate
* 0x2480: run_console
* 0x2710: shm_put
* 0x2780: shm_get
* 0x29D0: run_flow
* 0x2C10: send_program (in parse)
* 0x2DE0: parse_file
* 0x34B0: run_parse
* 0x3AF0: run_syscall

```python
00000000 ; status in emulate
00000000 VM              struc ; (sizeof=0x31, mappedto_15)
00000000                                         ; XREF: emulate/r
00000000 pair_low        dd ?                    ; XREF: emulate+E0/r
00000000                                         ; emulate+110/r ...
00000004                 db ? ; undefined
00000005                 db ? ; undefined
00000006                 db ? ; undefined
00000007                 db ? ; undefined
00000008 arg1            dq ?                    ; XREF: emulate+D9/r
00000008                                         ; emulate+109/r ...
00000010 arg3            dq ?                    ; XREF: emulate+D2/r
00000010                                         ; emulate+102/r
00000018 pair_high       dd ?                    ; XREF: emulate+CB/r
00000018                                         ; emulate+146/r
0000001C                 db ? ; undefined
0000001D                 db ? ; undefined
0000001E                 db ? ; undefined
0000001F                 db ? ; undefined
00000020 arg_c           dq ?                    ; XREF: emulate+C4/r
00000020                                         ; emulate+13F/r
00000028 arg3_           dq ?                    ; XREF: emulate+BD/r
00000028                                         ; emulate+138/r
00000030 more_msg        db ?                    ; XREF: emulate+B6/r
00000030                                         ; emulate+120/r
00000031 VM              ends
00000031
00000000 ; ---------------------------------------------------------------------------
00000000 ; binary file structure
00000000 S40             struc ; (sizeof=0x28, mappedto_21)
00000000 field_0         dd ?
00000004 field_4         dd ?
00000008 field_8         dd ?
0000000C field_C         dd ?
00000010 arg1            dq ?
00000018 arg2            dq ?
00000020 field_20        dd ?
00000024 field_24        dd ?
00000028 S40             ends
00000028
00000000 ; ---------------------------------------------------------------------------
00000000 ; parse_file -> syscall -> opcode
00000000 msg30           struc ; (sizeof=0x30, mappedto_22)
00000000                                         ; XREF: emulate/r
00000000                                         ; sub_29D0/r ...
00000000 arg1            dq ?                    ; XREF: emulate+7F/r
00000000                                         ; sub_29D0+16C/w ...
00000008 arg2            dq ?                    ; XREF: emulate+7B/r
00000008                                         ; sub_29D0+170/w ...
00000010 opcode          dd ?                    ; XREF: emulate+77/r
00000010                                         ; emulate+95/r ...
00000014 field_14        dd ?
00000018 arg3            dq ?                    ; XREF: emulate+73/r
00000018                                         ; sub_29D0+153/w ...
00000020 some_pair       dq ?                    ; XREF: emulate+6C/r
00000020                                         ; sub_29D0+15A/w ...
00000028 idx             dd ?                    ; XREF: emulate+68/r
00000028                                         ; emulate:loc_2290/r ...
0000002C field_2C        db ?                    ; XREF: send_program+CD/w
0000002C                                         ; parse+1A1/w ...
0000002D field_2D        db ?
0000002E field_2E        db ?
0000002F field_2F        db ?
00000030 msg30           ends
00000030
00000000 ; 
---------------------------------------------------------------------------
00000000 ; last -> parse_file
00000000 msg30_2         struc ; (sizeof=0x30, mappedto_24)
00000000                                         ; XREF: sub_29D0/r
00000000                                         ; parse/r
00000000 field_0         dd ?                    ; XREF: sub_29D0+16C/w
00000000                                         ; sub_29D0+1AE/w ...
00000004 field_4         dd ?
00000008 field_8         dq ?                    ; XREF: sub_29D0+170/w
00000008                                         ; parse:loc_35F0/r ...
00000010 field_10        dq ?                    ; XREF: sub_29D0:loc_2B1E/w
00000010                                         ; sub_29D0+1B3/w ...
00000018 field_18        dd ?                    ; XREF: sub_29D0+153/w
0000001C field_1C        dd ?
00000020 field_20        dq ?                    ; XREF: sub_29D0+15A/w
00000020                                         ; parse:loc_3680/r ...
00000028 field_28        dq ?                    ; XREF: sub_29D0+175/w
00000030 msg30_2         ends
---------------------------------------------------------------------------
00000000 ; opcode -> console -> last -> parse_file
00000000 msg18           struc ; (sizeof=0x18, mappedto_23)
00000000                                         ; XREF: emulate/r
00000000                                         ; console/r ...
00000000 op              dd ?                    ; XREF: emulate+262/w
00000000                                         ; console+40/r ...
00000004 field_4         dd ?
00000008 arg1            dq ?                    ; XREF: console+54/r
00000008                                         ; sub_29D0+129/r ...
00000010 arg3            dq ?                    ; XREF: emulate+26B/w
00000010                                         ; sub_29D0+A6/r ...
00000018 msg18           ends
```