{"id":17106,"date":"2019-12-05T09:40:03","date_gmt":"2019-12-05T17:40:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/12\/05\/news-10842\/"},"modified":"2019-12-05T09:40:03","modified_gmt":"2019-12-05T17:40:03","slug":"news-10842","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/12\/05\/news-10842\/","title":{"rendered":"Dissecting Tor Bridges and Pluggable Transport &#8211; Part I:  Finding the Built-in Tor Bridges and How Tor Browser Works"},"content":{"rendered":"<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12\">\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p><b><i>A FortiGuard Labs Threat Research Report<\/i><\/b><\/p>\n<h2>Background<br \/> <\/h2>\n<p>At the <a href=\"https:\/\/securewv.org\/\">SecureWV 2019 Cybersecurity Conference<\/a>, held in Charleston, West Virginia, Peixue and I presented our talk \u201c<b><a href=\"https:\/\/fortiguard.com\/events\/3274\/securewv-2019-dissect-tor-bridge-and-pluggable-transport\">Dissecting Tor Bridges and Pluggable Transport<\/a><\/b>.\u201d We are now sharing more details of this research, with our analysis being posted in two blogs. In this first blog, I will explain how I found built-in Tor bridges and how Tor browser works with Bridge enabled using reverse engineering.<\/p>\n<h2>Tor Browser and Tor Network<\/h2>\n<p><a href=\"https:\/\/www.torproject.org\/\">Tor Browser<\/a> is a tool that provides anonymous Internet connectivity combined with layers of encryption through the Tor network. When users explore websites using Tor Browser, their real IP address is hidden by the Tor network so that the destination website never knows what the true source IP address is. Users can also set up their own website in the Tor network with a domain name ending with \u201c.onion\u201d. That way, only Tor Browser can access it and nobody knows what its real IP address is. It\u2019s one of the reasons why ransomware criminals require victims to access the payment page on a .onion website through Tor Browser. The Tor project team is aware of this practice because the Tor project blog clearly states that \u201cTor is misused by criminals.\u201d<\/p>\n<p>Tor Browser is an open source project with a design based on <a href=\"https:\/\/www.mozilla.org\/en-US\/firefox\/\">Mozilla Firefox<\/a>. You can download the source code from its official website. The Tor network is a worldwide overlay network comprising thousands of volunteer-run relays. It consists of two kinds of relay nodes: normal relay nodes and bridge relay nodes. The normal relay nodes are listed in the main Tor directory, and the connections to them can be easily identified and blocked by censors.<\/p>\n<p>The bridge information is defined in the profile file of Firefox, so you can display it by entering \u201cabout:config\u201d in the address bar of Tor Browser, as shown in Figure 1.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_799609344.img.png\/1575408078732\/fig-one-tor.png\" alt=\"Figure 1. Displaying config data in Tor Browser\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 1. Displaying config data in Tor Browser<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>However, the bridge relay nodes are not listed in the main Tor directory, which means that connections to them can\u2019t be easily blocked by censors. In this blog I will be discussing how to find these bridges and relay nodes using functions built into Tor Browser.<\/p>\n<p>To use a bridge relay in Tor Browser, there are two options. Tor Browser has some built-in bridges for users to choose. If the built-in bridges don\u2019t work, the users can obtain additional bridges from the Tor Network Settings, by visiting https:\/\/bridges.torproject.org\/, or by sending an email to bridges@bridges.torproject.org.<\/p>\n<h2>Analysis Platform<br \/> <\/h2>\n<p>This analysis is done on the following platform, as well as the following Tor Browser version and extensions:<\/p>\n<ul>\n<li>Windows 7 32-bit SP1<\/li>\n<li>Tor Browser 8.0<\/li>\n<li>TorLauncher 0.2.16.3 (one extension)<\/li>\n<li>Torbutton 2.0.6 (one extension)<\/li>\n<\/ul>\n<p>Figure 2 shows the version information of Tor Browser that I worked on.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image.img.png\/1575408209272\/tor-one.png\" alt=\"Figure 2. Tor Browser information\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 2. Tor Browser information<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>During my analysis, Tor Brower pushed out a new version: Tor Browser 9.0, on October 22, 2019. You can refer to the <b>Appendix<\/b> of this analysis for more information about it.<\/p>\n<h2>Starting Tor Browser with Built-in Bridges<\/h2>\n<p>This version of Tor Browser I analyzed provides four kinds of bridges: \u201cobfs4\u201d, \u201cfte\u201d, \u201cmeek-azure\u201d and \u201cobfs3\u201d. They are called pluggable transports. You can see the detailed settings in Figure 3.<\/p>\n<p>\u00a0<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_113727583.img.png\/1575408512577\/tor-two.png\" alt=\"Figure 3. Choosing a built-in bridge on Tor Network Settings\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 3. Choosing a built-in bridge on Tor Network Settings<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>Obfs4 Bridge is strongly recommended on Tor official website. All of the analysis below is based on this kind of bridge. I chose bridge \u201cobfs4\u201d in the list shown in Figure 3 to start my analysis. Looking into the traffic when Tor Browser makes an \u201cobfs4\u201d connection, I found that the TCP sessions are created by obfs4proxy.exe, which is a bridge client process.<\/p>\n<p>Figure 4 is a screenshot of the process tree when starting Tor Browser with \u201cobfs4\u201d. As you can see, \u201cfirefox.exe\u201d starts \u201ctor.exe\u201d, which then starts \u201cobfs4proxy.exe\u201d. The process \u201cobfs4proxy.exe\u201d locates in \u201cTor_installation_folderBrowserTorBrowserTorPluggableTransports\u201d. Originally, I thought the built-in \u201cobfs4\u201d bridges should be hard-coded inside the \u201cobfs4proxy.exe\u201d process.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn aem-GridColumn--default--12\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_858248435.img.png\/1575408558132\/tor-three.png\" alt=\"Figure 4. The process tree when using \u201cobfs4\u201d bridge\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 4. The process tree when using \u201cobfs4\u201d bridge<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<h2>Tracing and Tracking Within the Bridge Process \u201cobfs4proxy.exe\u201d<\/h2>\n<p>I started the debugger and attached it to \u201cobfs4proxy.exe\u201d. I then set a breakpoint on the API \u201cconnect\u201d, which is often used to establish TCP connections. Usually, using reverse engineering could quickly discover the IP addresses and ports from this API. However, I never got it triggered before the connections to \u201cobfs4\u201d bridge were established. After further analysis of the process \u201cobfs4proxy.exe\u201d, I learned it used another API called \u201cMSAFD_ConnectEx\u201d from mswsock.dll instead.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_912396543.img.png\/1575408644682\/tor-four.png\" alt=\"Figure 5. Calling the API \u201cMSAFD_ConnectEx\u201d\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 5. Calling the API \u201cMSAFD_ConnectEx\u201d<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>Figure 5 shows that \u201cobfs4proxy.exe\u201d is about to call the API \u201cmswsock.MSAFD_ConnectEx()\u201d to make a TCP connection to a built-in \u201cobfs4\u201d bridge, whose IP address and port are \u201c192.95.36.142:443\u201d. The second argument of this function is a pointer to a structure variable of struct sockaddr_in, which holds the IP address and Port to be connected to. Later on, it calls the APIs \u201cWSASend\u201d and \u201cWSARecv\u201d to communicate with the \u201cobfs4\u201d bridge. As you may have noticed, the debugger OllyDbg could not recognize this API because it is not an export function of \u201cmswsock.dll\u201d. In the IDA Pro\u2019s analysis of mswsock.dll, we can see that the address 750A7842 is just the API of \u201cMSAFD_ConnectEx()\u201d. By the way, the instruction \u201ccall dword ptr [ebx]\u201d is used to call almost all the system APIs that \u201cobfs4proxy.exe\u201d needs, which is a way to hide APIs against analysis.<\/p>\n<p>From my analysis, most of the PE files (exe and dll files, like \u201cobfs4proxy.exe\u201d) used by Tor seem to be compiled by the \u201cGCC MINGW-64w compiler\u201d, which always uses \u201cmov [esp], \u2026\u201d to pass arguments to functions instead of \u201cpush \u2026\u201d instructions that create trouble for static analysis. By tracing and tracking the call stack flow from \u201cMSAFD_ConnectEx()\u201d, I realized that my original thought was wrong because the built-in IP addresses and Ports are not hard-coded in \u201cobfs4proxy.exe\u201d, but taken from the parent process \u201ctor.exe\u201d through a local loopback TCP connection. <\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_1181524060.img.png\/1575408688190\/tor-five.png\" alt=\"Figure 6. \u201cobfs4proxy.exe\u201d received one \u201cobfs4\u201d bridge\u2019s IP address and Port\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 6. \u201cobfs4proxy.exe\u201d received one \u201cobfs4\u201d bridge\u2019s IP address and Port<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>Usually, the third packet from \u201ctor.exe\u201d to \u201cobfs4proxy.exe\u201d contains one built-in obfs4 bridge\u2019s IP address and Port in binary, just like in Figure 6. It is a Socks5 packet that is 0xA bytes long. \u201c05 01 00 01\u201d is a header of its Socks5 protocol, and the rest of the data are the IP address and port in binary. The packet indicates that it asks \u201cobfs4proxy.exe\u201d to make a connection to a bridge with the binary IP address and Port. \u201cobfs4proxy.exe\u201d then parses the packet and converts the binary IP and Port to a string, which in this case is \u201c154.35.22.13:16815\u201d.<\/p>\n<h2>Moving to Tor.exe<\/h2>\n<p>\u201ctor.exe\u201d uses a third-party module named \u201clibevent.dll\u201d, which is from <a href=\"https:\/\/libevent.org\/\">libevent<\/a> (an event notification library), to drive Tor to perform its tasks. Tor places most of its socket tasks (connect(), send(), recv() and so on) on events to be automatically called by libevent. When tracing the packet with the bridge\u2019s IP address and Port in \u201cTor.exe\u201d, you can see in the call stack context that many return addresses are in the module \u201clibevent.dll\u201d. In Figure 7, it paused on \u201cTor.exe\u201d calling the API \u201cws2_32.send()\u201d to send the packet containing the bridge\u2019s IP address and Port, just like the received packet shown in Figure 6.<\/p>\n<p>Figure 7 is the \u201cCall stack\u201d window, which shows the return addresses of \u201clibevent.dll\u201d.<\/p>\n<\/p><\/div>\n<div class=\"cmp cmp-image aem-GridColumn--default--none aem-GridColumn--default--9 aem-GridColumn aem-GridColumn--offset--default--1\">               <noscript data-cmp-image=\"{&#34;smartImages&#34;:[],&#34;smartSizes&#34;:[],&#34;lazyEnabled&#34;:true}\">             <img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_1180282551.img.png\/1575408736309\/tor-six.png\" alt=\"Figure 7. \u201ctor.exe\u201d uses libevent module to send bridge\u2019s IP and Port to bridge process\"\/>         <\/noscript>          <span class=\"cmp-image--title\">Figure 7. \u201ctor.exe\u201d uses libevent module to send bridge\u2019s IP and Port to bridge process<\/span>         <\/div>\n<div class=\"cmp cmp-text aem-GridColumn aem-GridColumn--default--12\">\n<p>Through tracing\/tracking of \u201ctor.exe\u201d sending out the bridge\u2019s IP address and Port, I found a place where it starts a new event with a callback function that then sends the bridge\u2019s IP address and Port. The ASM code snippet below shows the context of calling \u201clibevent.event_new()\u201d in \u201ctor.exe\u201d. Its second argument is the socket handle; its third argument is the event action, which is 14H here, standing for EV_WRITE and EV_PERSIST; its fourth argument is a callback function (sub_2833EE for this case); and its fifth argument contains the bridge\u2019s IP address and Port that will be passed to the callback function (sub_2833EE) once it is called by libevent.<\/p>\n<p>The following ASM code snippet is from \u201ctor.exe\u201d, whose base address for this time is 00280000h.<\/p>\n<\/p><\/div>\n<div class=\"raw-import aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"text-container\">\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif;\">[&hellip;]&nbsp;&nbsp; <\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C84&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; edx, eax<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C86&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; eax, [ebp+var_2C] ; <\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C89&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [eax+14h], edx<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C8C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; eax, [ebp+var_2C] ; <\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C8F&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; ebx, [eax+0Ch]<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C92&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; call&nbsp;&nbsp;&nbsp; sub_5133E0<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C97&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; edx, eax<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C99&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; eax, [ebp+var_2C] <\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281C9C&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [esp+10h], eax &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: #00b050; background: #D9D9D9;\">; argument for callback function<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CA0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [esp+0Ch], <\/span><strong><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: red; background: #D9D9D9;\">offset sub_2833EE<\/span><\/strong><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: red; background: #D9D9D9;\"> &nbsp;&nbsp;&nbsp;<\/span><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: #00b050; background: #D9D9D9;\">; the callback function<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CA8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [esp+8], 14h &nbsp;<\/span><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: #00b050; background: #D9D9D9;\">; #define EV_WRITE 0x04|#define EV_PERSIST 0x10<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CB0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [esp+4], ebx &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/span><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: #00b050; background: #D9D9D9;\">; socket<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CB4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [esp], edx<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><strong><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: red; background: #D9D9D9;\">.text:00281CB7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; call&nbsp;&nbsp;&nbsp; event_new<\/span><\/strong><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">&nbsp;&nbsp;&nbsp; <\/span><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: #00b050; background: #D9D9D9;\">; event_new(event_base, socket, event EV_READ\/EV_WRITE, callback_fn, callback_args);<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CBC&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; edx, eax<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CBE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; eax, [ebp+var_2C] <\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif; color: black; background: #D9D9D9;\">.text:00281CC1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mov&nbsp;&nbsp;&nbsp;&nbsp; [eax+18h], edx<\/span><\/pre>\n<pre style=\"line-height: 115%; margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';\"><span style=\"line-height: 115%; font-family: Calibri, sans-serif;\">[&hellip;]<\/span><\/pre>\n<p><a href=\"http:\/\/feedproxy.google.com\/~r\/fortinet\/blog\/threat-research\/~3\/PYEh-NxQrZU\/dissecting-tor-bridges-pluggable-transport.html\" target=\"bwo\" >http:\/\/feeds.feedburner.com\/fortinet\/blog\/threat-research<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"\/blog\/threat-research\/dissecting-tor-bridges-pluggable-transport\/_jcr_content\/root\/responsivegrid\/image_799609344.img.png\/1575408078732\/fig-one-tor.png\"\/><br \/>Learn more about how our FortiGuard Labs researchers discovered built-in Tor bridges using reverse engineering.&lt;img src=&#8221;http:\/\/feeds.feedburner.com\/~r\/fortinet\/blog\/threat-research\/~4\/PYEh-NxQrZU&#8221; height=&#8221;1&#8243; width=&#8221;1&#8243; alt=&#8221;&#8221;\/&gt;<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10424,10378],"tags":[],"class_list":["post-17106","post","type-post","status-publish","format-standard","hentry","category-fortinet","category-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=17106"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/17106\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=17106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=17106"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=17106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}