Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.

Sign up to join this community
Anybody can ask a question
Anybody can answer
The best answers are voted up and rise to the top

Top Questions

1 vote
0 answers
16 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

1 vote
1 answer
65 views

Identify two structs in IDA

1 vote
0 answers
29 views

can't debug properly

0 votes
0 answers
19 views

How to prevent dynamic loader from modifying binary in memory?

1 vote
1 answer
48 views

unpack ZXIC chip firmware

2 votes
0 answers
22 views

Decompiling an executable compiled by vercel/pkg

1 vote
0 answers
22 views

What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?

0 votes
1 answer
48 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

0 votes
1 answer
48 views

Editing Binary File with Hex Editor

0 votes
0 answers
29 views

How can i get the address of a function in memory?

1 vote
0 answers
15 views

Where is Zyxel nas326 system log files. and how to see failed login ip

0 votes
0 answers
16 views

I have an application that views an encrypted document and stored it as an (encrypted) pdf

0 votes
1 answer
26 views

How do I install fail2ban to Zyxel nas326

0 votes
1 answer
22 views

WinGraph32 for the OllyFlow plugin

0 votes
0 answers
15 views

X32dbg Stepping through assembly, seems to get stuck on one line and not progress forward, even though the application continues to progress forward

-1 votes
0 answers
32 views

loader a Win32 exe C++

1 vote
2 answers
59 views

How to attach and step through a running .NET process?

1 vote
1 answer
38 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

0 votes
0 answers
27 views

Is there any way to get old Windows kernel drivers?

0 votes
0 answers
20 views

Are physical databooks of any use?

0 votes
1 answer
63 views

Reversing encrypted file with unknown extension

1 vote
1 answer
30 views

How to set a breakpoint in android's openssl library in running android application?

2 votes
1 answer
55 views

Am I missing symbols when RE'ing shellcode?

0 votes
0 answers
22 views

What skills are need to find ways of take root of Phones?

1 vote
1 answer
27 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

1 vote
0 answers
101 views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

0 votes
1 answer
49 views

reverse engineering image format

0 votes
0 answers
13 views

Intercepting a PHP module with frida

0 votes
0 answers
30 views

Reverse Engineer Emulated Game

0 votes
1 answer
21 views

Frida script returning different instruction at address compared to entering commands in repl

1 vote
0 answers
36 views

Is it possible to recover/acquire schema of FlatBuffers binary file

1 vote
1 answer
90 views

Can I get a valid source code from this assembly?

3 votes
1 answer
67 views

How to select an item in IDAPython, in decompilation view?

1 vote
1 answer
30 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

2 votes
1 answer
103 views

Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph

1 vote
1 answer
30 views

Cannot reset botched IDA setting

1 vote
0 answers
49 views

Reverse-engineering the Sony Camset (Camera Settings) file format

0 votes
1 answer
47 views

How do i loop this CreateThread call in Assembly to get 4 threads instead of only one?

0 votes
1 answer
27 views

Paused at the right (?) breakpoint, what do I do next?

2 votes
1 answer
72 views

Is there a way to show/enable mnemonic description in Ghidra?

2 votes
0 answers
38 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

1 vote
0 answers
28 views

Changing Offset Value with frida

0 votes
0 answers
32 views

how to hide all export functions in a elf so library?

0 votes
1 answer
44 views

IDA not allowing Memory Mapping

2 votes
1 answer
58 views

Is there any way to understand if a raw binary firmware is Cortex-M or not?

1 vote
1 answer
49 views

Decrypting .toc file

0 votes
1 answer
70 views

Multi segement code, but I'm stuck at this one part. What does sprintf do?

0 votes
0 answers
98 views

ghidra returning wrong function address


Looking for more? Browse the complete list of questions, or popular tags. Help us answer unanswered questions.