Community Digest

Top new questions this week:

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...

disassembly assembly c++ arm vtables  
asked by Overblade 2 votes
answered by Igor Skochinsky 1 vote

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...

firmware arm hardware firmware-analysis nec-78k0r  
asked by Mr_SMT 2 votes

Identifying ROM segment in unknown firmware update file

I am working on reversing a firmware update from a FujiFilm FinePix S1800 camera. So far I have managed to identify the instruction set (ARCompact) and dump a few things from the camera using the ...

firmware entry-point arcompact  
asked by Geoffrey 2 votes
answered by Igor Skochinsky 2 votes

Cant see mnemonics on ollydbg 2.01

Im reverse engineering an exe, but i get locked on a specific location, i suppose this is a jump to the same location, when im on this "obfuscated" addresses i cant see any instruction, but the ...

x86 asm  
asked by deon cagadoes 1 vote
answered by Yotamz 2 votes

ASUS Strix Vega 56 or 64

I'm in the process of creating ASUS AURA drivers for Linux. I'm hoping somebody here has access to a Strix version of the Vega 56 or 64 on a windows machine? If you do, would you please dump the ...

amd64 graphics  
asked by Twifty 1 vote

What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?

The relevant files for this question are here: https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip Contains a before and after DLL. This simple PHP script demonstrates the problem: <?php ...

pe  
asked by CubicleSoft 1 vote

Monitor all process's communication

I have exe file in windows that running and send message to another process/to network. How can I monitor all the communication of this process and know who send and what is the data, without using ...

windows networking process  
asked by Meryy 1 vote
answered by Jon 0 votes

Greatest hits from previous weeks:

Radare2 (noob question) can't set breakpoint?

I was following this video: https://www.youtube.com/watch?v=3NTXFUxcKPc at the end it show how to do basic stuff with Radare2. When i try to set a break point with: db 0x004005bd where '0x004005bd' ...

radare2 breakpoint  
asked by tatticadanito 7 votes
answered by Weeruhputt Supsohmboon 6 votes

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...

gdb elf x64  
asked by 3lokh 24 votes
answered by perror 52 votes

What are the targets of professional reverse software engineering?

At the professional level, for what purpose is reverse software engineering used? What software is targeted and why? For reasonably complex compiled code that's doing something novel, making ...

disassembly  
asked by Praxeolitic 38 votes
answered by joxeankoret 40 votes

How can I set a breakpoint for a button click?

I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible? Any tools or tricks to assist in this?

windows ollydbg  
asked by Menna 13 votes
answered by Peter Andersson 20 votes

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...

disassembly decompilation linux c exploit  
asked by MLSC 6 votes
answered by pank4j 14 votes

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...

ida debugging dll dll-injection  
asked by Pramod Mohandas 9 votes
answered by josh 19 votes

Finding OEP in a VMProtect v3.0 protected malware

I've been trying to reverse engineer a malware that has been packed with VMProtect v3.0. My first instinct was to google an automated way for this and I found a script. Unfortunately the script to ...

malware unpacking anti-debugging anti-dumping  
asked by rustam Shirinov 4 votes
answered by PeterG 6 votes

Can you answer these questions?

How to extract an unknown archive files? (umd "I am alive" PC)

I'm trying to extract game files which contains textures, meshes etc. I wanted to see how hard would it be to make a texture mod. I just have knowledge on editing graphics from school and youtube ...

unpacking  
asked by Hassle 1 vote

Extracting Archive-Like file format analysis that does not seem to match known formats

Good afternoon, I am looking to try me skills at extracting some data from a proprietary format. I have made some progress but I wanted to contact the experts to see if I could gain some insights. ...

file-format  
asked by Rboreal_Frippery 1 vote

Finding PEM passphrase that may be in an executable?

I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...

windows decompilation executable openssl  
asked by Edward Severinsen 1 vote
You're receiving this message because you subscribed to the Reverse Engineering community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038

<3