All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

I need to make a dominance tree using Ghidra headless

I need to make a dominator tree where I need to tell a function(a) dominates function(b). There is an API in GraphAlgorithms which needs GDirected graph and "vertex from" parameters, but I ...
0
votes
1answer
14 views

IntelPin, Ins_Insertcall?

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall: VOID CpuidCalled(const CONTEXT* ctxt) { std::cerr << "+++++&...
0
votes
2answers
45 views

Understanding Loop Statements: For & While

Background Hello! New user. I am working on a personal computer science project that involves research on loop statements such as the for and while loops in C - these loops can apply to other ...
0
votes
0answers
11 views

failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64

I have implemented packer of x86_64 shared library. Briefly, a loader is injected to a shared library, and the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
1
vote
0answers
11 views

WinApi of UWΡ Shаdοws

I want to ask, which WinApi methods being used to draw shаdοws under flyοuts on UWΡ. What I know: This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
0
votes
1answer
23 views

Dump PCode in Ghidra for a specific decompiled function

I'm working on an automatic exploit generation system for low level code, and I want to try it out on real world code. I thought PCode might be a nice place to start, since it abstractst away over ...
0
votes
0answers
23 views

Reverse enginiring Samsung Quick share uwp app

I want to make the Samsung quick share to work on my PC which is not Samsung. So which DLL file to look to reverse engineered to bypass that restriction, and how to get full access to uwp folder? ...
0
votes
1answer
15 views

Functions and methods for working with AST tree

I am implementing deep search with Python Hex Ray API. Can someone say classes and methonds for implentation this feature on IDA Python API?
0
votes
1answer
25 views

IDAPython: function parameters and return value

I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using tif = idaapi.tinfo_t() ida_nalt.get_tinfo(tif, ea) function_type = tif....
0
votes
0answers
12 views

Cutter Mac OS Debugging

I am just stuck at OSX code signing requirement to debug others' apps. (I'm new debugging on OSX) Can someone please explain the steps in order to use Cutter correctly (with rizin)? Or any other ...
0
votes
0answers
13 views

How to debug a .NET windows service: "Cannot start service from the command line or a debugger"

I have a .NET windows service which I can stop and run through Process Hacker. I can also view it's code with dnSPY. I tried to debug it without a success by trying to attach to the process. I wanted ...
1
vote
1answer
46 views

Re-analyse HexRays decompiled output

I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures. How do I automatically ...
0
votes
0answers
28 views

How can I retrieve dropped PE files from a dropper without the program necessary to execute the dropper?

I have a file (dll) that is a Cobalt Strike dropper based on the strings found inside. The file has an "entry0", and other general windows specific functions. The file appears to be ...
1
vote
1answer
38 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
0
votes
1answer
71 views

IDA interpretation of switch-case statement

This is my first question on this forum, so I hope that it would not be offensive or redundant. So recently I am attempting to developing some kernel extensions for Apple's macOS using the IOKit ...
1
vote
1answer
39 views

IDA Pro - configure register clobbering

TL;DR: The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
0
votes
1answer
41 views

.data segment seems to contain code?

I have recently been trying to improve my skills on reverse engineering. So, I opened C:/Windows/System32/DriverStore/FileRepository/xboxgip.inf_amd64_90ed6b3fdc759a5b/devauthe.sys in IDA. While ...
0
votes
1answer
23 views

How to exploit __isoc99_scanf with a segmentation fault

I'm an absolute newbie when it comes to all this side of reverse engineering. Each time I try and understand it, I get lost almost immediately. I am trying a lab. I open it up in Binary Ninja. I get ...
1
vote
0answers
9 views

Edit Squashfs filesystem in flash memory

I have read Flash memory and analyze with binwalk and find out Squashfs that I can extract with dd and open with unsquashfs . When I open this FS I want to add some file into this FS and edit some ...
0
votes
0answers
52 views

I can't solve this crackme challenge with radare2

I have a challenge in which the executable asks me to enter a key. It outputs me if the key is wrong or valid. I took a snap of the function validate_key(). In the third command of the function, more ...
1
vote
0answers
18 views

How can I tell ld to link to a local symbol in a shared object?

Symbols in shared objects can be either local or global. This is controlled by a flag in the symbol table. If the symbol is local, ld won't resolve to it. Reverse engineering can often be aided by ...
0
votes
1answer
29 views

Prevent IDA from jumping to disassembly when debugging with decompiler

I've noticed that whenever I'm single stepping for loops inside IDA hexrays decompiler it'll jump to the disassenbly view, doesn't matter if I step through with F8 ou F7, what gives and can I prevent ...
0
votes
0answers
12 views

Force a mediatek device into BROM mode via OTG from another Android device

I have been using mtkclient from my PC to unlock bootloaders and flash images onto mt8163 tablets (hat-tip to Bjoern Kerler for developing this amazing tool). In my current situation, it would be very ...
1
vote
0answers
27 views

How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?

I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth. I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
1
vote
1answer
21 views

How is the data section dealt with in PIE?

According to my understanding, for the .rodata, the compiler can simply put it "next" to the .text section, because it shares the same page permissions, so wherever the binary is loaded, an ...
-1
votes
0answers
23 views

How can I Bypass the dongle protection for this setup file? [closed]

I have this software that needs to have a dongle for the software to be installed. I do have the dongle but it's used on our radio computer since we use this program to play our audio on our station ...
2
votes
1answer
39 views

Debug shared library in Android application

There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug . When I look at /proc/PID/maps I don't see that library (I do see the ...
1
vote
1answer
53 views

Patch .net executable via hex editor

What I am trying to do: I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue: // Program.DoWork public static int SomeValue => 15; In code, ...
0
votes
1answer
28 views

Change global variable value in IDA

I have a global variable stored in the data section: data:00007FF7DDBF78E4 00 00 00 00 dword_7FF7DDBF78E4 dd 0 Is there a way to change its value?
2
votes
3answers
96 views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
2
votes
0answers
31 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
0
votes
1answer
29 views

Hook/Call __thiscall first argument of which is probably a function or constructor (__thiscall ***) [closed]

int __thiscall sub_xx43780(int (__thiscall ***this)(void *, int, int), int a2, int a3) { int *v4; // edi int v5; // ebx int v6; // eax v4 = (int *)sub_xx3F070(); v5 = *v4; v6 = (**this)(...
0
votes
0answers
21 views

How to change operand value using IDAPython

What function can be used to change an operand value? Identical functionality as ManualOperand?
0
votes
1answer
26 views

android index.android.bundle file

I downloaded an app from Raccoon. I got these files: com.company.name-3423.apk config.ar-3423.apk config.armeabi_v7a-3423.apk config.en-3423.apk config.iw-3423.apk config.ru-3423.apk config.xhdpi-3423....
0
votes
0answers
49 views

QR-Codes of Temial-Teamachine

I have a tea-machine that reads QR-Codes and brews the tea accordingly. I want to generate my own codes. I have the following codes (and more): Copy/Paste of the C-Column L7UMQRQCQAZBD OYXPVAANAB4ZE ...
0
votes
0answers
36 views

Write to file with Frida instead write to console.log

With Frida, I know how to write to console.log like: console.log('TARGETED_METHOD_CALLED'); But how can I write to a file?
0
votes
2answers
69 views

What is the data on the start of .rdata segment?

I've been doing some reverse engineering lately trying to improve my skills and came across the following bytes on the start of .rdata segment. Filename: C:/cygwin64/bin/xkbcomp.exe Bytes: 70 D3 FD FF ...
0
votes
1answer
29 views

How to make a screenshot of a graph view in IDA on Windows?

Trying to save a big graph(the default graph view of assembly instructions in IDA after you press space in text view while viewing instructions of a function) as an image. Googled this article: ...
0
votes
2answers
45 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
0
votes
0answers
26 views

Is there any way to extract sandbox bundles since the implementation of monolithic kernelcaches?

I'm trying to obtain the same result that joker -K <bundle> <kernelcache> used to obtain. I tried using jtool2, but it appears that when I'm trying to extract a bundle nothing happens when ...
0
votes
1answer
62 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
1
vote
1answer
123 views

Is it legal to publish details on how to reverse engineer a non commercial game?

Say I used a game engine and made a game (from scratch on my own). Further, I provide details on how to reverse engineer my game, including methods and details. Two questions. Is it legal to do that? ...
0
votes
1answer
58 views

How to check for a valid PE file?

How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?
1
vote
1answer
28 views

How to use decimal in x64dbg calculator?

The x64dbg calculator can evaluate hex expressions. Is there a syntax to calculate the sum of a hex value and a decimal value? For the example in the snapshot, is it possible to treat 10 as a decimal?...
1
vote
1answer
39 views

How does PIE mitigate exploits?

I read a tutorial where they compiled with the -no-pie option. Is it because the .text segment will be loaded at a random address, therefore making the address of gadgets founds inside it useless ?
1
vote
1answer
64 views

IDA Pro: unknown warnings

I am using IDA pro to analyze an old nginx binary. I am getting following warnings which I have never seen before. Does anyone have an idea about these warnings? IDA is analysing the input file... You ...
0
votes
1answer
29 views

Reverse engineering encoding of solidity argument [closed]

I'm trying to reverse engineer the encoding of solidity argument. I know that a3bc6af9c1bbf6c4afde5b11a821b47a0020ca00 when decoded is equal to deda363f5c454d96c45e7388d3bad12546c47726 Another ...
0
votes
0answers
33 views

Overhead of dynamic instrumentation tools

Is there some way to estimate the overhead of dynamic instrumentation? It certainly depends on what you actually do with injected code and how often you do inject code. But I guess there should be at ...
0
votes
1answer
28 views

Dynamic instrumentation tool for injecting assembly

I'm not sure about all tools. But afaik at least with Frida functions are patched and new code is added to other memory regions and then jumped to. The rest of the code layout stays the same. Is there ...
1
vote
0answers
57 views

What is happening with this *param_1?

I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far). I have a function that seems to read like it is a Constructor. But ...

15 30 50 per page
1
2 3 4 5
168