All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Any ways to combine Android APK with Expansion pack file?

I want to have only one APK that contains all files and resources without having to download expansion pack every time. Is there any way to combine Android APK with Expansion pack file? My expansion ...
0
votes
0answers
17 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
16 views

how can I capture league of legends traffic with burp

league of legends offer money if I hack them https://www.riotgames.com/en/reporting-a-security-vulnerability league of legends use this ports TCP: 2099,5222-5223,8088,8393-8400 UDP: 5000-5500,8088 ...
0
votes
0answers
9 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
-1
votes
0answers
21 views

Please help detect crypt algoritm?

I reserch one progrmam and see strange crypt algorytm. I see on decrypt function. Function use to precalculate 3072 array and some additionla array. What is the algoritm may be? I put all code on ...
0
votes
1answer
35 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
0
votes
1answer
43 views

How can I de-obfuscate a VBScript (.vbs) file?

I have a VBScript (.vbs) file that is a malware dropper. It executes correctly in a commercial malware sandbox. but does not act the same in my manual analysis lab, and I need to figure out why. The ...
0
votes
0answers
12 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
0answers
27 views

Decode lua scripts for cocos2d based game / frida, android

I'm trying to decrypt LUA scripts from cocos2dx game (for wiki). In most cases, it's XXTEA based, but not in this case. The game itself: https://apkpure.com/might-magic-era-of-chaos/com.ubisoft.might....
0
votes
1answer
36 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
-1
votes
1answer
71 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
18 views

Reverse engineering algorithm for get keys

I have 2 groups of 4 byte and from this i have to get a key that have 6 byte. Im trying to get the algorithm but i cant in any way. The 1st group have only one bit different from the 2nd one. Idk if i ...
0
votes
2answers
57 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
1
vote
0answers
22 views

Strange memory allocation behaviour

I'm currently working on a modding library for a particular game, and I have come across a part of the menu system that I can't figure out the purpose of. The expression in question is this: unsigned ...
0
votes
0answers
15 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
24 views

How to create an uninitialized variable in Ghidra?

The code under inspection is a native Android library used in an Android application. The decompiler is showing me a lot of lines in the style DAT_12345678 = 0x12345678 with ascending addresses. I ...
1
vote
0answers
37 views

c-sky family based gx6605 firmware analysis to read data

from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor. my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-...
0
votes
0answers
35 views

Question about basic hooking concept

I have created a c++ complete project to hook GOG game and work perfectly (this add a unofficial Force Feedback support). To to it I have found on github a custom version of d3d9.dll with with DllMain ...
0
votes
0answers
21 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
0
votes
1answer
22 views

Can't find sequence of bytes in IDA while debugging

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44: I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
1
vote
0answers
32 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
0
votes
0answers
24 views

understand how call __usercall function

I have disassable with ida this function: int __usercall sub_4F314A@<eax>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, int a5, int a6) I attach the original assembly: can you ...
0
votes
1answer
50 views

What checksum algorithm is this?

I'm trying to control an air conditioning unit. The app and the unit communicate using the Broadlink protocol. I can decode the settings it's sending and replay them. The payload is 32 bytes but only ...
0
votes
1answer
32 views

Application only Crashes on CPU with SHA extension

Have an application that only crashes if CPU has SHA extensions. After some investigation find a hashing routine that only occurs if CPU has SHA extensions. I'm trying to confirm if issue is with ...
0
votes
1answer
21 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...
0
votes
1answer
23 views

ghidra scripting: ghidra unable to resolve string type

I have following code: #include <stdio.h> char somes[10] = "good job!"; char somes1[8] = "another"; char somes2 [5] = "job"; int func() { printf("You did a ...
-1
votes
2answers
74 views

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

I have literally no idea how to start to decode this kind of a file, but I really want these fonts and a decoder would be huge for the community, so any help would be great. Linked below is a google ...
0
votes
1answer
56 views

Ransomware Source Codes

Have been searching ransomware source codes for analysis(as much as possible). I have already checked with sites like Any.Run but most of their samples are .exe and binary files. Does any one have any ...
0
votes
1answer
55 views

Password evaluated from the sum of ASCII letters

After analyzing the code, I have been able to understand and recreate the algorithm used to check if the password the binary takes is correct, but don't know how to solve it (or at least can't think ...
0
votes
1answer
29 views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
0
votes
1answer
51 views

Generating an elf header

To get a basic understanding of the ELF format, I'm writing a basic program to generate a valid elf file from the most basic assembly output. I'm going step-by-step so I'll probably ask a few ...
0
votes
0answers
40 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
-1
votes
0answers
29 views

String to instruction

I am more into reverse engineering more than binary exploitation. I like to bypass jump instruction. but sometimes, I get very frustrated when I don't find the jump instruction via a string. for ...
0
votes
1answer
26 views

How to find the file address of AddressOfEntryPoint

I have a binary file and in the optional header I have the address of the entry point 0x00011046 but when I put the file inside HEX editor this address doesn't exist, more than that 0x000097f0. I ...
0
votes
0answers
36 views

ret2libc exploit issue

i have some code in c i am working to write exploit for it: #include <stdio.h> void secretFunction() { printf("Congratulations!\n"); printf("You have ...
0
votes
0answers
12 views

How can I have an interactive r2pipe session?

I am trying to make an interactive tutorial. It uses radare2 with r2pipe as its reverse engineering toolkit. I want my users to be able to use the visual mode through r2pipe. In order for the visual ...
0
votes
0answers
23 views

How to change value at a memory address?

I am solving Micro Corruption CTF (msp430 assembly) How can I put the value 0x3c4f inside address 0x439c (r15 from Register state)? When cmp instruction executes, we want the value at memory address ...
0
votes
0answers
14 views

IDA, wrong jmp operand after patching

I'm writing a python script for IDA to automate the deobfuscation of a binary. After patching with a jmp instruction ida provides the following disassembly: .text:008FD01E jmp ...
0
votes
0answers
17 views

Memory Corruption CTF: How to enter null character in user prompted input?

I was solving memory corruption CTF In the picture you see a memory dump. I solve the problem when the string stored at addresses 2400, 2401... 2407 (in assembly it compares 8 memory addresses ...
-1
votes
1answer
57 views

Is decompilation easier or generally more accurate for smaller ISAs?

I am wondering if decompilation would be easier for an ISA with fewer instructions. For example, RISC-V vs x86.
-1
votes
1answer
42 views

IDA decompile binary file

how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
0
votes
2answers
56 views

How to probe my smart thermostat for reprogramming?

I got a Greenlite AIRZ thermostat which connects to my home wifi so that I can change the settings remotely on my phone. The Android app is, however, difficult to use, so I'm thinking about making my ...
1
vote
1answer
46 views

How to enlarge block in Ghidra's Function Graph View?

I can't seem to figure out how to do such a trivial task: Basically, how can I enlarge a block in Ghidra's Function Graph View so that I can see all of the instructions (instead of ...). There does ...
0
votes
1answer
23 views

Running radare command on each line of the output of another command

Say, I have a command in radare which produces multiple input, say afl. I can run it and extract many addresses: [0x5579ca2e2196]> afl~[0] 0x5579ca2e2060 0x5579ca2e4fe0 0x5579ca2e2090 ...
1
vote
1answer
48 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
0answers
25 views

debugging a android built in shared library (which comes with android rom)

suppose I have a .so file (android built-in shared object ) {lets suppose a camera .so file } now I am writing an android application and using high-level API provided by google for interacting with ...
0
votes
0answers
42 views

Firmware reversing IP camera

I'm fairly new to reversing and was tasked to reverse a IP camera to find its authentication web CGI. stuck on reversing BFLT executable and not sure where to look for the authentication, found the ...
1
vote
1answer
58 views

Disassemble and debug dynamic generated code executed via delegate in c#

I'm trying to reverse engeneer a malware using dnSpy that at some point do this: delegate IntPtr H7IREAEBYY(string path, IntPtr data); byte[] array = new byte[] { 233, 151, ... } IntPtr value ...
0
votes
3answers
104 views

How to find if a function is using registers as parameters?

The disassembly of the function Winload!CmpFindNlsData whose prototype I'm trying to construct 00893c10 8bff mov edi,edi 00893c12 55 push ebp 00893c13 8bec ...
0
votes
0answers
21 views

in ida pro 7+, what is the way to get a list of applied functions by signature?

I can only see the number of applied functions, but not the full list. In the function window, there is no way to differentiate which signature lib is applied

15 30 50 per page
1
2 3 4 5
147