All Questions

Filter by
Sorted by
Tagged with
0 votes
1 answer
23 views

What does the code do?

Challenge #64 What does this code do? An array of array[x][y] form is accessed here. Try to determine the dimensions of the array, at least partially, by finding y. _array$ = 8 _x$ = 12 _y$ = 16 _f ...
user avatar
1 vote
1 answer
15 views

Mov instruction from a pointed location at the beginning of a program

I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
user avatar
  • 123
0 votes
0 answers
16 views

Trace java calls from a native library using frida

Im trying to trace method calls from a native library using frida I've tried jnitrace but it won't print anything Do you have any suggestion?
user avatar
0 votes
0 answers
20 views

How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?

I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
user avatar
0 votes
0 answers
13 views

How do I reverse engineer an Electron compiled file?- a JSC Bytenode file

I have a bytenode JSC file which is described as: This tool truly compiles your JavaScript code into V8 bytecode, so that you can protect your source code. It can be used with Node.js, as well as ...
user avatar
  • 103
0 votes
2 answers
39 views

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other. Based on asking others ...
user avatar
  • 125
0 votes
0 answers
18 views

How can I set a breakpont before the software exits in Dnspy?

I'm trying to reverse a software using Dnspy but after a few seconds, the software exits, how can I find the code that exits the program and modify it? In Ollydbg I would look for the command ...
user avatar
  • 103
0 votes
0 answers
11 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
user avatar
0 votes
1 answer
34 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
user avatar
0 votes
0 answers
35 views

How to fix CRC32 checksum in an xz-compressed folder without corrupting the data?

I need to fix the CRC32 checksum of an xz folder that is part firmware. I extracted the files from this folder, made the necessary modifications and recompiled using mksquashfs. How do I fix the ...
user avatar
  • 1
1 vote
1 answer
39 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
user avatar
  • 123
2 votes
0 answers
47 views

Load to Ida binary with all of SO

I have a Linux ARM binary with a lot of shared libraries. Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
user avatar
-1 votes
1 answer
89 views

How to call and what means: _DWORD *__thiscall

I have one question maybe you can help, I always find this functions in IDA: void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4) And I use them like this: // talkChannel typedef DWORD(...
user avatar
  • 31
1 vote
1 answer
93 views

help with Ghidra and rewriting assembly

I'm learning reversing and for that i use Ghidra. There is program i'm trying to modify so i can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
user avatar
1 vote
0 answers
24 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
user avatar
-1 votes
0 answers
244 views

What does this lowlevel function do?

I am currently reversing a game called Warframe and have gotten quite far. There is just one function which is really making me wanna give up. One hint I can give: The function was found IN another ...
user avatar
  • 1
0 votes
0 answers
33 views

Is there any problematic difference in Intel and AMD processors for reverse engineering?

Maybe this question is not fully adapted for this site, I'll delete it if it is the case. I'm considering working in the reverse engineering field. I will also soon get my own pc. One of the main ...
user avatar
0 votes
0 answers
22 views

Decrypting Android game using cocos2dx-lua [closed]

There's an app that I would like decrypting but the process so far has been a pain for me so I'm looking to hire anyone who's interested in making some money. Usually I'd try and do it myself but I ...
user avatar
1 vote
1 answer
51 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
user avatar
  • 31
0 votes
0 answers
53 views

Tenda router + Firmware-Mod-kit = Firmware header not supported

I have been working hard for over 1 week trying to get a modified firmware installed on a Tenda AC10 V1 router. It is the original firmware with some modifications to unlock extra features. The ...
user avatar
  • 1
0 votes
1 answer
43 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
user avatar
0 votes
1 answer
49 views

Find the first function that sets the value currently stored in a given register

I'm interested in a general approach to the following problem: Some function F_Init allocates a byte buffer Buffer with a size BufSize. The buffer is allocated each frame/iteration resulting in ...
user avatar
2 votes
1 answer
60 views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
user avatar
0 votes
0 answers
22 views

Restore debug symbol for a embedded .bin image with an .axf file

I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device. The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
user avatar
0 votes
0 answers
47 views

Can't get Visual C++ to generate the same code give by Ghidra

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following: ...
user avatar
-1 votes
0 answers
29 views

ida pro overwrite bytes not increase rom location (Value)

I am using IDA pro and try to edit hex code but when try to edit then it's overwrite the hex code not adding new code. In my IDA pro edit patch already enable but still overwrite and old hex code ...
user avatar
0 votes
0 answers
28 views

How can IDA Pro disassemble paged memory from HCS12 processort?

I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory? If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
user avatar
1 vote
1 answer
39 views

How to define an xmmword variable in IDA?

How to define an xmmword variable in IDA? IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords: I also tried to set the type after pressing ...
user avatar
  • 206
1 vote
0 answers
27 views

In IDA is there a way to load the PE headers after the initial loading?

This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it. But suppose I have already worked on an IDB for a while and realize that ...
user avatar
  • 10.5k
1 vote
0 answers
43 views

Reverse engineer CRC Canbus

I am trying to figure out what I believe is a CRC8 value on some 8 byte canbus messages. I have tried "RevEng" without luck. But maybe some of you are able to figure it out. Some messages in ...
user avatar
  • 11
0 votes
1 answer
25 views

Interpreting Response for Modbus/TCP function code 0x08 Diagnostics

A client application sends a Modbus 0x08 diagnostics query to Schneider modicun PLC over TCP/IP. The software describes itself as designed for Modicon Micro/Compact/Quantum/Momentum/584/984. Payload ...
user avatar
1 vote
0 answers
23 views

How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?

I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the ...
user avatar
0 votes
0 answers
13 views

How are system page map entries belonging to process's updated?

Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
user avatar
1 vote
0 answers
55 views

Implementing syscalls under Miasm

I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two. So I tried to ...
user avatar
0 votes
1 answer
65 views

Deobfuscator and decompiler for .NET [closed]

Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
user avatar
0 votes
1 answer
54 views

How to reference an address set by 2 instructions in Ghidra

I encountered the following 2 instructions while reversing Tricore assembly: These 2 instructions load the final address: 0x804A9474. Where a global symbol resides. Is there a way to hint Ghidra the ...
user avatar
0 votes
0 answers
21 views

iOS unknown library sending ssl pinned request

Here is my problem: I am trying to access to a ssl pinned request sent by an action I am doing on an iPhone. The action I am making sends two requests: The first one is ssl pinned, sent by a pre-...
user avatar
  • 1
0 votes
1 answer
54 views

x64dbg: is there a way to save the complete disassembly of a module to a text file?

Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
user avatar
0 votes
0 answers
22 views

How does `bne` know which bit field in the condition register to branch on? (PowerPC Gekko)

I'm currently reversing a PowerPC Gekko program and saw a bne instruction that branched on the condition register after a rlwinm function. Perfect. That makes sense. bne is checking the third bit of ...
user avatar
1 vote
1 answer
54 views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
user avatar
0 votes
0 answers
46 views

Password encryption when transferring from master to PLC

So, there is a PLC and a SoftMaster program to work with it. The PLC works according to the XGFenet protocol. When connecting to the PLC for the first time in SoftMaster, a password must be entered. ...
user avatar
0 votes
0 answers
90 views

Basic buffer-overflow on a remote program with Python/pwntools

I work on a online program in which I should do a buffer Overflow. When I run the program, I have to complete a sum of two numbers generated randomly) : >>> 451389913 + 1587598959 = If I put ...
user avatar
  • 101
0 votes
1 answer
49 views

Floating point number mangled in a proprietary file

I'm reverse engineering a proprietary file format that contains a set of points to construct a curve (FL Studio's .fnv format). What i have trouble with in particular is how the Y-coordinates are ...
user avatar
0 votes
0 answers
24 views

Reverse engineering Powermac G4 Cube firmware

I need help. I am neither a programmer, nor an electrical engineer, but I am willing to learn if I only knew where to start. The G4 Cube was famous for having no internal audio. However I have found ...
user avatar
0 votes
0 answers
31 views

Finding function called when button is clicked

I am trying to find what function was called from the main application upon the button click in the specific game. In particular, there is a starting UI, where I can select Load option and then click ...
user avatar
  • 146
1 vote
0 answers
25 views

Warning: struct->til conversion failed

In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code. So I created a struct from the selection (Create struct from ...
user avatar
  • 10.5k
1 vote
2 answers
70 views

What is the best approach to reverse a custom TCP Application Layer?

I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump. What is the best approach to reverse the custom application layer? Some data seems to be ascii ...
user avatar
1 vote
1 answer
73 views

Exporting dll out of a process memory

Idk if this is asked before sorry So I tried something with Process Hacker and Windbg but it couldn't help me The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
user avatar
  • 13
1 vote
1 answer
100 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
user avatar
  • 39
0 votes
1 answer
66 views

Frida hook multiple processes

There was such a situation. I run the frida hook on the process like this: frida -f '..\hack2\hackme.exe' -l .\start.js In the script itself I do this var moduleData = Process.getModuleByName("...
user avatar
  • 11

15 30 50 per page
1
2 3 4 5
173