All Questions

0
votes
1answer
10 views

why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?

the c code: void overflow (char* inbuf) { char buf[64]; strcpy(buf, inbuf); } int main (int argc, char** argv) { overflow(argv1); return 0; }
0
votes
1answer
8 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
0
votes
0answers
7 views

Debugging multiple threads

I have a PE executable which uses threads to handle most of its functionality. The code that gets run when the thread is created is obfuscated and it's hard for me to extract information just from the ...
0
votes
0answers
22 views

How to extract images/3d files from file loaded in runtime memory?

how would you dump runtime memory of a software (that has loaded 3d models and images) and then extract automatically the 3d models or images?
0
votes
0answers
13 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
0
votes
0answers
18 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
25 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... My book on reverse engineering says this about the first line: It is essentially ...
0
votes
1answer
33 views

Help unpacking U-boot firmware

I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm). I have this tf_recovery.img that's supposedly a U-Boot image, but I can't unpack it either using dumpimage ...
1
vote
1answer
20 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
2answers
46 views

How to 'hack' the chat box in an online game

First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. I play an online game that is predominately played by Spanish speaking players. I'...
0
votes
1answer
61 views

How would I go about finding the 'flag' in this QR image(Capture the Flag)?

How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz ...
-1
votes
1answer
35 views

decomplied apk with bad parameters

I'm trying to reverse engineering an android app API so this is what I tried: First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...
0
votes
0answers
72 views

Reverse engineering a CRC in a RS485 communication

I have been struggling for a week now with reverse engineering a CRC byte in a serial communication of a digital pH probe. Here are some captured bytes from pooling the probe with the original ...
0
votes
1answer
66 views

x64dbg - Locating where data is initially written

I am hoping someone can help me with a question or two. Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...
0
votes
1answer
48 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
1
vote
1answer
40 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
1
vote
1answer
39 views

Is PNF's JEB Reverse Engineering platform written in pure Java?

I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro. While examining the earlier versions of JEB,...
1
vote
0answers
79 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
42 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
0
votes
0answers
26 views

Can I use a message structure thats reverse engineered

The dispaly interface is not open source. It talks to open source firmware on a controller board. My question is if I figure out the message structure can I use this with my own non opensource ...
1
vote
1answer
34 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
2answers
48 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
1
vote
2answers
97 views

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...
1
vote
2answers
45 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
0
votes
0answers
54 views

Need help finding compression type used in flash image

I have tried multiple tools already like binwalk or trid hoping to find some information about the image. As far as I know the CPU used is from Imagination Technologies and uses some sort of RISC ...
1
vote
2answers
86 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
0answers
23 views

Directplay8 application

So I am working on an old application that use to run on Directplay8 now deprecated and the company who created this directplay8 game is out of business and has been for some years. I am writing a new ...
2
votes
1answer
59 views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
0answers
63 views

How to extract battle algorithms from an RPG?

I have Final Fantasy X HD Remaster that I'm using for this, as I find their systems quite interesting. Main goal for this is a personal project, but beyond it, it would help with the educational side ...
0
votes
0answers
19 views

Will an iOS app (IPA) that requires a login work if I repack it and install it on the device?

I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...
4
votes
0answers
48 views

How to reverse engineer an elliptical trainer? [closed]

I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful ...
0
votes
0answers
42 views

Disassembly and decryption of internal files of Unity game [closed]

I'm seeking for help and future direction for my work. I'm looking for game data of Ragnarok M: Eternal Love and stuck at point of decryption of LUA files. The game use SLua unity library (c++ ...
1
vote
1answer
47 views

How to convert hex data to decimal degree latitude and longitude? [closed]

I have been trying to decode GPS coordinates (latitude and longitude) which is in HEX format, and the documentation doesn't have a clear explanation, please help me out. I'm adding some examples below....
1
vote
0answers
66 views

OTOOL alternative for linux

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine. Currently on Mac, ...
2
votes
2answers
56 views

Angr - Solve for function return value

I'm trying to create an angr script to solve this test program: #include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, char *argv[]) { int value = atoi(...
2
votes
3answers
148 views

Jump in the middle of an instruction Coldfire firmware

I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure. ROM code quality seems pretty low, and I see ...
0
votes
1answer
79 views

Firmware reverse engineering

this question is a follow-up from this previous post: Flash dump binwalk blank, low entropy I need to reverse engineer a firmware from a very secure device. I was able to reverse engineer the PCB ...
0
votes
0answers
52 views

MS DOS virus - version discrepancy [closed]

I am trying to reverse engineer the DOS-7 virus but the one that I have seems to be significantly different from some of the notes I have read online. Particularly, the one I have does not infect the ...
0
votes
1answer
53 views

What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?

I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced. Basically the health gets stored in the stack and then pops out for displaying on the screen. ...
0
votes
2answers
79 views

Solve an angr function with string parameters

Look at this C code: #include <stdio.h> #include <string.h> int my_function(char *s); int my_function(char *s) { for (int i=0;i<strlen(s);i++) { s[i]++; } if (...
0
votes
0answers
51 views

Decode Rolling Code

I have a motorized curtain, which uses a 433Mhz RF Control. I'm trying to figure out how is it encoded. I could already get the times and converted to HEX representation. Below has 10 samples for ...
0
votes
1answer
59 views

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

This question has already been asked here but for some reason it was deleted, as "dead". I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
-1
votes
0answers
68 views

Bike battery and coded frame [closed]

I'm writing you from France sory if my english is not perfect. I'm trying to repair my bike battery (PANASONIC NKY350B2 8Ah 36V) and there is a coded frame send with UART at the start of the bike. ...
1
vote
1answer
60 views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
0
votes
0answers
35 views

Reversing custom JavaScript obfuscation/encryption

I have a js file with no external dependencies. It has two parts, one looking like this: { b: "IxIjACMBQzM=", U: [0], G: [0], k: [1, 18] }, { b: "IxFMTgH+...
0
votes
1answer
32 views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
-2
votes
0answers
32 views

How to telnet to a security camera

I have a C63S vstarcam camera and its RTSP servers keep crashing. I'm certain that if I can log into the camera I can at least restart the RTSP server or reboot the camera. The only open ports on the ...
2
votes
1answer
64 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
-1
votes
1answer
59 views

Go back to the function call address

My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace ...
1
vote
0answers
22 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...

15 30 50 per page