All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Cisc/Risc in reverse engineering

What is the difference between Cisc/Risc when reverse engineer binary? I know the difference between then, but is there any difference while reversing? Is it easy to reverse Cisc than Risc?
0
votes
0answers
14 views

How can I reverse engineering .lua file

I have *.lua file which is the android application. Is that possible to use reverse engineering in that lua and extract code because when open it showing strange symbol like this FFSZÏS!¤x»ßÿ÷^1ù
1
vote
1answer
16 views

Memory map in AVR Harvard architecture

In this video https://youtu.be/D0VKuZuuvW8?t=259 . You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff . So in the video he ask ...
0
votes
1answer
37 views

Which JSON object compact binary serialization is this?

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server. Does anyone recognize this? I've attached the first ...
0
votes
0answers
19 views

Extract .NET code from React Native for Windows

I'm interested in reversing a UWP program made using React Native for Windows. Once such applications are compiled, the logic is contained in one dll. After opening this dll into IDA, it appears ...
0
votes
1answer
22 views

IDA decompiled function signature mismatch

I am on the last version of IDA. There is a function B, that its signature is B(int a,int b). There is a function A that calls it. But in function A, the call appears like B(12) for example. How ...
2
votes
0answers
83 views

Reverse engineering a checksum algorithm

I am attempting to implement an editor for a discontinued hardware drum synthesizer which uses undocumented system exclusive MIDI messages for communication. I've figured out the patch format, but I ...
0
votes
1answer
43 views

Finding “func main” in a stripped binary written in GO

I'm reversing a binary that was apart of a CTF I was involved in about a month ago. It was too large of a binary to do during the challenge so I am doing it now. I am having trouble finding the main ...
0
votes
0answers
29 views

Can't read squashfs filesystem

I retrieved the content of a NAND flash and used binwalk to analyze it. Binwalk found a squashfs filesystem: 5309174 0x5102F6 Squashfs filesystem, little endian, version 4.0, compression:...
0
votes
1answer
19 views

id the HW port and protocol

i have a vtech baby monitor and since i want to be aware of it while i'm playing in VR (PC, HTC vaive/Valve index) i still want to see if the baby starts crying. on this monitor there is external ...
0
votes
1answer
24 views

IDA - ObjC - Meaning of _BYTE and dword_0?

This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
1
vote
0answers
26 views

Obtaining a relation between reads and writes with Pin

I'll be honest, Pin is confounding my intuition. Let's say, for the sake of argument, I have a line a = b + c and I wish to then store the addresses of b and c as a's dependencies, say, in a map, ...
0
votes
0answers
18 views

Mark reset code in IDA

I have have firmware to processor that I need to find ram,rom and reset vector by datasheet to analyze it. I found this article (My cpu is not like this article) https://rdomanski.github.io/...
0
votes
0answers
23 views

Copy content of User32.dll with some modifications

I am newbie to reverse engineering, so I have a qustion. I need to create a copy of user32.dll file with modification in one function. Then I want to place it back into system32 folder. Can you help ...
0
votes
1answer
28 views

indirect return value address

I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void. I've noticed that every calle reads from x8/w8 afterwards, from wikipedia; ...
0
votes
0answers
5 views

I have edited the GnssLocationProvider.smali file but fail to Smali back anyone can help?

Hi All I have use command apktool d to baksmali classes.dex and i have make some change using notepad++ on the GnssLocationProvider.smali file and want to smali back to classes.dex but after i do so( ...
0
votes
1answer
18 views

IDA Change ram and rom without reopen IDA

when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary. Is there any smart way ?
2
votes
0answers
43 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
0
votes
0answers
24 views

Offline YouTube [closed]

I'm designing an Android app that does not allow user to open files downloaded through it. But how do I write the app to hide what ever file it downloads and only accessible by it.
2
votes
0answers
23 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
1
vote
1answer
81 views
+50

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
0
votes
0answers
12 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
2answers
79 views

How to solve this anti-disassembler trick?

I have this __asm instruction in C code: int func_0x8b4c55a0() { __asm { call $ +5 add[esp],5 ret } } int main() { char cVar1; if ((cVar1 = ...
0
votes
0answers
19 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
2answers
67 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
1
vote
1answer
33 views

C# - Identical block of code, but IL instructions changed after update. How do I modify the more convoluted update?

Background info - For the game 7 Days To Die, there is a C# wrapper that implements the Harmony API, which allows us to intercept the game's function calls, as well as changing the IL instructions ...
0
votes
1answer
54 views

How can I deobfuscate this javascript code

I am trying to deobfuscate this javascript code, but I don't know how it was created. Can you please tell me what the mechanism or the function is that generate such characters in javascript? É=-~-~[]...
2
votes
2answers
128 views

CPU support by ghidra

Where can I see all the CPUs supported by Ghidra? Does Ghidra support more CPUs than IDA Pro?
2
votes
0answers
31 views

Ghidra loading linux kernel function signatures

TLTR I want to load linux kernel headers vs. 4.19 to Ghidra so it recognizes kernel structures and function signatures. Full description I'm trying to reverse engineer a linux kernel module (kernel ...
0
votes
0answers
66 views

Reverse engineering IOT training course [closed]

Looking for an advanced reverse engineering IOT training course with a focus on firmware packing/unpacking, file systems, Linux, watchdog, etc. I found a nice video https://m.youtube.com/watch?v=...
-1
votes
0answers
28 views

How to decompile pyinstaller exe? [duplicate]

How do I decompile a pyinstaller exe, back to source code?
1
vote
1answer
29 views

Is there a way to edit structure field value in memory during debug

I'm debugging some code and I know that there's a structure in memory, I have a definition of the structure, I apply it on memory, then I look at the structure field values, and I see that one of the ...
1
vote
0answers
46 views

Alternative for Wireshark for USB packet sniffing

I'm looking for alternative for Wireshark, with this requirements: Cross-platform (Windows and Linux) USB packet sniffing Easy creation of dissectors Wireshark is great, but Lua API for writing ...
1
vote
0answers
31 views

How to hook eval function in node.js

As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
0
votes
1answer
74 views

Encrypt a function in the exe and decrypt at runtime C++, PE32 [closed]

I want to keep an important function encrypted in the exe and while running the program, decrypt it at run time from memory. After execution of the function, I will encrypt it back in the memory (so ...
0
votes
1answer
69 views

How to to decompile a pyinstaller exe, back to source code?

Python versions, this method has been tried on: 3.7.5, 3.6.0, 3.5.0, 2.7.17? (I know, Im just too desperate to get my source back) I have problem with decompiling an exe. I kinda deleted the wrong ...
0
votes
0answers
9 views

flare-vm installation not completed? [migrated]

*** I'm not really sure if this is the right place to ask this kind of question. If not, let me know the right site. Thanks I've just installed flare-vm via install.ps1 script from https://github....
2
votes
2answers
68 views

Are there existing automated approaches to reverse engineering the data types in a binary data stream?

Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet. Are there existing tools that automatically detect (or estimate) the various data types present and their ...
0
votes
0answers
50 views

Export logic analyzer data to protocol analyzer

Probably I'm little ot but I'm unsure where to ask this. Is there any easy (already working) way to export my logic analyzer data (vcd format) to a protocol analyzer like Wireshark? I'm analyzing an ...
0
votes
0answers
28 views

limit application access

There are applications that block of many software packages to secure themselves.(sniffers , monitoring , and more ...) For example, the software examines parts of Windows including (list of ...
0
votes
0answers
24 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
1
vote
1answer
83 views

Best way to protect source code of .exe program running on Python?

I am developing proprietary software that would be distributed in a form of .exe file. In order to use it, users will have to authenticate with their whitelist credentials (username + password). The ...
0
votes
1answer
48 views

Isolate the call to a function

Is it possible to call a function of a binary and obtain its result (without calling other functions), to isolate; are there any tools to do this?
0
votes
0answers
80 views

How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange

This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine ...
0
votes
0answers
37 views

ollydbg help creating a patch

am new to ollydbg unpacking and patching. i have a programme packed with themida and i use a 1.3 unpacker script which opens the programme to the ebp opens the software up fully then i pause it here. ...
3
votes
1answer
39 views

ELF file format find shared object for symbol

(in Windows) PE file format contains Import table with Module\Dll Name which tells PE loader where to search for symbol e.g. KERNEL32.dll -> CreateFileW In the ELF file format there is Symbol ...
1
vote
0answers
65 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
0
votes
1answer
45 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
3
votes
2answers
180 views

Struct reconstruction in decompilers

I'm testing several decompilers about struct reconstruction, given the following C example: struct S { int x; int y; long z; long t; }; int foo(struct S s) { return s.x + s.y + s....
0
votes
0answers
29 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...

15 30 50 per page