All Questions

Filter by
Sorted by
Tagged with
1 vote
0 answers
17 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
  • 111
1 vote
1 answer
65 views

Identify two structs in IDA

When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
  • 113
1 vote
0 answers
29 views

can't debug properly

In the last few days I tried to solve "unlink" challenge in pwnable.kr and I'm struggling to attach a debugger remotely and locally on the server using pwntools (code added below). #!/usr/...
  • 11
0 votes
0 answers
19 views

How to prevent dynamic loader from modifying binary in memory?

I have patched a loadable object (an .so file) from this: xor eax,0x304b7c0 to this: mov eax,0x0 When I try to run my binary with these modifications, the application loads the .so file and then it ...
2 votes
0 answers
22 views

Decompiling an executable compiled by vercel/pkg

I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg I tried using pkg-unpacker however the output is ...
  • 21
1 vote
1 answer
48 views

unpack ZXIC chip firmware

Is it possible to unpack this firmware for ZXIC chipset device? I tried to unpack it with binwalk but wasn't successful and I saw this information: DECIMAL HEXADECIMAL DESCRIPTION -----------...
1 vote
0 answers
22 views

What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?

I am trying to reverse a portion of a game, that game loads a DLL file called "ddraw.dll". Most of the DLL file functions don't appear by their names but appear by their addresses for ...
  • 135
1 vote
0 answers
15 views

Where is Zyxel nas326 system log files. and how to see failed login ip

Does anyone know where is log files in the Zyxel nas326? I want to send failed tcp login ip to my server so I know if someone is logging in to my nas and I can block the ip.
  • 11
0 votes
0 answers
16 views

I have an application that views an encrypted document and stored it as an (encrypted) pdf

When I load this application with lldb, surprisingly no anti-debugger techniques scuttle it. I've even managed to find an interesting breakpoint to set... break set -r AES_decrypt -s /usr/lib/...
  • 179
0 votes
0 answers
15 views

X32dbg Stepping through assembly, seems to get stuck on one line and not progress forward, even though the application continues to progress forward

I'm using x32dbg. Stepping through assembly, I get to the following instructions: '''76B7CC12 | 8B4C24 54 | mov ecx,dword ptr ss:[esp+54] |''' If I continue to step through ...
0 votes
0 answers
29 views

How can i get the address of a function in memory?

I am currently completing a CTF exercise where i must attempt to overwrite a function pointer on the stack through a buffer overflow here is the code: #include <err.h> #include <stdio.h> #...
0 votes
0 answers
27 views

Is there any way to get old Windows kernel drivers?

I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
0 votes
1 answer
26 views

How do I install fail2ban to Zyxel nas326

So I just got Zyxel nas326 and I looked from internet how to protect nas from bruteforce attack and I found that fail2ban can protect my nas. Then I found that I can't download any programs to nas326. ...
  • 11
-1 votes
0 answers
32 views

loader a Win32 exe C++

I need to edit this source for patch multi address https://github.com/vinodkumarys/simple-memory-patching-loader/blob/master/loader.cpp src: https://github.com/vinodkumarys/simple-memory-patching-...
0 votes
1 answer
22 views

WinGraph32 for the OllyFlow plugin

I am trying to use the OllyFlow plugin for OllyDbg 1.10. It requires WinGraph32.exe, which was apparently distributed with IDA at some point, because the book Game Hacking says: Wingraph32 is not ...
  • 103
0 votes
1 answer
48 views

Editing Binary File with Hex Editor

If I edit out and replace four bytes of a binary file with 00 00 00 00 and the binary crashes when it runs does it mean that there is some sort of security protection? How likely is it that the crash ...
0 votes
1 answer
48 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
0 votes
0 answers
20 views

Are physical databooks of any use?

I have taken over the office of an old retired electronics guy. As a result, I have a huge shelf filled with data books: Intel, Atmel, Texas Instruments... etc. My instinct is to throw these all away ...
1 vote
1 answer
38 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Running a kernel driver I wrote. The driver includes: mov rax, cr0 btr rax, 10h mov cr0, rax to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
0 votes
0 answers
13 views

Intercepting a PHP module with frida

I have a PHP module, and I'm trying to hook the functions of that module. ... 39: 0000000000024a60 1858 FUNC LOCAL DEFAULT 12 zim_ClassName_ClassName_exec ... 90: 0000000000028f10 8 ...
  • 156
0 votes
0 answers
22 views

What skills are need to find ways of take root of Phones?

I am very interested in about take root of Android phones and I'm noob of reverse engineering. I have some of old Android devices that already unused. Some Android devices provide easier path to root ...
0 votes
0 answers
9 views

Sentinel C-Plus B emulator help

I find your post. I need an emulator for the Sentinel C-Plus B dongle. I was able to find the dumper. In this post I found the SC_Emulator.zip which seems to work: http://www.reteam.org/board/...
  • 1
1 vote
2 answers
59 views

How to attach and step through a running .NET process?

This is quite easy to do with a low-level debugger, like x64dbg (for instance). Say, if I have a running native process I can attach to it, set a breakpoint, and then step through native code with it. ...
  • 1,335
1 vote
1 answer
30 views

How to set a breakpoint in android's openssl library in running android application?

I'm debugging an obfuscated android application. I use Android Studio's debugger. I attach it remotely to my physical device via adb. I can set a breakpoint in the app smali code, but when I try to ...
  • 13
0 votes
1 answer
21 views

Frida script returning different instruction at address compared to entering commands in repl

I have an iOS device on 14.2 and am using frida 15.2.2 on Ubuntu 18.04. If I launch an app via frida, in the repl I can get the base address of the module, add an offset to that address, and print the ...
  • 107
0 votes
1 answer
63 views

Reversing encrypted file with unknown extension

Hello to everyone in RE section! I have a binary file with questionable extension(meaning idk if its exe/dll). Multiple variations of this file can be acquired throught connection to remote CDN via ...
2 votes
1 answer
55 views

Am I missing symbols when RE'ing shellcode?

I have a question about reversing a tutorial (https://blog.nviso.eu/2021/09/02/anatomy-and-disruption-of-metasploit-shellcode/) which shows how to reverse engineering shellcode. My question is simple: ...
1 vote
1 answer
27 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

We have an EXE that IDA pro lists the following segments: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs cseg01 00000000 0000EA50 ? ? ? . ...
0 votes
1 answer
49 views

reverse engineering image format

Can anyone help me with this? I think it's a targa image
  • 1
0 votes
0 answers
30 views

Reverse Engineer Emulated Game

I am trying to reverse engineer an emulated game. Is it possible to increase the score by cheating in an emulated game, or not because it is in a sandboxed environment? Does the console being emulated ...
1 vote
0 answers
101 views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6 wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files not ...
1 vote
0 answers
36 views

Is it possible to recover/acquire schema of FlatBuffers binary file

Without having access to the schema file, is it possible to recover the schema of a binary FlatBuffers file by examining the file? Also, some of those files contain encrypted scalars. If you can ...
  • 11
1 vote
1 answer
30 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
  • 43
0 votes
1 answer
27 views

Paused at the right (?) breakpoint, what do I do next?

The output currently looks like this: 2022-09-10 00:09:03.955729-0500 REDACTED[51480:28773370] -openPDFWithPath: /Users/REDACTED/Library/Containers/com.REDACTED/Data/Library/Application Support/...
  • 179
1 vote
1 answer
30 views

Cannot reset botched IDA setting

I managed to accidentally modify the opcode column setting of the view window to display the data in word format (2 byte). For the life of me I cannot seem to figure how to switch if back to byte ...
  • 11
1 vote
0 answers
49 views

Reverse-engineering the Sony Camset (Camera Settings) file format

Context Newer Sony cameras have functionality that allows them to: save the current camera settings (shooting mode, auto-focus mode, etc.) to a file load the camera settings from a file into the ...
1 vote
0 answers
28 views

Changing Offset Value with frida

So I found this offset in ghidra, and I want to change that offsets value in Frida with this picture I have deduced that the offset is 0x6ae210 What I want to do with this is change game....
3 votes
1 answer
67 views

How to select an item in IDAPython, in decompilation view?

I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures). I have changed the arguments types for a list of ...
  • 68
2 votes
0 answers
38 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
1 vote
1 answer
90 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
  • 113
0 votes
0 answers
32 views

how to hide all export functions in a elf so library?

I have this game I want to patch, the game server executable loads a elf so library with functions. I want to add new functions into this library so I patched the game server executable with elfpatch ...
1 vote
0 answers
25 views

Auto-loaded type information and relationship between .til and .sig: how to find links and how to change them (config)?

NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm. Let's say I load a PE ...
  • 10.5k
2 votes
1 answer
103 views

Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph

I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
2 votes
1 answer
40 views

Can an OpenWrt FIT kernel be virtualized in qemu?

I have a router I'd like to virtualize in order to do some dynamic analysis. I could virtualize individual binaries with qemu, but I'd like to have the whole ecosystem up and running. I'll start here: ...
2 votes
1 answer
72 views

Is there a way to show/enable mnemonic description in Ghidra?

I am currently working on java byte code in GHIDRA and I was just wondering if there was a way to show the instruction descriptions like there is in IDA and x64dbg. For e.g bipush - Push byte
2 votes
1 answer
58 views

Is there any way to understand if a raw binary firmware is Cortex-M or not?

I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares? I have some ideas like Interrupt vector Table (...
0 votes
0 answers
34 views

How to find the fifth function argument on stack in windbg?

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
0 votes
0 answers
98 views

ghidra returning wrong function address

I am reverse engineering a android app shared library (.so file) and I am trying to use frida to hook a non exported native function I am using this hook const ghidraImageBase = 0x00100000; const ...
0 votes
1 answer
49 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
2 votes
0 answers
41 views

How to disassemble Renesas RX210 MCU firmware?

I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
  • 55

15 30 50 per page
1
2 3 4 5
177