All Questions
9,525
questions
0
votes
0
answers
8
views
Find offset to parameter not listed in objdump in vmlinux (which contains debug symbols)
I have a series of address offsets for ubuntu that are used in a custom toolset. I'd like to build a set of offsets for another kernel, but I can't find some ubuntu offset addresses in the debug ...
- 1
0
votes
0
answers
11
views
Failed to attach: unable to connect to remote frida-server: closed
I'm trying to bypass Frida (Android) local port scanning detection, so I followed this guide. The sequence of commands I used are : (magic_man is alias for frida_server)
adb root
adb push magic_man /...
- 101
0
votes
0
answers
48
views
Hello Watch 3+ firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
$ binwalk -...
1
vote
0
answers
65
views
Got access to SWD, but I need to identify the chip
I was able to connect to the chip via SWD/openocd, but I can't figure out what chip it is (says SM9PQ1 2322-52 on chip, googled but cant find anything). I'm hoping to download the firmware after I ...
- 11
0
votes
0
answers
31
views
resolved IDA I get a warning "7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160)"
when trying to debug an application with IDA, I get the following warning:
7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160)
After clicking Ok, I am taken to the kernelbase.dll line
...
- 1
1
vote
1
answer
69
views
What is 0xCC between each functions?
First, sorry for my bad english.
What I know about 0xCC instruction is a breakpoint instruction.
But, when I see x64 binary, each functions are seperate by multiple 0xCC instructions.
I think x64 uses ...
- 41
3
votes
0
answers
64
views
Reverse DLL and EXE at the same time?
I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
- 131
0
votes
0
answers
20
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
0
votes
0
answers
32
views
Recognize API calls of an APK
I have an Apk file for an app that functions as an AI image generator. I want to identify the specific API call responsible for the AI image generation.
How can I do it?
- 101
0
votes
0
answers
18
views
Need help when reading .sam file of cocos2D game
so recently I tried to reverse a dead game apk to get their animation cause it's so unique that me and my friend want to remake it.
But it took so long to just take each part of the image and combine ...
- 11
-1
votes
0
answers
54
views
What does this string mean?
Disclaimer: I am not gonna paste the whole string just in case it contains sensitive data.
The thing is, I have this string I got from a response's payload, and I am trying to understand what it is. I ...
- 1
0
votes
0
answers
50
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
0
votes
0
answers
20
views
Extracting pwsafe.key from memory dump
I am at uni and we have been given coursework to do. This is not asked of us but its something extra i want to try. on the encase image we have been given there is a database.kdb file which i have ...
0
votes
0
answers
41
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
0
votes
1
answer
56
views
Microchip ATSAME70Q21-CN unable to connect with JTAG or SWD
First time delving into hardware reverse engineering and can't seem to connect using JTAG nor SWD. I found two identical devices that I'm trying to understand how they work and see if I can extract ...
- 1
0
votes
2
answers
56
views
How to make a plugin python function available to IDA's console?
I want to have utility functions shared between all databases, for example:
from idautils import *
from idaapi import *
from idc import *
from ida_name import *
def FindFunctionImpl(...
- 306
2
votes
0
answers
37
views
Extracting Audio from a Game
Does anyone know a way which audio can be extracted from PCB boards such as this?
This is what I captured a long time ago from a game from 1998 called Brain Shift, and based on what I asked so far, ...
- 21
1
vote
0
answers
42
views
How does Play integrity api assures Genuine app binary
I discovered that we can use the Play integrity api instead of safetynet now to assure the integrity off an app that is running. I am wondering if people have a way of bypassing the "Genuine app ...
- 11
1
vote
0
answers
112
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
0
votes
0
answers
31
views
decode lua files cocos2dx and protected from Frida and IDA64 for hooking
I want to decode the lua and other resources files. But i cant find the key when i use frida or ida 64 it crash before the game start.
Game is here https://megamonglobal.com/
https://imgur.com/88Habwu
- 53
1
vote
0
answers
42
views
Frida: how to hook a synthetic class
When reverse engineering an APK I came across a class that was marked synthetic.
I have used JADX decompiler. The simplified result I got was:
package com;
public final class zz6 extends B implements ...
0
votes
0
answers
28
views
Scylla error on FThunk import (manually unpacking UPX)
I'm trying to practice on manual unpacking starting from UPX.
I'm using putty.exe x64
This is what I'm doing:
upx -o putty_packed.exe putty.exe
Disable Dynamic base (ASLR) using CFF Explorer on ...
- 11
0
votes
1
answer
66
views
.NET Packer/Protector
I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection
...
- 23
0
votes
1
answer
46
views
Function return in machine code (by platform/compiler)
I am asking this question to gather a knowledge base. I know in x86-64, a machine code function can have only one function return, i.e., ret instruction. I know it can be compiler (GCC, clang, etc) ...
0
votes
0
answers
41
views
Address arithmetic in Ida Pro
Can someone tell more about address arithmetic in Ida? I were looking for assembly instructions and saw this
LDR R0, =(byte_255914C - 0xC63D50)
I understood right that in r0 will be an address which ...
1
vote
0
answers
31
views
UTC Timestamp since 1900
While reverse engineering a system I found a time stamp with a peculiar year:
UTC:'20.09.118 17:41:38'
It seems as if this is the UTC timestamp since 1900, which would result in
UTC:'20.09.2018 17:41:...
1
vote
1
answer
33
views
Keycode from a serial PDA keyboard (iPAQ G750)
I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
- 11
0
votes
0
answers
23
views
radare2 on an architecture with custom instructions
I am exploring RISC-V binaries that contain custom instructions. Is there a way to add them to the disassembler?
0
votes
0
answers
54
views
Import function symbols from a reflection system into IDA
I'd like to import structs and functions from a reflection system into IDA.
The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
- 306
1
vote
0
answers
33
views
How can I create a radare2 type for a variable-length struct?
I'm trying to parse a binary file and it has a structure similar to this,
struct foo {
int64_t count_things;
int64_t offset_to_thing[count];
int8_t bytes[];
int64_t other fields;
}
...
- 1,779
2
votes
1
answer
89
views
Unix system with windows-style registry
When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination.
The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-...
1
vote
2
answers
89
views
reversing pyinstaller compiled exe
i created some compiled binaries using different languages and tried to understand them using x64dbg, the compiled binaries produced by the c language/gcc compiler were pretty easy to understand, then ...
- 11
1
vote
0
answers
45
views
Strings disappearing from dumped Frida module
I am trying to reverse some functions from Tiktok. One of them is linked to a string called X-Argus. I dumped the app using frida-ios-dump, and the string was nowhere to be found in the app's files.
...
- 61
2
votes
0
answers
60
views
What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?
What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?
I found this command useful to debug with ASLR (w/o disabling it).
- 101
0
votes
1
answer
56
views
When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?
IDA has the ability to parse C header files (by now a secondary option based on Clang also exists). It is useful to get structs and enums into your database via the Local Types view.
Question: Aside ...
- 10.9k
1
vote
1
answer
40
views
Chip identification in nonin module
This chip is off the Nonin OEM MODULE III.
I would appreciate if anyone can find out what this chip and datasheet is.
I have tried looking up the numbers in alldatasheet.com and the company to no ...
- 11
1
vote
0
answers
62
views
How to use IDA environment to run python scripts?
I am trying out following technique:
https://github.com/CMUSTRUDEL/DIRTY
This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset.
It ...
- 1,797
0
votes
0
answers
40
views
Reverse Engineering A RS-485 Steam Shower Protocol
Scenario:
A residential steam shower with a control box, touch pad display, and single input contact sensor on a half-duplex, RS-485 daisy chained network.
Goal:
Determine RS-485 based Link Layer from ...
0
votes
0
answers
21
views
DesignAKnit shape (.shp) file format
With help from information provided by members of this forum, I have more or less succeeded in reverse engineering DesignAKnit pattern (.stp) files. Has anybody worked on the shape files? I have never ...
0
votes
0
answers
65
views
Why ghidra does not use label variables and uses constants to represent code local variables?
so the question is in the title I had a simple C program to understand how global and local variables(struct) are stored in the stack. The problem is I don't know if this is good or bad or if I'm ...
- 1
0
votes
0
answers
93
views
ARM64 Stack Layout - Why 100x'A' Doesn't Crash?
I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog.
When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
- 101
0
votes
0
answers
42
views
Windows boot sequence operation
I am targeting at creating software for the Windows pre-boot environment but I have hard time finding conclusive information about how it operates. For background: this software will communicate with ...
- 1
0
votes
0
answers
34
views
Help on identifying encryption/encoding scheme
I am trying to find the encryption used in a legacy database.
The db is from 2003, and it is stored on a dbf (FoxPro) file.
The following are supposed to be ZIP numbers, more specifically, are ...
- 101
0
votes
1
answer
53
views
My ida.reg file got deleted, is there any way to restore ida?
I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed -
Is there any way to restore ida? ...
- 1,797
0
votes
0
answers
25
views
how to set flag in windbg
Let's say we have 2 functions funcA and funcB, funcA is the upstream of funcB. I want to view certain values and call stack in funcB only if funcA satisfies certain conditions. I can't achieve this ...
- 313
0
votes
1
answer
132
views
How do I deobfuscate this JavaScript? [closed]
link to the code:
https://drive.google.com/file/d/1Y-M-gkYpzkrECh6gpsVyo_ZMO5ZMgdiW/view
I tried using this site (https://lelinhtinh.github.io/de4js/), but it still accomplishes almost nothing
youtube ...
- 1
0
votes
0
answers
46
views
IDA Free Debugger slows down app substantially
I'm using IDA Free to decompile and debug an exectuable (a game, actually).
When starting the debugger, the game runs really, really slow occasionally.
Before, I have used Cheat Engine to debug the ...
- 151
0
votes
1
answer
77
views
Mnemonic suffixes for x86-64 assembly for AT&T syntax
I'm trying to understand suffixes used for the AT&T syntax for the x64 assembly used for instruction mnemonics.
For regular cases:
'b', // 8_bit
'w', // 16_bit
'l', // 32_bit
'q', /...
- 1,639
0
votes
0
answers
32
views
Audio problem rushing?
After using a new Pc for some time, suddendly a problem with the Audio occured.
While listening music with Headphones, some rushing noise appeared.
I tried to narrow down the problem :
Checking the ...
- 1
1
vote
0
answers
58
views
How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?
I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
- 11