All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Breakpoint in GDB hit 144 times before first call to function

I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
2
votes
1answer
73 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
0answers
11 views

LOG Urls that APK requests using smali

I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events. ...
0
votes
0answers
28 views

How do you mapped a stripped function back to it's real address?

So basically this is a stripped android 32bit ELF (it's just a linux dll with android handle it a bit different - NDK/JNI), and I unpacked it. Now the function inside is cleaner and you can see ...
0
votes
0answers
16 views

Causeway DOS Extender unpacker?

I've seen an old Causeway Extender unpacker floating around, at some point being on EXETOOLS before they went forum-only, by the name "CauseWay DOS Extender Unpacker v0.17" or "unpcwc.zip". Is there a ...
1
vote
0answers
25 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
1
vote
1answer
37 views

SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
0
votes
0answers
36 views

Packet: Game last byte encrypted?

12:14 WSARecv() C3-73-3E-BE-36-2F-14-37-37 F4-44-09-89-01-18-23-00-00 ------------------------------------------ 12:14 send() C3-73-38-31-0E-35-EE-35-A5-35-7F-34-37-37-8D F4-44-0F-06-39-02-D9-02-92-02-...
0
votes
1answer
55 views

Writing a DLL in C# vs C++? [on hold]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
-1
votes
2answers
54 views

How to add a message box to a PE

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
-1
votes
0answers
28 views

Can any python coder help to port this OLLVM deobfuscator to ida v7 or below?

FYI ida plugin can be py script or be c++. This blog written very well on how the deobfuscation concept work. https://rpis.ec/blog/dissection-llvm-obfuscator-p1/ I don't know anything about c++ or ...
0
votes
2answers
92 views

Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" and "retn" ...
0
votes
1answer
53 views

How to make a program to read Unicode control characters

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. ...
0
votes
1answer
45 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
3
votes
1answer
71 views

concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
0
votes
0answers
61 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
29 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
0
votes
0answers
20 views

Looking for a coder who can RE IOS/Android Apps [closed]

As the title states, Im looking to hire someone who can reverse engineer ios/android apps.
1
vote
0answers
25 views
+100

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
46 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
0answers
14 views

CPU integrated PCI device functions

I'm trying to reverse an Xeon based hardware bios. During the early initialization in the UEFI SEC phase, I stepped into some CPU embedded PCI devices initialization. After few hours researches, I've ...
1
vote
1answer
45 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
0answers
39 views

Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
0answers
35 views

Can I bruteforce an .nc blowfish-448 encrypted (mcrypt2.2)?

Still a freshie at RE, but during my first expedition I came across some encrypted files. To be specific: _login.nc: mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit Any ...
0
votes
1answer
51 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
2answers
54 views

How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
1answer
66 views

Possible to get address of DRIVER OBJECT programmatically?

I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so: 0: kd> !drvobj HEVD 2 Driver object (ffffa70752fdbe30) is for: \Driver\HEVD ...
0
votes
0answers
7 views

App Store IPA - why it would suddenly need a “provisoningProfiles” entry in Info.plist?

An IPA I have acquired from Apple's App Store has a "provisioningProfiles" in its Info.plist. The "provisioningProfiles" entry was not in previous versions of the IPA file. Looking at another few ...
1
vote
1answer
21 views

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
0
votes
1answer
27 views

‘Purple Fox’ Fileless Malware - debug swf [on hold]

In reading TrendMicro's write-up(https://blog.trendmicro.com/trendlabs-security-intelligence/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell/), I ...
1
vote
1answer
38 views

Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
1
vote
2answers
77 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
0
votes
1answer
90 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
0
votes
0answers
37 views

Convert MIPS assembly code to C? please [closed]

Can someone help me convert the following MIPS code back to C? please .data 0x10010000 a: .word 30 .word 50 .word -10 .word 45 .word 100 .text .globl main main: lui $s0, 0x1001 addi $s1,...
2
votes
2answers
85 views

Malware Samples that defeats emulators by using uncommon API calls

I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
2
votes
0answers
46 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
0
votes
0answers
26 views

Reverse Engineering MS Access Encryption

I have an MDB with a column of what I assume to be encrypted data. The application I'm using shows me the unencrypted form of the data so I know what each encrypted string in the MDB column ...
0
votes
0answers
36 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
0
votes
1answer
68 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
0
votes
0answers
42 views

How do I decompile/modify a .dfu file?

I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the ...
1
vote
0answers
30 views

CRC Checksum? (Used in can open system)

We want to put our own messages on a can-open system. (So we can program our own functions to the system). We can put our message on the system, but when we do this, the safety relay stops the system. ...
1
vote
1answer
20 views

Regenerate PEM/DER keys from binary blobs

I have the binary blobs for the components of a private key including modulus, publicExponent, privateExponent, prime1, prime2, exponent1, exponent2 and coefficient, what is the easiest way to ...
1
vote
1answer
46 views

Can I use the Rich Header To Find out Compiler and Linker used?

I heard that I can use look at the RICH HEADER to find out what compiler was used. I looked at the Rich header and I cannot seem to make sense of this. Can I find the Compiler used for this program ...
0
votes
0answers
22 views

Can't find the missing part in this HEX blob encoding

I've tried everything but it feels impossible to find out what is missing: This encryption is generated by SQL Report Server 2012 and it holds an XML security schema that needs to be edited. It's ...
2
votes
1answer
107 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
1
vote
1answer
111 views

Encoding method of float

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and ...
0
votes
0answers
33 views

How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW

Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW i tried every combinanated value but without sucess.
0
votes
0answers
72 views

What kind of compression/encryption could this be?

I am dealing with a file that seems to use some kind of proprietary compression/encryption I can't figure out. I have a lot of sample files as well as different versions of the same file, so I have ...
0
votes
2answers
37 views

Error when changing push 0 to push function

Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure I've searched for a fix for a while to no avail help would ...
0
votes
0answers
28 views

Decrypt TCB, TAD file

I'm developing a Chinese game, it was released 10 years ago. I need decrypt two this files in the client game. My purpose is to redesign the game menu. This is code in exchange.tcb https://filebin....

15 30 50 per page