All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
6 views

IDA Pro - reverse Program while it's

So, I have a program where I can load scripts into the program when running it. Is there any way to see what is going there with the help of IDA? Because normally IDA debugs the whole program and goes ...
1
vote
1answer
16 views

Remote debugging android native lib(.so) No connection could be made because the target machine actively refused it. when connecting to

I have a running IDA debug-server on my virtual android device(check attachments). The problem is: when I try hit Attach procces it gives me an error(check title). Here is some kinda params that I'm ...
0
votes
0answers
12 views

IDA pro 7.5.2 fails to find python.dll even tho it is in the correct folder?

Anyone ever have this problem? how can it be fixed? Installed ida pro 7.5.2 the other day in the python folder it has two files named 2 and 3 clearly for python 2 or 3 but its not even finding the ...
0
votes
0answers
16 views

ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10

When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
1
vote
0answers
35 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
1
vote
0answers
22 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
0
votes
0answers
25 views

How to restore section headers in UPX unpack?

How would I fully unpack UPX? It seems to me that unpacking it by dumping and fixing the IAT does not actually fix the section headers.
-1
votes
1answer
47 views

Instrument memory accesses of python scripts

My research requires processing memory traces of applications. For C/C++ programs, this is easy using Intel's PIN library. However, as suggested here https://stackoverflow.com/questions/51835532/use-...
0
votes
0answers
32 views

Unrecognized function

There is function: push 65h push edi call sub_5D8750 In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
2
votes
0answers
19 views

Why PTRACE_POKEDATA returns I/O error?

I learning usage of ptrace. I tried following simple example but raises a I/O Error. I would like to overwrite "Hello, world" (printing string) from other process. A target program prints &...
1
vote
0answers
21 views

How to repack the monobundleapp

I recently had to make a version of a survivalcraft 2 mod that allowed circuits to run faster I found this script by stack overflow to unpack a mono bundle app I already modified the .dll, but I need ...
-1
votes
0answers
28 views

Windows PE File Where is the table located SEH?

I compile the file using MSVC. I am aware of the existence of the exception directory, but it is empty in my file. Although the code contains four SEH handlers. I wonder where, in this case, the ...
1
vote
1answer
38 views

trying to identify this SOP14 chip

I'm trying to find out what is this chip I have two devices that have this chip in them one of them stopped working and the problem was from this chip(I know that because when I removed that same chip ...
1
vote
1answer
31 views

Finding API in ROM dump (DOS debug)

Have dumped the ROM from a HP 200LX using these instructions: debug #Enters the debug mode r bx #Reads the bx register and prompts you to enter a new value 30 #The new value for bx r cx #Reads the cx ...
2
votes
0answers
29 views

Twitter scraping using Python

I've been working on a project to reverse-enginner twitter's app to scrape public posts from Twitter using an unofficial API, with Python. (I want to create an "alternative" app, which is ...
1
vote
1answer
31 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
1
vote
1answer
18 views

Comparing the static address of the vtable of a class, to the pointer to it held by the object

I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
2
votes
1answer
46 views

Unable to attach into mysterious PID

I have a suspicious process. I found it by ProcessHacker's network tab. ProcessHacker display the process as Unknown. The process listening into a constant port number that's also not found by ...
1
vote
0answers
35 views

Trying to call the Exit Shellcode in a c program

#include<stdio.h> #include<stdint.h> char shellcode[] = "\xb8\x3c\x00\x00\x00" "\xbf\x14\x00\x00\x00" "\x0f\x05"; int ...
2
votes
1answer
59 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
0answers
34 views

On reverse engineering an udp protocol to control a drone

My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it. First I connected the app to the drone, flew and used aircrack-ng to get the ...
2
votes
1answer
40 views

Reverse engineering 16-bit checksum algorithm for 433Mhz RF remote control

I'm stuck trying to figure out how to calculate the two last checksum bytes (16-bits) of these packets. The remaining data fields are understood, and it is just the two last bytes that I am current ...
2
votes
0answers
22 views

How do I calculate where to put the canary value in a program

I am trying to exploit a program with a buffer overflow for a class. The program has a canary enabled and when you smash the stack it exits. When running the program in gdb you can set a breakpoint ...
2
votes
1answer
51 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
2
votes
2answers
48 views

Changing value of parameter with gdb

I have a file named exploit.c inside which: #include <stdbool.h> #include <stdio.h> const char y1 = 'a'; const char y2 = 'b'; const char y3 = 'x'; const char y4 = 'y'; const char y5 = 'i';...
1
vote
1answer
21 views

analyze how data is read in android usb device

I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
1
vote
0answers
47 views

reversing a grpc call

im reversing a android app and i managed to intercept a grpc request and decode it using protoc but i cant seem to make sense of any of the data, i know its compressed using gzip because of the ...
-2
votes
0answers
61 views

IDA Pro unable to disassemble the following function

I'm new to this forum recently I have been trying to learn how to reverse IPA. While decompiling an app, IDA would return this but would not be able to return meaningful data about this section. ...
1
vote
0answers
29 views

Reverse engineering chinese headunit eeprom

I've got a cheap chinese headunit in my car which i love, but i can't stand the boot logo. Main Components: AllWinner F1C200s processor EN25Q64-104HIP eeprom I bought a programmer and dumped the ...
0
votes
0answers
21 views

Can't figure out the type of hash

I know that SHA-1 is a cryptographic hash and it takes 20-byte and this is an example of it 64C1F7689B32D9805C5A1D5DABF3EAD31446B80C The problem is with iirc, I'm working in a small project, and ...
-1
votes
1answer
33 views

Finding some specific adresses in an exe file

I'm an absolutely beginner in the reverse engineering field. I've an exe program and I should find : address of main function/address of function that validate user input/address of hardcoded password....
0
votes
0answers
25 views

Deobfuscating JS Code?

I am trying to deobfuscate a highly obfuscated JS file for use to be passed in along with an HTTP POST request from my C# application. I don't know much about JS. The file I am trying to deobfuscate ...
0
votes
0answers
22 views

Java Software cleanroom implementation

I'm trying to make a cleanrooom implementation of a java written lib. What resources can I use for it. Only the official software docs? Or can I use what I get after i throw the lib into a java ide (...
3
votes
1answer
41 views

Confused about the use of the shl instruction in this disassembly

I created a code construct in C to see how it looks in x86. I'm confused about the use of the shl instructions. I'm confused about what is happening in between the lines <+39> and <+51> I ...
0
votes
1answer
69 views

How do I find missing/undefined vtable functions in IDA64?

I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them? (*(BaseClient->int640 + 304))(...
0
votes
0answers
33 views

Ghidra headless + bindiff (binexport)

I am working on patch diffing using ghidra + bindiff (specifically, binexport), and am looking for advice on using bindiff with Ghidra headless. ida_haru does essentially everything that I need, but ...
1
vote
1answer
41 views

How to extract the kernel assembly code from a zImage?

here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
-2
votes
0answers
24 views

MS-DOS 16 bit Autonet.exe [closed]

I have downloaded Autonet neural network program from https://archive.org/details/msdos_AUTONET_shareware. This is a a demo program with limitations and there is no full version available. Can ...
3
votes
1answer
50 views

Force IDA to reanalyze a function recursively?

How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
1
vote
0answers
23 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
0
votes
0answers
31 views

What is the difference between a file on disk and a file on memory?

Currently, I am learning about the differences between static and dynamic analysis. I have come across this incredible question that has been bugging me: What happens to the file (in memory) when you ...
0
votes
0answers
16 views

Write the compiled MIPS code for the following C statements: [closed]

a. f = g – (h +10); b. f = g* h + i; (Hint: make sure you also use the proper instruction to place the desired result into a general-purpose register before you perform the add ...
0
votes
1answer
42 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0
votes
0answers
18 views

How would you approach solving the algorithm if you have samples of input to output?

There is a page that lists integers. All these integer inputs have corresponding alphanumeric outputs that form a url where I have some desired information. The algorithm is a black box to me. I can ...
0
votes
0answers
19 views

Decompiler view of IDA pro when debugging windows kernel shows the content of every variable as “?”?

When Im debugging windows kernel using IDA pro and i am using the decompiler, it does not show the content of ANY variable, when i hover the mouse to any variable, it just says "?" ?? how to ...
1
vote
0answers
15 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
1
vote
0answers
19 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
0
votes
0answers
21 views

Unknown but suspiciously aligned test pads

I am currently working on an Epson printer main board that exposes 5 aligned test pads (see image). The board also exposes a row of 4 pins that turned out to be UART. Now I am wondering if these could ...
0
votes
2answers
45 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
0
votes
0answers
35 views

Ghidra unable to find the JDK

Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...

15 30 50 per page
1
2 3 4 5
160