All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

Which interrupt was called

cseg01:00046E80 sub_46E80 proc near ; CODE XREF: sub_46ED8+81p cseg01:00046E80 ; sub_47164+6Dp cseg01:00046E80 000 ...
black4's user avatar
  • 331
0 votes
2 answers
56 views

IDAPython: error executing init.py

When I open Ida Pro 8.3 I see an error message IDAPython: error executing init.py: No module named imp Refer to the message window to see the full error log. i have python 3.12.3 and i ran as ...
alex 's user avatar
0 votes
0 answers
34 views

Static offsets Vs. Loaded Offests

I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of ...
Shockmeister's user avatar
1 vote
1 answer
46 views

Any special meaning for this weird ObjectName value in Kernelbase.dll in Windows 10/11 passed to NtOpenKey

This function in kernelbase.dll : _ReadSettingsCache@8 proc near DestinationString= _UNICODE_STRING ptr -0F0h ObjectAttributes= _OBJECT_ATTRIBUTES ptr -0E8h KeyHandle= dword ptr -0D0h Handle= dword ...
chentiangemalc's user avatar
0 votes
1 answer
53 views

What is the meaning of *((_DWORD *)

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below. *((_DWORD *)a1 + 150) = 3; *(_DWORD *)(a1 + 604) = 1; I can't understand what is happening for this two ...
yepochangfeng's user avatar
0 votes
0 answers
21 views

What Kind of BLE Handshake is This?

I have a peripheral to which I am trying to connect over BLE. I do not have access to the internals of the peripheral, though I do know it is using a TI CC2540 chip for its BLE implementation (not ...
fbrereto's user avatar
  • 101
0 votes
0 answers
20 views

How to detect obfuscator and deobfuscate .net framework 4.5.2 app?

I need to deobfuscate exe built on .net framework 4.5.2. de4dot not worked for me, it left all absolutely as it was. All methods in controllers / models / views are following: try { invoke = ((...
Alex's user avatar
  • 1
0 votes
0 answers
29 views

Parsing a Microsoft PDB file to extract symbols from it?

I have a Microsoft PDB file and I want to extract symbols along with their addresses from it. Are there any libraries or APIs available that I can use to accomplish this task?
OUSSAMA ELFAHSI's user avatar
-1 votes
0 answers
31 views

Flags setup in code

There is C++ structure: ... //structrue flags uint16_t loaded : 1; uint16_t intelligent : 1; uint16_t save_position : 1; uint16_t save_hitpoints : 1; ...
black4's user avatar
  • 331
0 votes
0 answers
23 views

sp analysis failed - red marks in code

This is start of func: https://imgur.com/n0jbT1E This is end of func: https://imgur.com/GiQQAYP What means red mark "sp analysis failed"? I looked in C++ source code of this disassembled ...
black4's user avatar
  • 331
0 votes
1 answer
51 views

Shift operation and subtract in code

There is C++ code: int16_t ** g_Meshes; int32_t m_MeshPtrCount; int16_t * g_MeshBase; uint32_t *mesh_indices; for (int i = 0; i < m_MeshPtrCount; i++) { g_Meshes[i] = &g_MeshBase[...
black4's user avatar
  • 331
0 votes
0 answers
33 views

Binwalk firmware analysis

When I run binwalk on a .rom using -Me it shows md5cheksum and a 411 signature under dec hex and description are blank why is it blank I’ve used binwalk on bios chip and got data the binary in ...
Strix Strong's user avatar
0 votes
0 answers
79 views

How did a cheap amazon RF key managed to clone original key with rolling codes?

I have a garage and I have the original key which is 433MHz and the specifications say it is a rolling code. Here is a table of the specifications: Range in open field (m): 100 Frequency: 433.92 MHz ...
Skywalker's user avatar
0 votes
1 answer
38 views

Сode in IDA breaks off

My code breaks off, and then the code color is red, like in the screenshot, a fragment of a function. What can you do here? How to restore the code? Is there a keyboard shortcut for this?
black4's user avatar
  • 331
0 votes
0 answers
24 views

Cloning full content of a pic24fj128gc010 chip (Flash + RAM)

I have some hardware that uses a PIC24fj128gc010 microcontroller. This microcontroller lives on a pluggable board that is plugged in on a main board. This detachable board has the microcontroller with ...
user45316's user avatar
0 votes
1 answer
25 views

Is there any way to read the data in STC11F02E?

I need to read the data from the STC11F02E microcontroller. Is there a way to do this?
akifh's user avatar
  • 1
1 vote
1 answer
67 views

Reverse engineering AES128 Key Derrivation from MAC Address

Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped. From this decompilation I ...
Seb's user avatar
  • 11
0 votes
0 answers
33 views

NxP3143 Uboot encrypted image and roots help

I have an encrypted firmware based on 2 files uImage (kernel) and rootfs (filesystem) and I have got the encryption keys from someone who cracked it. However I don’t know where to start so I can mount ...
Armandooooo's user avatar
0 votes
1 answer
24 views

struggle with Decrypt Byte Array with a key of unity game using il2cpp

So i'm trying to reverse an unity game using il2cpp to get the assets of it. After some reverse stuff i found that the asset's (especially here the png image) byte array get encrypted with a key and i ...
NoName's user avatar
  • 23
0 votes
0 answers
30 views

Change Mac address

I have read the NAND memory MT29F2G08ABAEAWP contents via the RT809F programmer from IP Camera, when I have written the program (.bin) to the new NAND memory the Mac address and serial number of ...
Motaz's user avatar
  • 1
0 votes
0 answers
37 views

Decoding API headers of unknown encoding?

I'm using mitmproxy to monitor facebook messenger app traffic on my android. Firstly I had to enable whitehat settings to use it. After that I found some request headers has some unknown value in body....
Wojciech Wolski's user avatar
0 votes
1 answer
44 views

Protection of the source code of an ML model

I wanted to know how it would be possible to run an ML model in an offline setting securely? What I mean is, if the Python files and libraries are bundled as an .exe file (using libraries like py2exe ...
woka's user avatar
  • 1
0 votes
0 answers
20 views

x64dbg string references can not find

i am trying to register a software with x64dbg, but my experience is not enaugh for do this. Anyone can help me ? i am ready to pay price. Problem is can not find string references in x64dbg.i already ...
KADİR SÖNMEZ's user avatar
0 votes
1 answer
38 views

Inject ELF with an entierly self-contained code section that can statically call standard library functions

What I want to do What I want to do is inject an existing ELF binary with additional code that runs before the original .text section and then transfers control back to it. What I can already do Now, ...
PaperTsar's user avatar
  • 101
0 votes
1 answer
52 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
Grandmaster's user avatar
0 votes
0 answers
22 views

How to use reverse engineering to replicate websocket request

how I can use reverse engineering technique to get known how websocket is working on website. What data my browser is sending to websocket so it reply with data. How I can replicate that process as ...
innocent98's user avatar
0 votes
1 answer
90 views

Function calls to unmapped memory

I'm examining an iOS framework (extracted from a dyld shared cache) and there are a lot of branch-link instructions to functions which don't exist. For example, bl #-0x50e7e04 Performing the ...
August Vrubel's user avatar
0 votes
1 answer
130 views

Reverse engineering RS-232 motor controller

I have a motor controller and I'd like to communicate with it using Arduino. I can communicate with the controller using a software and I used it to sniff some data from RS-232 commnunication and ...
Jdx's user avatar
  • 1
0 votes
0 answers
53 views

Unknown file analysis

I have a file, which supposedly contains an output of CRC32 hash. Problem is, file has no extension, type file (cat analogue) returns mangled gibberish, i.e. ёя╫жW▲{═Sb╨y¶|ИМ▐ВQ╙l9k╖▀у║?╩↓b☼┐R. TrID ...
flying_meatball's user avatar
0 votes
0 answers
49 views

How to use reverse engineering to get paginated threads id on facebook messenger

I'm trying to replicate websocket request in python. I want to get paginated results of threads id that appears after scrolling down the friends chats section. Seems messenger uses websocket for it. ...
Wippar's user avatar
  • 1
0 votes
0 answers
45 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
HCSF's user avatar
  • 143
1 vote
0 answers
72 views

How to decrypt Zyxel's 'Backup_Restore' config file?

I have a VMG3625-T50B running an ISP-dedicated firmware version (V550ABTL0b2r). I managed to get the supervisor password yet I can't enable open an SSH port because my SP disabled that option. I've ...
Khalid's user avatar
  • 11
0 votes
0 answers
34 views

Finding JTAG/UART Connections on smart doorbell

Trying to dump firmware of this device. I can't find the UART/JTAG connections. I've searched over it for awhile now; I feel like I must just be missing something.
Eric's user avatar
  • 1
0 votes
0 answers
21 views

Can Ghidra load a directory and translate the binary files within it into assembly code?

Can Ghidra load a directory and automatically convert the binary files within it into assembly code? If not, is there a pre-defined script available, or do I need to write one myself? If Ghidra isn't ...
0xh3xa's user avatar
  • 111
1 vote
1 answer
54 views

Tracing all functions in executable conditionally, to find function of interest

I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/...
tcpie's user avatar
  • 113
0 votes
1 answer
46 views

Location of CoreMedia framework

I've been attempting to dive into mediaserverd which runs on iOS. Pulling the binary and running otool -L on it reveals, unsurprisingly, that it's linked against /System/Library/Frameworks/CoreMedia....
August Vrubel's user avatar
0 votes
0 answers
50 views

Hex-View in IDA [TMS320C3x]

For the target processor TMS320C3x, IDA does not display all data in HEX-VIEW as ASCII, only every 4th byte. The minimum addressable data block for this target processor is a 32-bit word. It seems ...
strannyi's user avatar
0 votes
1 answer
26 views

Get the jar from exe4j executable

I've read this question and it is not a duplicate to mine. I have a .exe file which has different contents inside when opened with 7zip. However let's say I know that it uses EXE4J, how can I ...
Grinding For Reputation's user avatar
0 votes
0 answers
25 views

How do I force IDA to reload PE Header and/or segments?

Introduction I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called "....
Kyuuri's user avatar
  • 1
0 votes
1 answer
55 views

What's this connector type?

Does anybody know this kind of connector? It is used as a diagnostic connector on diesel engines. Inner diameter 15mm, outer 19mm.
Alex4102's user avatar
0 votes
0 answers
45 views

How to use reverse engineering to learn how facebook send messages?

I would like to know how I can use reverse engineering technique to learn how Facebook/messenger send messages? I were analyzing my developer tools network tab, but couldn't find anything. Fiddler ...
innocent98's user avatar
0 votes
0 answers
26 views

S30+ Game Development

How can I get started developing games for the S30+ operating system on Windows or Linux? I have a new nokia 150, which seems to run the correct operating system, although I'm not sure if this phone ...
Kynemix's user avatar
1 vote
0 answers
46 views

How to hook or call "non-native/non-exported functions"?

I wrote this simple application in C++ to learn about reverse engineering: #include <iostream> #include <windows.h> void PrintMessage(const char *message) { std::cout << message ...
Unknown X's user avatar
1 vote
1 answer
74 views

Ghidra not displaying member function call

On lines 67, 70 and 77 ghidra makes a call to what I assume is a member function, but it does not show me which member function. Why is that? Example from line 70: (**(code **)(*(longlong *)metaStream ...
Proton's user avatar
  • 13
1 vote
0 answers
39 views

Unknown string encoding

I'm new to reverse, my question may be stupid. I am trying to reverse a function in the application that reads a string at the address and concatenate it to another char[250] v30; char[20] v31; ... ...
SHVED's user avatar
  • 11
0 votes
0 answers
23 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
Unknown X's user avatar
0 votes
1 answer
35 views

How can I reverse engineer a self-contained dotnet executable on MacOS?

For a challenge at OWASP WrongSecrets I have build a self-contained binary to be reverse engineered (see https://github.com/OWASP/wrongsecrets-binaries/actions/runs/8244751569), but, I have not been ...
Jeroen's user avatar
  • 101
0 votes
0 answers
80 views

Decompiling very heavily obfuscated JAR

I have a very very obfuscated jar. I tried using Krakatau and CFR and it won't decompile. With CFR some of the important classes / methods fail to decompile and with krak it says it is writing data to ...
tritheo's user avatar
0 votes
0 answers
24 views

How to draw invisible entities (glow) with DX11?

I'm trying to understand how GLOW hacks work. In some games like CSGO you can just overwrite the memory address to 1 and glow chams are enabled. So you can see people through the walls like in this ...
kuhi's user avatar
  • 161
0 votes
0 answers
23 views

can the source code for video slot machine be pulled using dev tools?

i want to obtain pre built source code and logic for video slots , and then rename my own sprites / skins, ect and essentially create a reskin of said game . can anyone tell me how this can be ...
William Wheeler's user avatar

15 30 50 per page
1
2 3 4 5
195