All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
18 views

How to figure out functionality when doing Static Code Analysis in ASM?

When doing Static code analysis on a disassembled app, I usually end up seeing many calls to registers (CALL EAX for example), which is constructed in runtime, which leaves me clueless on how to ...
0
votes
1answer
14 views

Define operations to do in specific breakpoints using GDB

In gdbinit I defined some breakpoints. How can I do that when specific breakpoint called I want to run x/s $r1 ?
2
votes
0answers
40 views

How to find “in degree” of chunks divided by ida pro?

I am working on IDA pro. I am splitting an executable in multiple chunks. My purpose is to calculate the possible ways any chunk can be traversed. There might be multiple ways that any particular ...
2
votes
2answers
68 views

Find Decryption algorithm of an encryption algorithm

I recently work on an algorithm that encrypt some data with 8 byte length. I worked hard and I successful to get this algorithm, but I need decryption of this algorithm. How I can invert it? I guess ...
0
votes
0answers
26 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
1
vote
1answer
29 views

far jump do not point to instruction?

My title is kind of ambiguous and not sure if it is true, Hence the question mark at the end. Basically, I was trying to trace windows printf in NASM to identify "what is the last call/function ...
0
votes
0answers
10 views

“rabin2 -E” and “afll” no output for an exe file

$ rabin2 -I test.exe arch x86 baddr 0x400000 binsz 3229424 bintype pe bits 32 canary false retguard false class PE32 cmp.csum 0x0031d950 ...
0
votes
0answers
27 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
3
votes
1answer
40 views

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
0
votes
1answer
18 views

How do I execute “File -> Add To Program…” in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
2
votes
2answers
282 views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
0
votes
0answers
14 views

objdump says “64-bit address is disabled”

I've run into an issue with the MinGW build of objdump on Windows. Consider this very simple input file: 48 bf 88 77 66 55 44 33 22 11 I want to disassemble this as Intel x86-64 raw machine code. I ...
0
votes
1answer
12 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
2
votes
0answers
21 views

QEMU with GDB: Stepping Instruction causes Windows VM BSOD

I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing. I have ...
-1
votes
0answers
45 views

How to decrypt this xml? [closed]

I have a blog theme with a lot of obfuscated code, does anyone know how to decode it? Here an example: var _0x6c0f = ["w7RWwpzCigArVcKSw4c=", "WnlY", "HMODPg==", "...
0
votes
1answer
64 views

What is the obfuscation method utilised in Playdead's 'LIMBO' video game?

The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
1
vote
0answers
38 views

Adding my own assembly code to x64 .exe

I have assembly code like this: 142cccc0c c7 43 18 MOV dword ptr [RBX + 0x18],0x4000 00 40 00 00 142cccc13 e8 a8 79 CALL FUN_141a845c0 ...
0
votes
1answer
13 views

error shmat function when simulating MIPS file in Qemu

I want to run (simulating) MIPS file with Qemu: $file httpd httpd: ELF 32-bit MSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, no section header ...
0
votes
1answer
37 views

How to export arm64 and x86-64 binary into one?

I am trying to export a binary that contains both AARCH64-64 and x86-64 in Ghidra. I only opened the x86-64 counterpart to perform some changes. When I tried to export it, it exported a .bin file that ...
0
votes
1answer
41 views

With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?

I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra. I'...
0
votes
1answer
36 views

Reverse engineering mode X VGA function(s)

I'm trying to reverse engineer an old DOS game. At the moment I'm stuck at a function that implements some functionality of VGA running in mode X. My issue is that any of the available sample codes on ...
0
votes
1answer
45 views

how to calculate a byte value

We are reversing the method of creating a byte array packet. These values are obtained by serialport monitor from mediatek metamode usb port.The values of both packets are changed by changing the imei....
3
votes
1answer
88 views

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
-1
votes
0answers
34 views

Deobfuscate JS code

I have this js obfuscated code: var _0xcc92=['C3bSAxq=','z2v0rwXLBwvUDa==','DgHLvgLTzq==','Aw1N','CMv0DxjUic8Iia==','kYb0AgLZicSGiG==','AM5HCxC=','xIbDFq==','Aw50','zguGDMvUy2LTAq==','C3vIC3rYAw5N','...
1
vote
0answers
48 views

Disassembler with pixel/bitmap view

I am looking for an ARM disassembler that runs on Linux that has a graphic "pixel" or "bitmap" view like the one shown in the pictures below: I am reverse engineering some old ...
0
votes
0answers
37 views

.dll file pull source from compiled study?

Forgive me I’m new, and not a programmer but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
0
votes
1answer
32 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
0
votes
0answers
13 views

Ghidra SDK Register TypeFlags are not populated

I am using the Ghidra P-Code in a Ghidra script and I am looking for an architecture-independent way to decide if a register used in a P-Code Op is the Stack or the Base Pointer (basically making the ...
0
votes
1answer
37 views

Exporting C++ types from database to another

I have a pe dll binary with it's pdb file. I'd want to use this file's types in another database. I tried to export the types using "Create C header file" and "Dump typeinfo to IDC file&...
4
votes
1answer
104 views

WinDBG Hung on Shellcode Execution

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
0
votes
1answer
21 views

CC3200 Firmware - gaining information about - Registers / Memory (Ghidra) - SVD / CMSIS

I am currently reversing a firmware for the TI CC3200 (ARM Cortex M4) via ghidra. For other ARM chips I have learned that I may use a SVD-Loader to load all information about the registers and memory ...
-1
votes
0answers
21 views

Need help with .str files in The Godfather II [closed]

I've been looking for a way to edit npc names in The Godfather II, located in dac49de4.str. This is the Zenhax topic about everything I found out so far, including sample .rar attachments: https://...
0
votes
0answers
28 views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
0
votes
2answers
28 views

Lifting exported function instructions in PE files

I am trying to automate analysis of instructions within exported functions for a .DLL and need to be able to lift the first few instructions for the entry point of each exported function statically ...
0
votes
0answers
15 views

Is there a way to replace the load method in an objective c class with a stub method in a mach-o binary?

I am learning about parsing and editing mach-o files and I am stuck on particular issue. I am able to read the segments and sections within a binary which is a test iOS app written in Objective-C. I ...
2
votes
1answer
109 views

reverse a RF rolling code

I have the following codes from a rolling code RF garage fob I want to duplicate. There is a duplicator remote that able to get one code and learn the sequrence from it: https://www.ebay.com/itm/V2-...
0
votes
0answers
8 views

Is it possible to pass hexadecimal chars to edb-debugger?

I'm trying to find bad chars using edb-debugger. When I open the binary through file --> Open I add the string which causes the program to crash as program arguments value. Anyway I don't know how ...
1
vote
1answer
49 views

Detecting and reading embedded filesystems on desktop Linux

I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device. This is the device information: https://openwrt.org/toh/bt/homehub_v5a The NAND chip is 128MiB ...
0
votes
0answers
50 views

Reversing an ELF file

I am a beginner in reverse-engineering and am trying to understand what a custom ELF file is doing with a particular file (File1) it is reading from the system. File1 is in a custom format. Using ...
2
votes
1answer
36 views

Reverse Engineering API's of Browser games

I like the idea of Reverse Engineering API's and creating bots/scripts for Browser games. However, I am a beginner in the Computer Science field. I recently started my Computer Science Degree and ...
0
votes
2answers
51 views

Correct target of absolute jmp in IDA

In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution: F000:FEFF : mmap'ed location of function ...
0
votes
0answers
36 views

How to print disassembly of predecessor and successor block of blocks containing 'RET' in Ghidra?

I am using ghidra to do reverse engineering of a binary. I am using the following script to get the disassembly of the blocks containing instruction 'RET' across all functions: from ghidra.program....
0
votes
0answers
62 views

Adding an export entry into dll file

There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
0
votes
0answers
19 views

How do I get the disassembly of basic blocks for all functions containing a special instruction like 'RET" using python in Ghidra? [duplicate]

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...
3
votes
2answers
56 views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
0
votes
0answers
35 views

How to download restricted backup config file on HG8245H router

I have HG8245H router and I want to download backup config file to which I dont have access as regular user in my case its caled root. So I downloaded firmware of my router and extracted it using ...
0
votes
2answers
62 views

C++ hide string parameter for string viewer

bool isLaunched = CreateProcessW( L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler. 0x0, 0x0, 0x0, TRUE, 0, 0x0, ...
4
votes
1answer
101 views

Is it possible to sniff an ATA Drive password?

Context: I have a proprietary Tandberg Data RDX QuickStor Internal USB3 drive bay for PC (item number 8666-RDX) and some storage cartridges for it. Esentially, these are just regular TOSHIBA MK3276GSX ...
0
votes
1answer
42 views

usercalls in old Win32 game

I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C. I noticed that there are almost no usercalls (i.e. calls that use registers ...
0
votes
1answer
32 views

How devices such as smart Wi-Fi power plugs and Wi-Fi ip cameras connect to a private Wi-Fi network?

How devices such as smart Wi-Fi power plugs and Wi-Fi ip cameras connect to a private Wi-Fi network ? The usual steps are the following : You buy the device You install the maker application on ...

15 30 50 per page
1
2 3 4 5
154