All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

Not the usual LUA decrypt

Luae2 files are special encrypted files from the Ankulua app. the process of encryption in briefly described here: http://ankulua.boards.net/thread/14/compile-encrypt-scripts Is it possible to decrypt ...
0
votes
0answers
14 views

De-obfuscate JS code

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
0
votes
0answers
40 views

Help to understand what's inside base64 string

While performing a file upload, a template parameter is sent together with file. Service acts differently when different parameters are passed. I need help to figure out what this parameter contains. ...
-1
votes
0answers
33 views

What does this code do and how to convert it to 64bits?

This is the begining of an exploit which encrypts. These block line, how do I convert it to 64 bits ? it doesnt run __encript_start__: mov rbx, 0x30 ;'clear ebx push ...
0
votes
0answers
22 views

Decompile/Disassemble an OCX file

We have an OCX file running in IE as ActiveX object. The control is sending some stuff. I need to decompile/disassemble the OCX file. How can I?
0
votes
0answers
24 views

Questions regarding PLT/GOT and statically linking

Hey so I was looking at the assembly code of a heap-overflow challenge (heap3 in protostar) in which use a vulnerability of an old version of dlmalloc to execute the exploit. Below is the assembler ...
1
vote
1answer
30 views

Adding my own logging function in Smali

I am trying to logcat the parameters of a function in smali with my own function. I made a new Android studio project and wrote the function then used APKtool to retrieve the Smali file. This is my ...
1
vote
0answers
21 views

Reverse old win32 app to find encryption vulnerability

I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
-2
votes
0answers
13 views

How can I edit loaded c++ dll in c# environment with dnspy i must edit ram on runtime?

How can I edit loaded c++ dll in c# environment with dnspy i must edit ram on runtime
0
votes
0answers
20 views

How to change Virtual Addres of PE without damage him

Im trying to sub all the VA section by 400000, but when i'm doing it windows says he can't run the file anymore, how can i do it without damage it?
0
votes
2answers
61 views

I'm looking for a list of C vulnerabilities like OWASP Top 10

I'm looking for a list of all vulnerabilities that can be present in C so I can practice them all. I found this: Category:C/C++, but it's not of much use.
0
votes
0answers
34 views

How to detect the language of an assembly code? How radare does it?

I've opened an executable in Radare2 (on Cutter) and it says that it was written in C language. Is it just a guess or there is a good way to find in which language a binary was written?
0
votes
0answers
45 views

Tools for statistical analysis of binary streams

I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
2
votes
2answers
178 views

Dealing with heavily obfuscated Java, possibly on bytecode level

I've got a jarfile from a friend, he told me to put it thru an decompiler. So I did, but: JD-GUI basically spit out just the imports and didn't show any class data CFR dumped out stack trace on ...
0
votes
0answers
33 views

How can i reverse engineer this obfuscated code?

The code in question is here: https://pastebin.com/gtE5XZBN I tried beatufierjs jsnicer and all these online tools but Ijust cant make it readable. I have this https://pastebin.com/iSuURVp6 and the ...
3
votes
3answers
221 views

ARMv8 (AArch64, ARM64) opcodes list

I'm sorry for such as questions where answer would seem to be easily searched in google... Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
0
votes
0answers
17 views

PS2 Raw Texture

so, i found some raw textures in the game that i'm modding, but i cannot identify (and not even open) them, someone can help me? I left a sample file below, it can have like 3 textures in this file, ...
0
votes
0answers
26 views

Make operational an old FTDI USB hardware on new OS

I have an old hardware that is controlled by a software for which I don't have the source code and the company that made it has closed their business. The original software is really slow (it use ...
1
vote
1answer
28 views

Is there a standard documentation format for file formats?

I'm analysing an undocumented file format. Is there a standard documentation format for file formats I can write up? Something of this level of complexity and detail? What I have in my mind is, !...
0
votes
1answer
20 views

VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?

I'm trying to decompile an old binary (about 20 year old). The program uses exceptions. I found some FuncInfo but they do not contain any pTryBlockMap and nTryBlocks is 0. I've tried many options ...
0
votes
0answers
35 views

How to capture specific data packets sent in an online game?

I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
1
vote
0answers
26 views

Reproducing video format

I received a promotional video screen with a USB interface. It comes with a couple example videos, one of which is here: https://drive.google.com/file/d/1B-wSURAgK-ePrfpKFM5nYbNhQ5mD-Ii2/view?usp=...
0
votes
1answer
30 views

I don't understand the use of mov eax,ds:0x404004 and the NOP slide in this code I made

Hi guys, I'm just practising the difference between global and local variables and how they are represented in x86 assembly. I just don't understand the use of the ds segment register and the NOP ...
2
votes
0answers
34 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
1
vote
1answer
36 views

Dump array of char* ASCII text to file? (ollydbg or x32dbg)

This question is similar to: List arrays (de-reference pointers) in Ollydbg I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
-1
votes
0answers
25 views

file download from github executable file [closed]

recently I search and find an software source on GitHub, and want to run it. But the problem is there is no .exe file and I cannot find any way out to run it, can any one help please. this is a basic ...
1
vote
0answers
25 views

Using Frida for early and late instrumentation

I am trying to hook functions with Frida where one .so file (x.so) is loaded early and another .so file (z.so) is loaded slightly later, after some processing is done by the application. This is what ...
1
vote
1answer
97 views

Stack-pointer analysis failed

I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
0
votes
0answers
21 views

tutorial of run-time hacking with Dnspy

Is anybody have good resource or tutorial of run-time hacking or memory hacking with .NET Applications with dnspy.
1
vote
0answers
54 views

Strange function in Disassembly (IDA)

I was reversing one executable in IDA and found out the function with this structure: .text:0058A6E0 sub_58A6E0 proc near .text:0058A6E0 .text:0058A6E0 var_4 = dword ptr ...
3
votes
0answers
45 views

The buffer is too short to insert addresses when exploiting buffer overflow

Newbie here. Sorry for what you about to read . I'm currently working on exploiting a binary on Ubuntu 18.04. Here is some information about the binary: Its checksec information using pwntools: ...
0
votes
1answer
26 views

Attach one debugger to a DotNet application, and a second one to a loaded DLL

I'm trying to reverse an application that is using a DLL that i'm interested in. I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
1
vote
0answers
24 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
1
vote
1answer
28 views

Load Library Android

I Work as cybersecurity consultant and now i'am in mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar ... the problem that after reverse them i found some native ...
-1
votes
0answers
28 views

How can i deobfuscate this javascript file? [duplicate]

I want to learn how a ui is connected to a smart contract but unfortunatly the JS file is obfuscated and i cant read it. Is there a way to deobfuscate this file? The code can be found ehre https://...
1
vote
0answers
23 views

Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly

Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
0
votes
0answers
35 views

WPA2-PSK default password generation algorithm in router - now what?

I'm interesting in reverse-engineering default WPA2-PSK password algorithm on specifics router. I have the firmware I find from a github (pretty lucky) and identified an ELF 32-bit MSB executable, ...
0
votes
1answer
39 views

Detecting libc function with IDA

I have binary than running on Arm , static and striped. I don't know which compiler compiled this binary. How can I identify function like fread sleep printf ioctl
1
vote
0answers
30 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
0
votes
0answers
12 views

Samsung A520F usb type-c uart debug mode

I'm trying to create UART cable for A520F phone with USB type-c. Seems, there is no UART debug modes S8+ either. On Samsung phones with micro USB one may access UART JIG mode with 619K resistor, ...
0
votes
2answers
60 views

Ghidra analyzing hardcoded indirect jumps

I'm currently analyzing a function that has a lot of indirect jumps looking like the following. LEA R10,[0x142000000] (some instructions that dont change R10) JMP R10 The Ghidra decompiler just ...
1
vote
1answer
153 views

Ghidra what's the meaning of _0_4_

What does _0_4_ mean in ghidra?
0
votes
0answers
25 views

Best way to find data in running executable (ollydbg/x32dbg/CheatEngine) that I found in Ghidra?

I have located a function that I would like to reverse engineer in a game. The function pulls character strings from a large array. I am trying to find this array's contents. The line in Ghidra is: ...
2
votes
2answers
118 views

Why Ghidra doesn't load the disassembly correctly while radare2 does?

I'm trying to get the disassembly of a very small binary file available here. This file is cropped from part of another executable binary. When I open it with r2 it automatically recognizes the ...
0
votes
1answer
19 views

Where can I find the QRC and QML files used for a QT gui application when reverse engineering?

I'm currently working on a crackme exercise for a GUI application using QT as practice. The application uses a server login authentication. I can see from the logs that the application output that ...
1
vote
1answer
53 views

Python self decryption script, as mean of obfuscation

I have a software with an embedded python interpreter. The software can open upon startup a given .py script and execute it. Let's assume that in my python environment I can't open other files, and I ...
0
votes
0answers
25 views

unpacking Armadillo-packed exe on Windows 10

I was trying to unpack the Armadillo-protected target from this webpage Armadillo 4.30a with Debug Blocker - manually unpacking on Windows 10. However, I got another child process spawning again after ...
-1
votes
1answer
46 views

How do I view the call stack of an executable?

Basically I'm trying to edit memory (replace branch with a nop so the executable can't branch to auth function). I've done successful reverse engineering on gaming consoles, but I don't really know ...
0
votes
1answer
23 views

Manufacturer interface on OCZ Agility 4 SSD

Inside the housing of an OCZ Agility 4 SSD I found several additional connectors on the opposite site of the SATA connectors. What are they good for and how to connect them properly? Zoomed:
0
votes
0answers
43 views

Use WinDbg to bypass file open checks

I'm using an evaluation version of a program that opens custom filetypes (a combination of text/midi like a karaoke helper). The evaluation version will only open certain files bundled with it. When I ...

15 30 50 per page