All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

Checksum verification of an apk does not the same as my java program

I'm from the sysadmin side of the IT and have not much experience in programing. I have an app that lets me screen share Android apps on my car's display. Sadly there is a whitelist baked into the app,...
2
votes
1answer
48 views

32 bit vs 64 bit IDA Pro

I am confused on the differences between using 64 bit and 32 bit IDA versions on a 32 bit application. If I use 64 bit IDA on the 32 bit application, will it make use of 64 bit or 32 bit architecture?
0
votes
0answers
15 views

How to remove abigle from .Net application?

How can I remove abigle from the application I used many methods but I cant bypass it please help
1
vote
0answers
30 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
2
votes
0answers
54 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
3
votes
1answer
65 views

Sharing variable between scripts

I wrote some Python scripts to help me disassemble one given file (only one), and I'd like to share some variables between differents scripts (or between 2 different executions of the same script). Is ...
1
vote
0answers
26 views

Getting all instances of Local type in Ida

I create a local type in Ida and put in some places this local type. How can I got all the references to dhat Local type?
2
votes
1answer
70 views

Reverse engineering Roland TR-8S kit file format .t8k

I'm trying to figure out the file format that the Roland TR-8S drum machine uses for importing/exporting drum kits. My goal is to replace the sample (PCM) data within a kit. It's a proprietary binary ...
-1
votes
0answers
22 views

How the SHA fingerprints can be extracted from an APK file and how can it be prevented in Android Studio?

Reverse engineering an APK file reveals sensitive information (including the source code). But can it also reveal the SHA fingerprints? If yes, then how to prevent its extraction in Android Studio?
2
votes
2answers
75 views

Is decompilation significantly more limited when performed on handwritten assembly?

I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
1
vote
0answers
44 views

Understanding the leap of logic in “Secrets of Reverse Engineering”

In Chapter 5 of the book "Secrets of Reverse Engineering" (by Eldad Eilam), the author goes about reversing an undocumented "table" API functions in the NTDLL library. The logic ...
1
vote
2answers
95 views

Using a buffer overflow to call a function

I'm new to reverse engineering C binaries but have been working on an old ctf and thought to ask for explanation of specific assembly commands and how a buffer overflow might force a function to be ...
1
vote
1answer
32 views

what is the difference between pd $s and pdf @@f in Radare2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
-2
votes
0answers
36 views

How to mod nfl street 1 gamecube iso [closed]

I'm trying to update the rosters in nfl street, i have a gamecube iso of the game. I downloaded the gamecube rebuilder app to get the root files to edit them, they are all DAT files and seemingly ...
1
vote
2answers
76 views

Adding a hook to the end of a function

I have a (so-called) function with multiple entry points but only one ret. I am trying to understand how to add a hook to the function. The main problem I'm facing is the code that is placed right ...
0
votes
0answers
40 views

Decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt?

Can I decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt? I am getting these packets from wireshark. I know that the IV might be at the front of ...
0
votes
0answers
88 views

How can I get a value from a memory address that changes almost every millisecond?

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond. ScreenShot: I did a hardware ...
0
votes
0answers
43 views

Bypass Javascript Debug Prevention in Firefox

I've looked around, and can't find an answer for my specific question. The closest I could find was this. I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
0
votes
0answers
42 views

C# Console Application can't load file or assembly, but needs a dll which doesn't exists?

I have a strange error. I created for testing purposes a normal Console Application and run my own Tracer which is written with the help of Mono.Cecil on this application. I embedd a Stopwatch at the ...
1
vote
0answers
21 views

How can I flash unpacked firmware into Alcatel MiFi?

I bought Alcatel MW40V from Vodafone Shop some weeks ago and I can't access USSD Codes within Web UI. Bus 001 Device 008: ID 1bbb:0195 T & A Mobile Phones Alcatel OneTouch L850V / Telekom ...
1
vote
0answers
24 views

Reversing Logitech G933 Battery Charge Values

I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
0
votes
0answers
44 views

How to maintain function ordering in an executable when replacing machine code with C step by step?

I am working on reversing a DOS game consisting of 16-bit MZ EXE files. I was able to determine the exectuables were generated by Microsoft C v 5.10, and loading the signatures from the static ...
0
votes
0answers
32 views

Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile

I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows DECIMAL HEXADECIMAL ...
0
votes
1answer
89 views

IDA analysing a PE file now for 7 days+

So i am pretty new to IDA (64bit) / reverse engineering and i got a few questions. Currently i have IDA pro 7.5 on Windows 10. First question: I am currently analysing a dumped (bypassed the anti ...
1
vote
0answers
45 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
2
votes
2answers
87 views

How can I decrypte the data in this SQLite Database file

I have this SQLite Database file https://we.tl/t-RwKqYyS3D7 When I open it in notepad++, I got some decoded strings. I was trying to clean it and show only the strings without the symboles but then I ...
0
votes
0answers
28 views

extract file from a compiled java exe

I've an exe compiled with nexe and I want to extract file . I can see all the source code with a Hexviewer but it is a shame to extract each file. I've extract 95% of the source code but I miss some ...
1
vote
0answers
53 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
-1
votes
1answer
48 views

How to see the function definition of a function pointer in Ghidra

i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way: iVar = (*DAT)(param_2, PTR_s) When i press on *DAT i see ...
1
vote
1answer
37 views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
0
votes
1answer
50 views

Retrieve user data as if it were the game making the request

Don't think the title really summed it up but here goes. There's a game built in Unreal Engine 4 that displays your (and other users) in-game statistics e.g a leaderboards page. I can determine some ...
0
votes
0answers
65 views

Is this native code possible for further static analysis?

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
0
votes
0answers
30 views

modifying specific binary file

I have binary packed file likely containing a series of if/then action statements if decoded and unpacked to modify. I know what to seek for within the file, I need assistance in unpacking, ...
0
votes
1answer
64 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
1answer
32 views

Java says “ghidra” is unknown protocol when creating project on linux

Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
-1
votes
0answers
71 views

Python lua decrypt

this python code decrypts 1config.lua but not 2config.lua both zip files contain python code please help 1config-lua-decrypt.zip Idle HeroesPS lua 2config-lua-decrypt.zip Idle Heroes Official lua ...
2
votes
1answer
188 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
0
votes
0answers
38 views

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
2
votes
1answer
57 views

Ghidra throws error when creating DWARFProgram

I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram. The constructor prints the following ...
0
votes
1answer
59 views

An incomprehensible line in the output from hex rays

v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1); Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
3
votes
1answer
42 views

alignment in Ghidra and IDA

I see in my IDA it does automatically "align 10" after the end of a fucntion. I wanted to know how to make the same in Ghidra manually like IDA does. Thanks
1
vote
1answer
54 views

IDA 7.5 Show the Progress from Auto Analysis?

Is it possible to create a box / bar in IDA wich indicates the progress?
1
vote
1answer
44 views

How to get thread start address in Windows?

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API. ...
1
vote
0answers
28 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
1
vote
0answers
35 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
0
votes
2answers
39 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
1
vote
0answers
31 views

process crash handler in Frida

I'm trying to debug a crash in some process in iOS frida-trace allows me to add handlers to specific functions, but I'd like to install a handler that prints the stack trace when the process crashes. ...
0
votes
0answers
38 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
0
votes
0answers
62 views

What are “covrage and ”codesz" in radare2?

[0x00009124]> a fcns 0 xrefs 0 calls 0 strings 126 symbols 74 imports 27 covrage 347 codesz 27543 percent 8% Sorry, this is a newbie question, but what are covrage and codesz? How can I ...
2
votes
0answers
32 views

How to find and read specific value in memory of running wine application?

How can I find and read specific values in memory of running WINE application? I am experimenting with text editors, writing some string and trying to find it in the heap memory and changing it using ...

15 30 50 per page
1
2 3 4 5
162