All Questions

Filter by
Sorted by
Tagged with
1
vote
0answers
13 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
0
votes
0answers
13 views

(Help) Apk Decomplied unreadable .pngs

I decompiled an android game apk to look at the source code / resources and the .pngs give me the error "it looks like we dont support this file format" when i try to view them in the Photos App, ive ...
0
votes
1answer
42 views

Info on ProcMon from SysInternals

I need help. I am reversing Procmon64.exe file. It drops procmon.Sys filesystem minifilter driver which does monitoring. Question: I need to know if filtering of events is done in user-mode or ...
3
votes
2answers
236 views

What is the purpose of consecutive ADC instructions to a single register?

To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set. Its use in the snippet below makes perfect sense to me since an overflow is most ...
0
votes
1answer
49 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
0answers
16 views

Move focus to Immunity Debugger command line

As the title says, I want to know if there is a keyboard shortcut that upon pressing will allow me to write in the Immunity command line?
1
vote
1answer
25 views

PowerPC TOC and SDA

I'm trying to understand the concepts of the TOC and SDA in PowerPC. From what I understand, they are basically pointers to tables of global values, when TOC is stored in r2, and SDA in r13. But ...
1
vote
1answer
46 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
1
vote
2answers
53 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
1
vote
0answers
31 views

UTF8, UTF16 encoding string search

I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
1answer
56 views

Identifying Compiler Used for Binary File

I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output ...
-1
votes
1answer
65 views

Understanding (pseudo-)C function from a video game

I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data. __int64 __fastcall ITF::...
1
vote
1answer
27 views

How to change IDA's name representation programmatically?

I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form 9 dseg_1234 the same as 2, but without data type ...
0
votes
1answer
36 views

BOSCH EDC development

I'm trying to reverse engineer some BOSCH EDCs firmware (there are many of them on the internet, for example: Here). To understand it better, I was wondering if someone has any idea how those EDCs ...
0
votes
0answers
122 views

4K demo - Crinkler - Unpacking tutorial [on hold]

http://www.pouet.net/prod.php?which=53563 containing http://demo.hack.se/crinkler_tutorial/crinkler_tutorial.zip is gone anyone who happens to have a copy, please share
2
votes
1answer
34 views

How to set breakpoint with gdb on arbitrary memory location?

I'm trying to debug some code on Linux. There's an arbitrary memory location I need the program to jump to. This location is result of calling mmap with appropriate protection flags for executing a ...
0
votes
0answers
36 views

How instrument read/write access to local variable in a function

I have a large executable and facing a SIGSEGV in a function. I have tried a lot of things, but none has worked. I am planning to set up a PIN, but reading from the documentation I cannot figure out ...
0
votes
1answer
37 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
0answers
25 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
-1
votes
1answer
53 views

How to identify/extract relevant assembly from a binary?

Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program ...
1
vote
1answer
38 views

IDA Pro - Load data in manually created segment

The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string. ...
2
votes
0answers
18 views

How to replay a signal on a different frequency with Gnu Radio Companion and Hack RF

I captured the traffic of a remote control for a LED light. I have multiple of those LED Lights. The payload seems to be the same for each device but the frequency(channel) differs. For one LED light ...
0
votes
2answers
33 views

How to wire up a rotary encoder with a “0v” connection?

I have a servo motor with rotary encoder salvaged from an old scanner. I'm trying to figure out how to re-use it in a DIY CNC machine. By reading through the engineering manual from the original ...
-1
votes
1answer
34 views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
0
votes
0answers
26 views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
1
vote
2answers
64 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
0
votes
0answers
27 views

obfuscating mprotect, or run-time alternative

For an anti-debug method, I need to make a stack page executable at run-time, but only briefly. I don't want to use mprotect() as it's easily located and tracing forward reveals the location of the ...
0
votes
1answer
30 views

Radare2 substituting second operand of lea instruction with a random register

I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx. ...
1
vote
1answer
36 views

IDA debugging a packed / encrypted library - retaining breakpoints / subroutine names set in debug segments

I am debugging a library that is heavily packed / encrypted. Here is a flowchart of the operation of this library and where I am at in my reverse engineering: Assume it is not possible to modify ...
0
votes
1answer
37 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0
votes
0answers
21 views

Frida: Make executable immune to updates

I have few questions which are related to each other so I'm going to ask all of them here. I have a dll which has no debug symbols(ASLR and relocation is disabled). The functions have names like ...
0
votes
0answers
53 views

How to bring the message box other than error message box with Ollydbg

I was trying to use the Call Stack window to catch the error message box in Ollydbg. I put breakpoint on the address and scrolled up a little. I changed the instructor JE to JNZ. When I press Run and ...
3
votes
2answers
41 views

Limited U-Boot options, any memory reading possibilities here?

Within this very stripped down firmware I'm looking at (hikvision camera misrepresented), this is all I have to work with. No other firmware exists, and the open-seasame command presents an encrypted ...
2
votes
0answers
24 views

How to load symbols from a text (map) file

I'm having trouble loading symbols for a very old Delphi-7 EXE. I posted a separate question regarding loading the DBG file symbols. Another approach would be to convert the debug symbols (available ...
2
votes
0answers
25 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
0
votes
0answers
48 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
0
votes
0answers
37 views

Which API function is responsible for input strings?

I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
-1
votes
0answers
24 views

HELP! I have .dmp file, usbtrace file and even .reg file…Please show me the way to emulate Secutech Unikey? [closed]

Does Multikey emulator work on secutech unikey ? please show me the path to emulate this unikey ? I tried x64dbg but could not understand it..Any help would be greatly appreciated!! I also tried to ...
0
votes
0answers
31 views

What does mean cs:Memory on IDA pro? [duplicate]

I don't understand the meaning of cs: Memory. Please help me.
2
votes
2answers
123 views

In reverse engineering, what does it mean to “patch a file”?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
-1
votes
0answers
20 views

move open new activity to antoher folder

Hi i decompiled an app in this app there are 2 activities (Start activity is with password). What iam trying is there is in the (Start activity(Keychecker) ) command to move to the next acticity what ...
2
votes
1answer
81 views

How does IPA decryption works?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
-1
votes
0answers
50 views

How to unpack files for old Dos game? (Nitemare 3D) [on hold]

I am trying to reverse engineer an old Wolf3D style Dos game named "Nitemare 3D", I can get a raycasting engine with directional sprites running pretty easily in my free time using SDL2, but I have no ...
0
votes
0answers
11 views

IDA Pro break on system call to stat64

Upon running strace of an android x86 program I am debugging I notice a large section of stat64 like this: stat64("/data/data/com.topjohnwu.magisk/", 0xbfbf2ef4) = -1 ENOENT (No such file or ...
1
vote
1answer
60 views

Confusion about LEA and why it means what it does in this context

I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example. The first part of it is fairly straightfoward- 7C921A39 MOV EDI,EDI 7C921A3B PUSH EBP ...
1
vote
0answers
39 views

How to find function called by instantaneous event (like mouse press for exemple)

I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me. I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
0
votes
0answers
46 views

How to defeat fake rdtsc driver?

This RSE thread and this one discuss effectiveness of RDTSC-based anti-debug methods, and also a way to possibly work-around (albeit using a fake driver method, which is complex). What is a counter-...
4
votes
0answers
59 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
1
vote
1answer
25 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
-1
votes
0answers
20 views

X64DBG Invalid memory address after breakpoint?

I can see the assembly code prior running. But when the program is running and hits the breakpoint there's nothing where previously (before running) there was the code. If I set 2 breakpoints close to ...

15 30 50 per page