All Questions

-4
votes
0answers
18 views

how to decrypt terraria game files? [on hold]

stack exchange community what encryption language is been used on this file and is there a way to decrypt files like this
1
vote
0answers
19 views

Unable to unsquash from a firmware dump

after struggling for days I'm asking for help with this problem. Link to download the firmware. I dumped a firmware image from an EEPROM Spansion FL128SAIF00 with flashrom and a buspirate via SPI ...
0
votes
0answers
37 views

Monitor encrypted TCP stream on android app with wireshark

Hello I'd like to monitor all incoming traffic from an android application. It is using certificate pinning and I managed to bypass it with an xposed module and I monitored HTTP(S) traffic of my app ...
1
vote
1answer
43 views

How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?

How to make Radare2 automatically disassemble next instruction after each ds debug single-step? I thought that e asm.bytes=1 would achieve this, but that doesn't help. In particular, GDB supports ...
0
votes
0answers
36 views

Extract file from vm memory dump

I have a vmware memory dump from a linux guest in the vmss.core format. I am dealing with an application using cryptopp and some kind of aes for encryption, and would like to extract the decrypted ...
0
votes
0answers
31 views

IDA Hex-Rays: There are no xrefs to

I defined a new type and changed the function signatures and local variables in the Pseudocode window so that they use this type. But IDA itself displays this type as unused. She did not see ...
1
vote
1answer
31 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
1
vote
0answers
15 views

moving info from one register to another using dot, powerpc

There are three simple instructions from Power PC assembly: mr. r7, r3 li r3, 0 beqlr Well, if i understand here all lines correctly, i move value from register r3 to r9, load r3 with 0 and jump to ...
0
votes
1answer
59 views

How can I make IDA understand this switch statement with a signed jump table?

I took the following C code and compiled it on Ubuntu 16.04 with GCC 5.4.0: int main() { int a = 0; for (int i = 0; i < 5; i++) { switch (i) { case 0: a = 1; break; ...
13
votes
1answer
3k views

How should I approach reverse engineering this text encoding?

So I'm trying to hack the translation from the PS4 version of a game into the Vita version. The script files were conveniently uncompressed, and I was able to drop them in and have it working without ...
0
votes
0answers
70 views

How much C and Assembler do I need to know for reverse engineering? [on hold]

I'm familiar with Python, Java, Javascript [...] and I slightly dare to jump from server programming to reverse engineering since it got my attention. I'm not sure whether my read-skills from Java ...
2
votes
1answer
63 views

VMProtect anti-debug method

I recently found a nice crackme which uses VMProtect 3.x as defense. After doing a little research online I found couple of API's VMProtect uses as an anti debug method. I set software breakpoint on ...
1
vote
0answers
32 views

Reverse engineering Nextbike API and random 16 character pre-shared key

I am trying to get to know how Nextbike's API works. It's not a public API but capturing the outgoing traffic with my phone I can see all the traffic and endpoints that are being contacted. I've ...
2
votes
1answer
44 views

Is there a standard character encoding that is ASCII minus control characters?

I came across some unusual strings in some embedded SH2A code I'm analyzing.... 11 53 54 00 53 55 4E 44 41 59 00 4F 46 00 2E 4F 56 45 4D 42 45 52 . S T . S U N D A Y . O F . . O V E ...
0
votes
0answers
72 views

What is the key to these encrypted messages? How do I reverse engineer it?

So I'm trying to reverse engineer a lock system that consists of a chip reader and a control unit. There are only two devices on this network, the reader which reads a rfid like chip and the control ...
4
votes
1answer
53 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
0
votes
0answers
29 views

IDA SDK: How to add a struct (pointer) field to a struct?

I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows: 00000000 SomeClass struc 00000000 ...
0
votes
0answers
31 views

Runing x86 Android Shared Library under i386 ubuntu

I have .so library extracted from an .apk file for x86 architecture. (let's say libfoo.so) From the .smali code I can see that the library is loaded with System.loadLibrary(), and I can see the name ...
-1
votes
0answers
48 views

Hasp envelope unpacking

I have one file that has been packed using HASP SRM 1.x and i want to learn unpacking. Here is Detect Easy result I found the signature 5750569C5351524150 and put break point in x64dbg but i ...
0
votes
0answers
27 views

View Data from a .dat file

I am doing working on a project of my own where I am using the data of a football game to calculate certain statistics on players. Long story short, I am having trouble extracting the data from the ...
0
votes
1answer
32 views

Reverse engineering Infostealer.Dyre

I'm a newbie to malware analysis and reverse engineering in general. I got hold of a Dyre malware sample from theZoo on GitHub and I've been trying to analyze it. I've put up my analysis report here. ...
1
vote
1answer
34 views

How to get the memory-mapping (e.g. library) that contains a given address in Radare?

How to get the memory-mapping (e.g. library) that contains a given address in Radare? I've done a search in Radare for a specific string (search.in = dbg.maps), which resulted in an address. Now, I ...
0
votes
1answer
45 views

Checksum error when flashing modded firmware on embedded device

I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar ...
0
votes
1answer
27 views

Find address of kernel function

Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I ...
1
vote
1answer
49 views

Manually unpacking DarkTequila, stumped. Can anyone help?

The malware is packed w/ UPX - can see 0/1 in sections. Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to ...
0
votes
0answers
33 views

Reverse engineering on a node js EXE file

I have an exe file originally coded in node js, but I don't know what compiler was used to compile it. Also, all the questions similar to mine that I found were unanswered. Is there a way to retrieve ...
1
vote
2answers
55 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
-1
votes
0answers
20 views

Unity C#: how to make a function activate when the player enters a collider [closed]

I am trying to make a platformer and now want to add a function that respawns the character when they touch a spike/enemy( in Unity with C#).
0
votes
0answers
25 views

Root access on a buildroot linux router

I have a Gemtek WVRTM 127ACN router / modem, my goal is to get root access and to dump the currently installed firmware, not being official, but a modified version of who provided it to me. On the ...
4
votes
1answer
123 views

Problems with extracting firmware

I am currently trying to reverse-engineer the firmware of an E-Cigarette but I cannot find any clues with the common tools. Heres everything I found so far. Binwalk doesnt recognize anything even ...
1
vote
2answers
88 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
1
vote
0answers
48 views

Extracting Firmware file from Wireshark Dump

I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is Zip archived data ...
-1
votes
0answers
20 views

OllyDB and DLL source code

I have a DLL and with ILSpy I can also see the source code. I'd like to change the dll flow by OllyDB on one specific line of code. I know for example the name of a function and I want to return ...
1
vote
1answer
92 views

Question regarding ASLR

If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time? Or the address will ...
-1
votes
1answer
99 views

How to convert assembly to pseudo code? [closed]

I have the following assembly. I don't know how to follow assembly. I was wondering if there is a way to convert assembly to a human readable pseudo code or better yet C code: init: mov eax, [ebp+...
2
votes
1answer
82 views

Call instruction changed while running

While debugging and reverse-engineering my exe, I have found a very weird thing. call ds:GetModuleFileNameA This call instruction is formed with below hex bytes in IDA. FF 15 24 C0 41 00 (I think ...
2
votes
1answer
86 views

IDA does not create Vtbl structs for child classes loaded from PDB

I'm decompiling a MFC 4.0 application, and now loaded the MFCS42.PDB from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the ...
0
votes
1answer
63 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
0
votes
0answers
32 views

TIIF File format

In VSat modem like COBHAM Explorer 510, the company offers to upgrade software every one year. So I check the new software update. It contains a tiif file format that the user manual said to copy the ...
0
votes
0answers
64 views

Advice on reverseing [closed]

Hi I am new into this fascinating community. I have a little libxxx.so (150kB) shared library on android; this lib exports a few functions and I am trying to understand what happen inside. I have ...
0
votes
0answers
24 views

How to start remote debugging in IDA Pro use IDC or IDAPython?

IDA Pro has remote debugging function. Some parameters are invisible characters and cannot be copied into the “parameter” edit box. So I want to start remote debugging with IDC or IDAPython. Do you ...
-1
votes
0answers
38 views

A very noob question: What is the .NET framework? [closed]

I know it has something to do with Windows and that it's "built on it" but I haven't got any good info on it I could find that didn't confuse me.
0
votes
0answers
24 views

IDA FLIRT signatures for externs?

I have a simple bit of code, that's invoking OpenSSL. Disassembly shows an expected call; int __cdecl BN_bin2bn(int a1, int a2, int a3) { return BN_bin2bn(a1, a2, a3); } Which points BN_bin2bn to ...
0
votes
0answers
35 views

LD_PRELOAD, doesn't work every time

I mean that when using LD_PRELOAD to replace a libc function, it does not always replace. (Unfortunately, it serves me in challenges). So my question would be: Are there any configurations that ...
0
votes
0answers
41 views

Adding new type libraries in IDA

While I'm reversing a binary, I found out that the binary is dynamically loading a GetHashFromFileW function from mscoree.dll, using LoadLibrary and GetProcAddress. The type information of this ...
0
votes
0answers
31 views

Error when i start Chrome Remote Desktop app after recompile

I recompiled Chrome Remote Desktop Android app(with no change) and tried to run on my phone. But everytime i start the app, it just close immediately with error below. 2018-12-04 20:11:35.053 9136-...
0
votes
0answers
29 views

How bypass PIE to read stack

How to know the location of a data in the stack, when the ASLR, PIE, NX are active? Are there any known techniques? It is especially PIE that disturbs me, because I can not break with GDB to read the ...
0
votes
0answers
33 views

Debugging two DLLs simultaneously in IDA

Having read How to debug the DLL of an EXE using IDA Pro, I know how to debug a DLL as called by an .exe. I have an '.exe' file that uses two distinct DLLs. How can I open both DLLs at the same time ...
1
vote
0answers
44 views

Reverse engineering a bar code's check digit

I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...
0
votes
0answers
22 views

Is it possible to change image base with `IDC` in IDA?

I use IDA ARM remote debugger with Android native libraries, and it detects wrong image base address always. I have to go to Segments => Rebase Program, and set Image base value to correct one on each ...

15 30 50 per page