All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

RE tips in using Ollydbg for beginners?

I am new to the RE community and currently studying debugging. I still have no clue how to start the debugging process when given a virus or infected file. Do you have any tips for beginners on ...
0
votes
0answers
9 views

Why does IDA Pro fail to add these constants?

I am trying to port Enrique Nissim's script from his presentation "Reverse Engineering and Bug Hunting on KMDF Drivers" to IDA 7.4. His original script can be found at: https://github.com/...
1
vote
0answers
34 views

crc - reverse engineering GAL16V8 checksum method

While working with the GAL16V8 (an old programmable logic device), I found out that the Programmers Electronic Signature (PES) of each GAL has a checksum byte I've read the PES of some GALs but was ...
2
votes
0answers
25 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
2
votes
0answers
41 views

How to approach a heavily obfuscated binary

I'm dealing with a binary that has been processed by a obfuscator and looks something like this (short excerpt): 4156 push r14 52 ...
0
votes
1answer
41 views

very weird 2-pin debug header

I'm working on a board with little documentation and a custom MCU (no public documentation). There's a two-pin debug header on the board; at first I thought it was SWD or UART without provided VCC and ...
1
vote
1answer
26 views

How can I easily convert little endian pointers in hex dumps?

I am tracking down a data structure whose address is inside the second operand: mov rcx, qword ptr ss:[rbp+E0] When I look at the value of [rbp+E0] I see the following dump: 21 C4 FC 5E 00 00 00 00 ...
1
vote
1answer
35 views

What is the easiest way to dump a REGION of memory in IDA pro?

I'm facing a problem that i need to dump a large region of memory with IDA pro using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
1
vote
1answer
44 views

Segmentation fault after export binary file in Ghidra even without any changes

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
2
votes
1answer
32 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
1
vote
0answers
39 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
2
votes
1answer
60 views

Attempting to reverse engineer an iOS OTA payload-like archival format

Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
0
votes
0answers
31 views

IDA Freeware Debugger crash on attaching

I run a binary that I am trying to reverse engineer from terminal and when I try to attach it with IDA debugger it says "OOPS! Internal error 20099" occurred. I am able to load the binary ...
-1
votes
0answers
53 views

Testing apk with frida

I am doing some analysis to apk. I the application retrieves from the server an encrypted data and decrypt it in the application and print the data as is. Is there an easy way that i can check with ...
1
vote
0answers
43 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
0answers
18 views

How can I lookup the current address of a location by file address in lldb?

Going back and forth with a debugger, I can very easily determine the file address of a memory location by doing (lldb) image lookup -a 0x102802574 Address: Program[0x0000000000002574] (Program....
0
votes
1answer
47 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
1answer
70 views

Bypassing IsDebuggerPresent [closed]

I am currently trying to attach a debugger to a program with a callback for IsDebuggerPresent. Normally, i would patch the program to pass over this check, but patching the program is not an option. ...
-3
votes
0answers
29 views

How to extract xxtea key from this code [closed]

I try to use ida pro to extract xxtea key from a lib.so Regards xxtea_decrypt(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4) { longlong lVar1; ulonglong uVar2; ...
1
vote
0answers
22 views

Reverse engineering a command line argument using angr for an aarch64 binary

I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
1
vote
1answer
25 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
-1
votes
0answers
73 views

i need help in compression algorithm identification [closed]

okay so, i'm modding a game which has compressed files, as far i could see, it has apparently 2 "compression patterns", files starting with "00 05" and "00 07". I was ...
1
vote
0answers
23 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
0
votes
0answers
32 views

IDA exported header full of errors

Im a noob when it comes to using reverse engineering tooling. I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...
2
votes
2answers
35 views

How to call to function while debug

When I debugging remote process with gdb-server and Ida, and put breakpoint in the code, when the process stopped at this breakpoint how can I call to function and after that return to my code ?
-3
votes
0answers
45 views

Need help to extract xxtea key [closed]

I try to use ida pro to extract xxtea key from a lib.so Regards xxtea_decrypt(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) { longlong lVar1; ulonglong uVar2; ...
1
vote
1answer
41 views

How to fix Mach-O headers from a memory-dumped binary to make it usable again?

I am trying to restore a binary from memory. I re-constructed the binary and analyzed it with a disassembler and it looks okay, but when inspecting the headers with otool I'm getting: truncated or ...
1
vote
1answer
60 views

Reverse engineer an HID device - recreate using arduino

I have an HID device that I'm trying to re-create using Arduino, I have captured the USB packets and I have pretty much analyzed all the data I need to operate the device, the only thing I'm not ...
2
votes
0answers
101 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly, then I use Objdump and IDA to check the code and they get the same ...
-2
votes
0answers
19 views

how to dec fully script lua [closed]

i try dec some offline game , but what i get inside after the get dec is not gg.command but "local L0_0, L1_1, L2_2, L3_3, L4_4 function L0_0() local L0_5, L1_6, L2_7, L3_8, L4_9, L5_10, L6_11, ...
0
votes
1answer
28 views

Call of a suspicious method cannot be found

i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played ...
0
votes
1answer
32 views

What is this line and how to remove it

I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
0
votes
1answer
61 views

How i can grab a pointer or hook the process procedure without creating a global hook [closed]

i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
0
votes
1answer
36 views

WinHex : There's a data that does not belong to any module

I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data). Now , when i open the process Entire memory with in WinHex , i can ...
4
votes
2answers
113 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
0
votes
0answers
19 views

Is it possible to decompile an apk file and create a communication channel? [closed]

The reason I want to decompile the apk file is because I am trying to automate some tasks and I want to make the decompile version of the app be able to communicate or take instructions from a python ...
0
votes
1answer
23 views

Windows PE64 throw error while allocating heap for unknown reason?

For some reason i'm not aware of ( some heap allocation limit ) while allocating memory for some classes, an application ( win64 ) raises this exception: DumpedMini Result[0] Exception Code[...
3
votes
2answers
534 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
2
votes
1answer
29 views

How can you dump the unpacked version of a packed library/plugin from memory on macOS?

I'm dealing with a custom-upx packed library that I'm trying to unpack. System is macOS. Given it's a library/plugin, it doesn't have a standalone entrypoint. I ran it through a disassembler but wasn'...
2
votes
1answer
45 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
2
votes
1answer
52 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
2
votes
0answers
63 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
3
votes
0answers
68 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
1
vote
0answers
45 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
1
vote
1answer
40 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
1answer
67 views

Latest VMProtect vs Latest Themida [closed]

I am working on an app to archive some important files in a compressed-encrypted format, What is the best for me to use (Virtualization) VMProtector or Themida ? Thanks in advance
1
vote
0answers
75 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
30 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
2answers
46 views

Defining operand as offset

I have an idapython script which automatically defines bytes as code by a predefined configuration. The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
0
votes
0answers
159 views

Extracting information from a random cipher or a binary file

I have measured data comes from a various types of sensors. After measurement, the data encrypted and stored in a memory. We monitor the serial data(via:RS232 from the memory), and the data was ...

15 30 50 per page
1
2 3 4 5
143