All Questions

0
votes
0answers
8 views

Ghidra - Export namespaces

I am currently learning to use ghidra, and I found the Symbol Tree. Ghidra found some namespaces that I would like to export. These namespaces don't even have to be readable, just reusable, such that ...
0
votes
0answers
12 views

Possibility of converting Powershell to a lower level language

Is it possible to convert a Powershell script to ILAsm or another low level assembly language?
2
votes
0answers
57 views

How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem

I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking ...
0
votes
0answers
25 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
0
votes
0answers
36 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
0
votes
0answers
13 views

Turning p-code generated by VBA (Visual Basic for Applications) back into VBA

According to the README in https://github.com/bontchev/pcodedmp : "As each VBA line is entered into the VBA editor, it is immediately compiled into p-code" "when you open the source of a macro ...
0
votes
0answers
36 views

x64 hook Fails on Messagebox

Quite new to the intels so i might not know much , I just need some form of direction here. I am trying to do a simple 64 bit hook detour for function hooking I do it like so : The detour hook ...
0
votes
0answers
55 views

Can somebody recognize this programming language?

I'm curious in which programming language or script language is this written, any idea? [Dashboard\Alfa Romeo\147 93C86] Size(280,270); // ширина и высота Form { Form { Group("Пробег",35,13,...
0
votes
0answers
43 views

Is there any way to change the encoding of an exe file?

I have an exe file and it will browse the xml, or txt files to display this exe file. And the characters only display the exact language of that country when I switch the language of the computer to ...
1
vote
1answer
69 views

How to inject some code to ARM .so files permanently?

I am trying to figure out how to solve the following. I have two ARM .SO libraries (32 bit and 64 bit) with the same functions. There is a method which returns const char* , it looks like this in ...
0
votes
0answers
22 views

Unknown three part signature

I have received a string which is supposed to be a cryptographic signature. I have access to a certificate which should let me verify the signature. However, I am rather confused about the structure ...
1
vote
0answers
56 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
-1
votes
0answers
30 views

how to do a dynamic malware analysis on a app which is intrusive? [on hold]

I try to did the analysis with inspackage but it was not working at all, I installed everything but the time than beginning with the analysis isn't working. So the information of the ransomware is ...
0
votes
0answers
16 views

APPINIT_DLLS from registry [on hold]

Malwarebytes has detected HKLM\SOFTWARE\MICROSOFT\WINDOWS\ NT\CURRENTVERSION\WINDOWS\APPINIT_DLLS as threads and it has been quarantined .Does this affect my computer system?
0
votes
0answers
18 views

ASCII strings not showing up in CPU in OllyDbg, but rather in dump

im preety much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
2answers
74 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
0
votes
0answers
22 views

Modifying apk at java bytecode level

After days of searching, i found that modifying an APK at Dalvik bytecode level is guaranteed to work, resulting in a new valid APK (steps explained here). I've already modified some malwares using ...
2
votes
1answer
35 views

Meaning of Flags in ELF Section header?

Given this classic helloworld.c example, #include <stdio.h> int main() { printf("Hello world!\n"); } In below sections output, the value for Flags presents a couple of different values, e....
0
votes
1answer
37 views

Hex editing a program to change variable types

For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand. ...
1
vote
0answers
22 views

How to embed PYZ.-00.pyz_extracted folder with entry .py file to generate exe file?

I have decompiled exe using pyextractor script and generated these files: PYZ-00.pyz PYZ-00.pyz_extracted gui pyi_rth_tkinter pyi_rth_multiprocessing pyi_rth_pkgres pyi_rth_win32comgenpy ...
0
votes
0answers
18 views

Reverse engineer Apple T2/SSD driver for linux

I wasn't exactly sure if this is the right place, as opposed to thinkdifferent or stackoverflow but I figure this might be a good place to start. I have a Macbook Pro 2018 15-inch laptop and want to ...
0
votes
1answer
57 views

Can't find any string with IDA, why?

A friend asked me to make some small mod on a app. The mod should be to rewrite some labels like button, textbox text into his language, so he can better understand the app... I loaded the app to IDA ...
0
votes
0answers
23 views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
0
votes
0answers
51 views

It is possible to parse this MBR? [on hold]

It is possible to parse this MBR (Master Boot Record)? 00000000 eb 3c 90 4f 70 65 6e 42 53 44 00 00 02 02 00 00 |.<.OpenBSD......| 00000010 00 00 00 00 00 f8 00 00 00 00 00 00 10 00 00 00 |.....
0
votes
1answer
29 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
0answers
21 views

Minimal results using the basics - strings, hexdump, Binwalk [on hold]

I have a firmware file I am trying to reverse engineer. I own the hardware the firmware is used in. The hardware is an SDR radio. I am seeing minimal returns with the basic I have posted below. I ...
0
votes
1answer
36 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
0
votes
1answer
44 views

Solitaire game invalid move [on hold]

I'm trying to reverse engineer a game of Microsoft called Solitaire. When I tried to pull non ace card to blank desk there is warning message box showing. I want this non ace card in blank desk not ...
0
votes
0answers
34 views

How to guess the key of XOR encryption in java?

I am trying to find the key of XOR encrypted string in java. It is very much probable that the key is eight characters long. I have the encrypted string. I am not able to understand how to go ...
0
votes
0answers
38 views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
0
votes
1answer
44 views

Search string in all binary pesudo-code

How can I search pesudo code string in all functions in binary with Ida?? Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c) I want to search for example where ...
0
votes
0answers
62 views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
2
votes
1answer
39 views

LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?

Observations When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program ...
0
votes
0answers
14 views

APP Signing on play console [closed]

I created the application from the application design site When posted on Google Play was rejected because of the signature I tried to apply the signature on AndroidStudio and i didn't succeed .. Am I ...
0
votes
1answer
34 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
0
votes
1answer
20 views

Is there a way to export all the strings for a certain module in x64dbg?

I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...
3
votes
1answer
133 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
0answers
46 views

How does IDA provide function names to dynamic calls?

I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to 004019c0. Looking in IDA I notice ...
2
votes
0answers
46 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
1
vote
0answers
51 views

How to Dump a locked PIC

I have tried these few days to read a PIC18F microcontroller which is locked.it says all protected (0000 E0FF 40FF).then i found out that it is possible to bypass the CRP on some of these ...
1
vote
0answers
64 views

Find File System in Firmware

This is my first attempt at working with firmware. We have some SNMP cards that are flaky & my ultimate goal is to try to make them better. The current firmware version is 12.06.0069. When ...
1
vote
0answers
79 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
0
votes
0answers
46 views

I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?

I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system. Can I edit the code off the .exe file? I need to change a value in the code. Thank ...
3
votes
1answer
89 views

How to identify memory access locations

I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I ...
2
votes
0answers
34 views

Invert stack view in radare2

Is it possible to invert the stack view when debugging in radare2 such that higher addresses are at the top?
0
votes
1answer
48 views

Large number of exports defined in a PE .exe file

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are ...
1
vote
1answer
102 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
1
vote
1answer
36 views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
3
votes
0answers
66 views

How does cartridge protection distinguish an original vs fake cartridge?

Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. What is ...
1
vote
0answers
44 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...

15 30 50 per page