All Questions

0
votes
0answers
12 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
0
votes
0answers
19 views

blowfish padding

I'm currently reverse engineering a binary that uses Blowfish. A sample input would be: 08 00 01 00 1C FB 19 00 When this data is encrypted and then decrypted, I get the following results: encrypt: ...
1
vote
0answers
20 views

How is PTX compressed in a fatbinary?

It is not clear how PTX is compressed in a fatbinary. I'm doing some research and by looking at the binary it seems a sort of LZ77 (or LZSS?). I've prepared some tests: Small PTX. A simple vec_add (...
1
vote
0answers
18 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
0
votes
0answers
37 views

I want to hire IDA Pro / Hex Ray Reverse Engineer [on hold]

I want to hire IDA Pro / Hex Ray Reverse Engineer for some projects within the car industry. Can anyone point me in the right direction.
0
votes
0answers
52 views

Why is the process crashing after executing my injected payload?

I tried the following payload for APC injection in Windows. It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload. What could be the possible ...
0
votes
0answers
28 views

Find entry point of start anti debugger? [on hold]

I need help to bypass this protector. Because game not loading after. Game (Blade and soul), and i not found info what a version using in this game, very sad. Maybe someone unpacking this protector, ...
4
votes
0answers
31 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
1
vote
2answers
55 views

Why there are two different shellcodes for bin/sh with much different syntax and which one is better to use? (x86)

I have found two shellcodes for spawning /bin/sh which are much different from each other. The second one is hardly ever found on the net, and it mostly comes up in reverse engineering websites: 1. "\...
0
votes
0answers
26 views

Server-side unique ID emulation

I'm trying to emulate an XML server-side response for an java application. The application receives a unique ID from the server every time it open. The response code is similar to this - ?VHR/UGFD]5 ...
-6
votes
0answers
79 views

Can you PLEASE help me decode, decipher or decrypt this? [on hold]

twhudcdfpmrsfjiical5molq2clavtrsaelqdahrnneevtiicwudwodqvwoytohpwmhgiclinornyjinooh5xcrgfwtnetuitwbolcdikossynbrceudswbqvclyktoiaeivvthzkotsyttehol8dwefscintmhvieivlorppneaomldmaugkedartessal5yotlzptl%...
2
votes
1answer
32 views

How to execute a specific shellcode with a non executable stack without using format string? (without ASLR and stack cookie)

First off we don't have ASLR and stack cookie, and assume we can't create our own files on this system So I'm trying to execute a shellcode in this code, this is what i have done so far: i have ...
0
votes
1answer
24 views

How to see all of my changes in idb?

Is there ant way to see all of my changes in idb file ? All of variable in psudo code that I changed here name, all the funxtion I rename. I want to see all of this
0
votes
0answers
56 views

IDA Pro debugging Linux .so libs

I am trying to debug a library that a server application loads in. On an Ubuntu server I start a gdbserver like this: gdbserver localhost:23946 ./smallserver After this on my Windows, I load the ...
1
vote
2answers
29 views

IdaPython Get Call Destination for Register Operand

I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of ...
5
votes
2answers
53 views

Understanding branch delay slots for reversing MIPS

I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in ...
-2
votes
0answers
14 views

PMC-E2200 Digital Receiver PMC from Curtiss-Wright [on hold]

I want The PMC-E2200 Digital Receiver PMC from Curtiss-Wright. It looks like absolute hence is any viable solution to redesign?
2
votes
0answers
13 views

SCSI interface through USB

I'm trying to dump the storage of Xiaomi Home camera. It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device. I tried mounting the SCSI disc with ...
1
vote
2answers
212 views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
101 views

Point-to analysis of IDA Pro

I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro. According to my personal ...
0
votes
2answers
38 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
1
vote
0answers
41 views

Unable to install ltrace on Kali [closed]

I am kind of stuck with the installation of ltrace on my Kali VM. My /etc/apt/sources.list file is updated with following entry: deb http://http.kali.org/kali kali-rolling main non-free contrib I ...
3
votes
1answer
35 views

Importance of Compiler Version in generating a signature

I load a reference elf that I cross-compiled for AArch64 into IDA Pro, idb2pat to generate a .pat which I then process through sigmake. I then use the signature file (in the appropriate IDA Pro ...
2
votes
1answer
107 views

Converting Assembly x64 code to C

I have the following code: 0000000000400526 <main>: 400526: 55 push rbp 400527: 48 89 e5 mov rbp,rsp 40052a: 48 83 ec 20 sub ...
0
votes
0answers
32 views

How to break on function call with gdb and no symbol table

I want to debug the Win32 event pumping loop. Thus, I need to put a breakpoint at GetMessage and GetMessageW call. I am using gdb as an asm disassembler on a file with no symbol table. Thus, how to ...
3
votes
1answer
159 views

How can I convert this assembly code (x64) to C?

I have the following assembly (x64) function: 400700: sub rsp,0x18 400704: mov QWORD PTR [rsp+0x8],rdi 400709: cmp QWORD PTR [rsp+0x8],0x0 40070f: jne 400718 <bar+0x18> 400711: mov eax,0x0 ...
1
vote
0answers
38 views

C# Hidden Method through transparent proxy object?

I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined. ...
1
vote
1answer
78 views

Figuring out what a segment of assembly code does

I have the following assembly code: 0000000000400711 <foo>: 400711: 55 push rbp 400712: 48 89 e5 mov rbp,rsp 400715: 48 89 7d e8 ...
1
vote
0answers
29 views

Legal Reverse Engineering for Security Review in US for Korean Provided Module

My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
1
vote
0answers
17 views

How can you use modprobe nandsim for two chips?

I have a board that uses two nand chips with data that appears to be interleaved byte-by-byte. I have manually desoldered the chips and dumped them with their respective spare areas to two files. I am ...
2
votes
1answer
101 views

Has there been any success in using deep learning for reverse engineering?

So has there been any success in using deep learning for doing reverse engineering? i couldn't find anything useful other than some theoretical papers, so was there any talk about this in recent ...
1
vote
1answer
33 views

Inversion of input parameters in ASM

the code is: .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD PTR [ebp+0x8] mov ebx,DWORD PTR [ebp+0xc] mov eax,ebx mov esp,ebp pop ebp The entry is: asm0(0x2a,...
1
vote
1answer
49 views

Is the value of EBP before the main function important?

So before we come to the main function, it looks we are in a function with a name __libc_start_main and before we come to our main function we obviously push EBP value in the stack ( the value of EBP ...
2
votes
1answer
35 views

Radare2 webui - need help setting it up

How can you set up Radare2 webui in Kali or Ubuntu or any other OS? I've tried so many different methods but none of them have worked so far. I think both of them are debian based so that might be ...
1
vote
1answer
85 views

Reverse Engineering Flat Data File

I'm writing a piece of software that will take positional data from a piece of software called Pyware and put it into a GUI so I can visualize the coordinates and assign each coordinate a color. ...
0
votes
0answers
39 views

Why /bin/sh getting permission denied after jumping to a function?

I have a simple buffer overflow code like this : #include <stdlib.h> #include <stdio.h> #include <string.h> char* exec_string = "/bin/sh"; void shell(char* cmd) { system(cmd); } ...
3
votes
0answers
52 views

Recovering data from mystery signal

I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following audio. (Wav ...
1
vote
0answers
30 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
1
vote
0answers
54 views

Need help understanding IDA Pro pseudocode

I am new into IDA and have some questions about the pseudocode in C. Could someone please explain to me the meaning of the following two lines: (*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
-1
votes
1answer
69 views

Analyze raw assembly using IDA Pro

I have a raw assembly dump i.e. .intel_syntax noprefix .bits 32 .global main main: push ebp ... And I know it's Intel x86 and the original function was most likely written in C. Now the ...
2
votes
0answers
52 views

Deobfuscate PHP that contains - goto

I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
1
vote
1answer
34 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
0
votes
1answer
146 views

What does this assembly language program output?

I have been struggling with this for a long time. I have the following assembly language code: .intel_syntax noprefix .bits 32 .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD ...
1
vote
2answers
55 views

What is a “trit”?

With Radare when I do ?, I get a list of answers in the result, [0x00400a04]> ? -0x120 + 0x110 hex 0xfffffffffffffff0 octal 01777777777777777777760 unit 17179869184.0G segment fffff000:...
3
votes
0answers
54 views

EEPROM data bytes verification

I'm investigating a tool. I have an section of an eeprom memory dump that this tool uses, shown in the figure below. By my inquiries, the two bytes highlighted in red are based on the bytes ...
2
votes
1answer
63 views

What's a decompiler that can be extended to new architecture, and how can I do it?

I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
0
votes
0answers
33 views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
0
votes
0answers
37 views

How to get index register from the instruction in IDA?

I have the instruction: add edx, ds:dword_7BFC7A50[eax*4] i.e. add edx, [eax*4+7BFC7A50h] And I decode it via decode_insn(). Then I try to get the information about the second operand. I ...
1
vote
0answers
50 views

Is Dynamic Binary Instrumentation legal in UK/EU for malware analysis?

I am doing a university project about performing malware analysis on binary files. The end goal would be to analyze real world executables(Microsoft Office installation file for example). If I use DBI,...
-1
votes
1answer
50 views

How can I decompile the CC2650 .hex file to C?

I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI. My goal is to know the specific way used by CC2650 to generate the LTK. I'll ...

15 30 50 per page