0
votes
0answers
17 views

Bypass/Remove Install Referrer to let apk Install not from Google Play Store

Helo, I mod unity game to tweak some ability in assembly-csharp.dll. In nox emulator, non-root or rooted, install success and mod work. But i have problem in non root phone. If I install it when ...
0
votes
0answers
35 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
0
votes
0answers
27 views

detect and reverse malware in movie files

we suspect some media files *.avi, *.mp4 contains trojan and virus. I have tried MBAM v1.75, but it doesn't have the capability to extract the malcious files. is there any other freeware or software ...
1
vote
0answers
36 views

Reverse engineer CRC16

I have not had success with reveng on figuring out how to calculate these CRCs. I successfully figured out another similar CRC from the same author so I'm pretty sure that the first four bytes as ...
1
vote
0answers
16 views

How determine correct checksum algorithm for this NFC Data?

I maae a dump of a Mifare Classic, NXP, tag. I can read some information without a problem, but if I write data in a block, I need to terminate the block with a checksum (CRC?, one byte). I tried ...
0
votes
2answers
45 views

Determining file format of an OBB

I'm trying to unpack an obb file used in an android game. From my initial google searches, it's my understanding that an obb can be basically any type of file. The only lead I have is the magic bytes ...
0
votes
0answers
45 views

IDA doesn't see code

I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
0answers
11 views

Looking for ideas on training neural network models to predict a n-byte response given an n-byte challenge as input [on hold]

I am experimenting to see if I can train a neural network to predict an n-byte response (key) given an n-byte challenge (seed). I was wondering if there any existing neural network models/research out ...
0
votes
1answer
46 views

Resource Hacker and IDA PRO

How can I find the reference, in IDA, for the dialog and Menu I see in Resource Hacker (RH). e.g. I find, in RH the following Menu items: POPUP "Painter" { MENUITEM "Start/Continue", 32840 ...
1
vote
1answer
27 views

IDA Python call func from idb names with specific arguments

I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 ...
0
votes
1answer
44 views

Break when pattern found in x64dbg and few small questions [on hold]

I am a beginner to reverse engineering and I have been trying for the whole day to learn how to force WinRAR to extract a file without giving the right password. I have cornered it down to a Windows ...
3
votes
1answer
36 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
1
vote
1answer
48 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
2
votes
2answers
41 views

Obfuscated code analysis - can unused variables be ignored?

I am analyzing a malicious javascript. The code is encoded and obfuscated in a way that I did not manage to even partially deobfuscate yet and it is filled with long strings. In order to simplify the ...
0
votes
1answer
47 views

IDA PRO - .id0: b Tree error: file open error: permission denied

Many times after closing a file I am working on and trying to open it later I get an error: <fileName>id0: bTree error: file open error: Permission denied even when i copy this file to a new ...
-1
votes
1answer
39 views

How do i find the decryption key for a encrypted text file [closed]

So context i have a game and a encrypted save file. My thoughts were how to find the decryption key in reverse engineering my game .I watched tuts but i think this topic isnt much detailed so i need ...
1
vote
1answer
49 views

Java digital signature

I'm using a java application & it validates two parameters from web server one is "signature" & another one is 'id". <signature>...
1
vote
0answers
23 views

Building custom image with firmware mod kit

basically I have netis WF2409E router and i want to update it with custom image so I decided to try fmk. First I added gdbserver to usr/bin and re-packt it with fmk and upload it. After finishing ...
5
votes
1answer
78 views

How can you explore behavior in malware that is not being performed?

I have a malware sample that I know is acting as a bot and connects to a botnet. The problem is that it uses no known protocol that I am familiar with (it's IRC-like) and doesn't actually do anything ...
3
votes
1answer
67 views

Why is it “safe” to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

Typically when I write a game-hacking executable after reversing a game, I go about code-caving to find where I can inject my code as need be. Well, while reversing a few such executables from someone ...
1
vote
0answers
71 views

Trying to identify block of code which generates 256 bit key

I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted. I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
1
vote
1answer
40 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
0
votes
1answer
45 views

How to use API monitor on specific process

I want to monitor specific process with API monitor but I didn't understand how do I do it please. I will happy to understand that. By the way, can I monitor process while I debugging it with ida?
0
votes
0answers
40 views

Does anyone have experience with ida DECOMPILER (not disassembler) for 64 bit? Is it worth $3k? [closed]

It’s hard to find reviews or any info on the 64 bit decompilier. Thanks!
2
votes
0answers
41 views

How should I got about working out the format for this psp game?

I have been attempting to reverse engineer a format for a visual novel psp game ('Mirai Nikki RE: WRITE - 13 Ninme No Nikki Shoyuusha') and I have come to the understanding that the format works as a ...
0
votes
1answer
62 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
-2
votes
0answers
16 views

How do I network fuzz my custom binary on network using Radamsa? [closed]

There is very little documentation on how to fuzz the network (e.g. 127.0.0.1:80) and would like to harden my binary on the network and run some test cases here and there and learn a bit more about ...
-2
votes
0answers
55 views

PIE bypass in /system/bin/linker [closed]

I tried to remove PIE error from my linker by this manual, but I can not find "data xref" line near this error. What to do? .rodata:0000B1F9 aErrorOnlyPosit DCB "error: only position independent ...
-2
votes
0answers
33 views

Is it can expand? , IDA Locals menu

I want to find a specific value in locals. (Child of context) But the context is too deep , So, is there any way to automatically expand it or extract it with csv?
1
vote
1answer
50 views

Finding RegisterNatives function calls in JNI_OnLoad's assembly code

My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with AAAAAAAA <JNI_OnLoad@@...
1
vote
0answers
31 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
0answers
36 views

problem with adding TitanHide to x64dbg

I am new and I have a simple problem. Can someone tell me how to add TitanHide to x64dbg? I found this: How can i add plugins in x64dbg? but i guess in case of TitanHide it's harder. Thanks for help....
1
vote
1answer
57 views

How to find a memory address of variable? [Radare2]

This question seems so basic but I have spent 5+ hours trying to figure it out. I have written a program in C++ that defines a few variables and does some other stuff. What I want to do is be able to ...
2
votes
1answer
43 views

Does x64dbg display the whole memory info even for a simple program opened?

I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below. #include <stdio.h> void main() { int x, y, z; while(...
1
vote
2answers
69 views

Comparison between orginal and modified DLL files with x64dbg

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg? And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
2
votes
1answer
42 views

extract zImage from MS-DOS executable

I have an aarch64 kernel image with the following magic number: root@localhost:/# cat msImage|xxd -l4 00000000: 4d5a 0091 MZ.. root@localhost:/# file msImage ...
1
vote
2answers
48 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
0
votes
1answer
43 views

Why code subtracts 60 from esp when the length of the variable is 64

I was following a tutorial that introduced stack overflows. Here is the c Code. #include <stdlib.h> #include <unistd.h> #include <stdio.h> int main(int argc, char **argv) { ...
-1
votes
0answers
24 views

Reverse 6531E Chip flash/firmware [closed]

I have a feature phone and It has the phenomenon of sending messages and internet access illegally. I want to reverse it to know. Now I had a flash of this phone, but I don't know structure of this ...
0
votes
1answer
85 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
2
votes
2answers
52 views

Win32 SEH address

I have read this kind of code in some tutorials : push handler ; Address of handler function push FS:[0] ; Address of previous handler mov FS:[0],ESP ; Install new Handler I do not understand ...
0
votes
0answers
27 views

debugger trap with angr

Let's suppose this (very ugly) c code: #include <stdio.h> #include <string.h> #include <signal.h> char sav_argv[100]; void on_sigtrap(int signo) { if (strcmp(sav_argv, "hello")...
1
vote
0answers
27 views

Missing Map from Java Native Method to C Code

When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
0
votes
0answers
26 views

Hooking with angr

I have created and compiled a very basic c program which displays a message with printf. I have compiled a 64 bits PIE elf binary. I want to learn how works angr analysis tool. I have written this ...
2
votes
3answers
138 views

What does ds mean in mov instruction?

I am reversing a 32-bits ELF executable. I see something like: mov al, byte ptr ds:xxxxx xxxxx is an absolute address. What is the meaning of ds here?
0
votes
1answer
38 views

multiple base addresses?

I'm quite new to reverse engineering and I'm currently trying things out on a game called Assault Cube. What I've done so far is finding offsets to my players health, ammo, name, etc.. When doing so I'...
5
votes
1answer
46 views

Passing a (string) argument via the return address?

I'm debugging an old PC BIOS and it has most of its constant strings interspersed directly with the code, like this: As the comment notes, the function putsc will take the string as its argument, ...
1
vote
1answer
59 views

Generate this assembly from a c program

I want to generate this assembly code: mov ecx, <absolute address of func1> call ecx How can I write and compile C code which generates this code?
2
votes
1answer
61 views

Why are these 0-byte jumps used as a delay?

I'm debugging an old PC BIOS and see a lot of what I assume are delay sequences, using 0-byte jump instructions (EB 00 = jmp short $+2). Why this particular instruction? I'm guessing it must have ...
2
votes
1answer
74 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...

15 30 50 per page