All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
2 views

Why mov empty block to register?

Why MOV a bunch of 00s to register? I have seen these empty blocks a lot of times being referenced this way.
meemy's user avatar
  • 1
0 votes
0 answers
5 views

Monitor Firmware String extraction

I have Monitor firmware that doesn't recognize by the binwalk and unable to extract file system of it. i want to extract data and string of firmware. anyone have experience please help me
Mickel's user avatar
  • 1
1 vote
0 answers
37 views

Why some anti-debugging/malware does `wmiadap.exe /f /t /r`?

It seems some possibly legit software, but also malware does wmiadap.exe /f /t /r. Apparently it's part of their anti-debugging attempts. (On Linux some such software I've seen drops a coredump_filter ...
got trolled too much this week's user avatar
0 votes
0 answers
15 views

Identify [and maybe reverse] Java obfuscator that generates method names like $$5$S, I1lI1 and ______________ and wraps API calls in static methods?

I'm guessing this is well known to people who deal with this daily, but a google search turns up nothing useful... So, what's the Java obfuscator that produces (or produced) method names like $$5$S, ...
got trolled too much this week's user avatar
0 votes
0 answers
22 views

disassemble a 76F0085 processor

Hello has anyone tried to disassemble a 76f0085 processor for a Denso ecu ? Do you know the ram address ?
Whallab1's user avatar
0 votes
0 answers
44 views

Trying to decode a data structure from a COM structured storage stream

I have a CAD file that is a COM structured storage file. One of the streams in this file contains some configuration data. I can see the ASCII strings that have the descriptions of the data I'm ...
Chris's user avatar
  • 1
0 votes
0 answers
25 views

Serializing and Deserializing XPC objects (xpc_object_t)

As the title suggests, I am interested in serializing/deserializing xpc_object_t type objects. Unfortunately, there does not seem to be an official or private API that supports this in a robust ...
n0ne's user avatar
  • 11
0 votes
0 answers
27 views

I extracted a file from inside the dump that contains the serial number and I need to analyze it

I extracted a file from inside the dump that contains the serial number and I need to analyze it I want to unpack and compress this encrypted file after modifying it
elctro1991's user avatar
0 votes
0 answers
21 views

SENT transmission decoding CRC

I am decoding a SENT transmission (Enhanced serial message format with 12-bit data field and 8-bit message id) for an electronic sensor and have it set up to find each packet of 18 messages and read ...
Electrical Computer Man's user avatar
0 votes
0 answers
42 views

Who is the manufacturer of this HDMI extender

I have a few of these around my house, they have been replaced with better units, but not removed. I know they are HDMI extenders and this is obviously a Receiver. I would like to know who the ...
Rohit Gupta's user avatar
0 votes
0 answers
61 views

Help to identify intermediate language

I have scripts written in PineScript, TradingView's proprietary DSL. Ultimately, Pinescript code gets translated to an intermediate language (IL) presentation, below is an example: PineScript //@...
drbolsen's user avatar
0 votes
0 answers
30 views

Recreating a custom bplist-derivative data type

I am trying to recreate a custom file type used by an iOS app. I analyzed its binary (image below) and it seems to be a bplist00, however I can't inspect it with any tools like plutil. Plutil returns ...
StarWolf's user avatar
1 vote
0 answers
31 views

Old drivers for S2 3650 CI dont work on Windows 11

I have an USB satellite receiver, S2 3650 CI with old drivers. My Q is if I can update the drivers based on the old ones. I have an Original CD with software + drivers, and firmware for the device. My ...
Donna's user avatar
  • 11
1 vote
0 answers
47 views

How to make a program start in Tray with reverse engineering?

The icon is already displayed in Tray. So maybe to block appearing the window only for launch. Or some nicer approach like switching launch parameters in exe (not available in the program settings). ...
oleedd's user avatar
  • 173
0 votes
1 answer
56 views

Is this a Bank security device?

I just found it at the back of my drawers. We started using the online banking before internet and had similar devices for security. They were replaced, possibly with these. I just want to decide if ...
Rohit Gupta's user avatar
1 vote
1 answer
35 views

Is there a way to check how much of GB was written to hiberfil.sys (windows hibernation file)?

I switched from intel macbook to M3 for development work. The Intel one is used now by my wife for generic stuff, powered by Windows. The thing is that it has plenty of RAM, 64GB, way more than she ...
nachrichten's user avatar
1 vote
0 answers
20 views

Differences between Mach Services and XPC Services in macOS Sandbox Profiles

I am trying to learn more about IPC implementations (mach/xpc) and how corresponding services are managed using sandbox profiles on macOS. After looking at many different profiles, I have learned that ...
n0ne's user avatar
  • 11
1 vote
0 answers
24 views

how to logging API call in x64dbg

I want to logging all API calls between two breakpoint. I have tried the trace option but it can not logging API name. Any good plugin achieve this?
qazwsdc's user avatar
  • 11
1 vote
1 answer
36 views

How to find what are all the third party apps used in an android app manually by decompiling an apk

How to find all the Third Party Libraries (TPLs) used in an android app after de-compiling apk using jadx? I have looked at this answer but this is too vague. I can use tools such as Libradar etc. but ...
Vamsi's user avatar
  • 11
1 vote
1 answer
54 views

Sniff Bluetooth traffic using Fitness Tracker

I am attempting to sniff the Bluetooth between the fitness tracker(GOJI ACTIVE GFITBK20 Activity Tracker) and the application(Goji Active) installed on the phone but I am unable to see any health ...
user309729's user avatar
2 votes
1 answer
50 views

What's the best way or approach to debug binary Linux library?

I've got a header file (I know the functions and have some documentation) and a .so file: From a wrapper library and from context, I need to call "Connect", but it does not work, just fails ...
Harry Blauberg's user avatar
0 votes
1 answer
55 views

ARM64 RE Questions

I have a chunk of ARM code which I am trying to make sense of. I'm new to ARM, so would appreciate some help figuring this piece out. I have added some comments to show my progress so far. My ...
BobNewby's user avatar
2 votes
1 answer
60 views

Firmware extraction of U-boot : No filesystem found via binwalk + relation between MTD partitionning and NAND subsystem

I recently extracted the firmware (u-boot system) from an old Sagemcom router and analyzed it using the binwalk utility for a personal reverse engineering project. Despite identifying a root ...
user372517's user avatar
1 vote
0 answers
39 views

Malware analysis windows file

During malware analysis , I was examining the sample in the cloud-service , but the clipboard copy was working from cloud machine to my local system. I believe there will be problem will happen when ...
Muthuji's user avatar
  • 11
1 vote
1 answer
55 views

C disassembly - biwise operations with 0x7FFFFFFFFFFFFFFF and 0x8000000000000000

I am using IDA to reverse engineer x86_64 binary file written in C. And pretty often I meet the following in IDA's pseudocode: (int64)v7 | 0x8000000000000000LL (int64)v7 & 0x7FFFFFFFFFFFFFFFLL ...
day_that_i_die's user avatar
1 vote
0 answers
33 views

Injecting dll to x86 process above user-virtual-address

First, sorry for my bad english. I have some program that heavely virtualized and doing dll injection behavior. The target process is x86 process and execute in wow64 system. When I saw the target ...
schnabel's user avatar
1 vote
0 answers
19 views

Detect what app uses a comport - potentially for a vmware escape via a comport/named pipe ntoskrnl

How could I diagnose if this named pipe that goes to com1 in vmware (now to a txt file) is malware or a legitimate piece of software? Are there anyways to track what sends data to a comport in windows ...
rollsch's user avatar
  • 263
0 votes
1 answer
104 views

Removing a limit in Notepad

Windows Notepad has a limit: 1024 symbols - max string length. Download link: https://krakenfiles.com/view/uID2gzKW7K/file.html (189 KB) How to find this value to increase or remove? Where is it ...
oleedd's user avatar
  • 173
1 vote
1 answer
96 views

How to decrypt or decode unknown file formats?

I have got a new challange. I hvae some log files that mostly contain android device modem and ap logs. The file extension varies depending on the chipset. There is specific tool provided by the ...
Tinku Hore's user avatar
1 vote
1 answer
104 views

Kawai ES110 - Firmware supplied as MIDI file, what can we do?

The firmware for this digital piano is supplied as a MIDI file with an EasyPlayer.exe (not sure if Wine can run this properly) binary to upload it. I'm wondering if there's a way to get at it's ...
Luke A. Guest's user avatar
0 votes
0 answers
19 views

Dumping all import symbols from x64dbg

I want to export the symbol addresses from all loaded modules in x64dbg. I know I can do this DLL-by-DLL from the Symbols tab (click on one module > right click in table > Copy > Export Table)...
thejoelpatrol's user avatar
0 votes
1 answer
46 views

IDA show decimal values instead of hex and vertical alignment for ELF file

New to de-compiling, want to set up Ida to give best reading experience with ELF files from android phone. I run in following issues: Even though i set Edit > PlugIns > Hex-Rays Decompiler > ...
FunComesFirst's user avatar
0 votes
1 answer
51 views

Decompress NSIS Script Bytecode

In NSIS installers, there is a compiled bytecode blob representing the NSIS script located in the overlay of the executable. The overlay start with flags 0xdeadbeef then "NullsoftInst". The ...
Utkonos's user avatar
  • 138
0 votes
0 answers
27 views

How to unpack LTE modem backuped file via chip programmer

I take a backup for my LTE modem to analyse the firmware on it, because i want to modify for getting "shell connexion" like adb /telnet or ssh on it. On binwalk dump_rout.bin it show this ...
0xnewbie's user avatar
1 vote
2 answers
80 views

How does Rohitab ApiMonitor capture API calls?

When I use EasyHook to hook API calls, the first bytes of the hooked API function are replaced with a so called "trampoline" which is a jump into EasyHook code. For example this is TextOutW ...
Elmue's user avatar
  • 461
2 votes
1 answer
39 views

IDA Remote Debugging and automatically interaction with the process

I am learning IDA and currently working with the debugger. In particular, I want to automate the interaction with my remote binary (from Windows Subsystem Linux - Ubuntu 22.04 instance), like what I ...
Anh Nguyễn Tuấn's user avatar
0 votes
2 answers
73 views

reduce size of executable ELF program

I'm experimenting on patching my hello world program in order to make it smol. I started by reducing the size of the program with the following commands: as --32 ./hello_32.S -o ./hello_32.o ld -...
Yuki San's user avatar
0 votes
0 answers
83 views

Need Help Reverse Engineering this "main.pak" Archive from a Nintendo DS Game

I hope I am in the correct place, so to start I have extracted this archive named "main.pak" from the 2008 Nintendo DS game titled, "SpongeBob SquarePants Featuring Nicktoons - Globs of ...
PenneyMarie24's user avatar
0 votes
0 answers
36 views

The dumb dvr performs factory settings automatically and does not save the settings

I have a DVR device from Hikvision that does not save any changes or settings, and when it is restarted, it returns to the factory state... I tried another dump, not from the same brand name, and it ...
elctro1991's user avatar
0 votes
0 answers
111 views

Most Effective Methods to Master Reverse Engineering

I am excited to begin learning assembly. I intend to learn it to guarantee security assurances when writing code for cryptography. One of the skills I wish to gain are reverse engineering. This is a ...
T. Salim's user avatar
  • 101
0 votes
0 answers
57 views

Help reversing Xilinx firmware

I have a binary file which can be flashed onto a FPGA board That being said, I am trying to reverse this firmware to understand it and just as learning experience After running binwalk; DECIMAL ...
Dennis Solomon's user avatar
0 votes
1 answer
47 views

Deodex Android 5 system app

Speaking of Qualcomm, their phones have the ability to expose a diagnostic/programming port, something many Qualcomm BREW feature phones do. Well, as it turns out, that Alcatel supports the same thing!...
qwerty keyboard's user avatar
3 votes
0 answers
81 views

gain root access to my camera monitor

Edit: I managed to dump the firmware and obtained the root password hash, but there are two hashes. I successfully cracked one, resulting in helpme, but the other one might take a while. However, user:...
NotRin's user avatar
  • 31
1 vote
0 answers
34 views

GDB Struct Deref

Let's say I have a type MyStruct. I would like to check if 40 bytes from the structs start, there is a pointer. If there is, I would like to get the type of that pointer. Is there a way to do that ? I ...
098029384098's user avatar
2 votes
1 answer
78 views

WinDbg command to retrieve TTBR registers for Aarch64?

Aarch64 architecture has the following registers, that contain physical base addresses for the virtual-to-physical translation tables for different exception levels: TTBR0_EL1, TTBR1_EL1, TTBR0_EL2, ...
c00000fd's user avatar
  • 1,711
0 votes
0 answers
40 views

whats the password after decrypting HG8546M. I cant remember the ISP web credentials

I am trying to get the web UI password of my Huawei ONT, model HG8546M. <X_HW_WebUserInfoInstance InstanceID="1" UserName="root" Password="ae...49" UserLevel="1&...
Victor Mutisya's user avatar
1 vote
0 answers
54 views

UPX anti unpacking (upx -d)

To start, I know that there is a post on this platform from 2013 that asked the same question but since it's been a while, I will ask it again. A few months back I recall to find a github repo / ...
Adrian Van den Broeck's user avatar
3 votes
1 answer
111 views

Ghidra is missing known code sections found in Binary Ninja. What settings to change in analysis?

I am studying binary lifting and the impacts of intermediate language representations. I have a binary that is an x86 PE file with a stripped header. I have many of these files so I need a more sample ...
Teijen's user avatar
  • 31
0 votes
0 answers
47 views

How to get which Tedit is referenced when retrieving text

Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv Now, the two parameters for the function are: LEA param_2=>local_8,[EBP + -0x4] MOV param_1,...
mark's user avatar
  • 1
0 votes
0 answers
42 views

Find Dereference And Write to Offset of Pointer

I want to find objects within a large C++ codebase that have a function that writes to 16 bytes offset off a pointer stored in an instance variable. So for example given the code has: MyClass object1 =...
098029384098's user avatar

15 30 50 per page
1
2 3 4 5
196