Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

The process of gathering information about a binary file, either with static or dynamic methods.

0
votes
0answers
45 views

IDA doesn't see code

I'm trying to analyze some binary but IDA doesn't see code inside .reloc section. I loaded it manually, changed segment class from DATA to CODE and marked as executable. In 010 Editor these bytes are ...
0
votes
1answer
62 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
60 views

Binwalk does not show anything when process binary

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands binwalk -Me file.bin binwalk --dd='.*' file.bin strings ...
-1
votes
0answers
42 views

Unknown Executable Header

I have this header that's supposed to be the one of an executable file, although running file or binwalk on it simply returns data. Opening it in IDA or any other tool gives only gibberish. Is there ...
6
votes
0answers
78 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
0
votes
1answer
32 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
1
vote
0answers
66 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
0
votes
1answer
87 views

Is this firmware using a substitution cipher?

I'm trying to extract data from a firmware file. I used binwalk on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used strings on the result, which ...
3
votes
2answers
43 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
1
vote
1answer
19 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
1
vote
0answers
40 views

How to make sense of this one pin serial communication

I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
1
vote
0answers
103 views

Unknown Game Client Data

As asking a friend and no amount of Googling yielded an answer, I figured I'd make an account and give this place a go. I'm working on reverse engineering the server for a relatively old game with no ...
4
votes
1answer
98 views

Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?

The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption. Does any one recognize this pattern? Is it maybe some kind of ...
3
votes
1answer
94 views

What are the popular machine learning unsupervised approaches to learning binary data representations?

This is somewhat open-ended question, so bear with me please. Be it a binary payload that you pull from network packet, firmware blob you pull of some EPROM or data intercepted straight from physical ...
3
votes
1answer
56 views

What are the steps to reverse engineering a Shockwave .DCR file?

I have been fascinated by reverse engineering after making several emulators and finding the pret community. I love the idea behind decompiling old games and recreating source code that recompiles ...
3
votes
2answers
134 views

Is pointer decryption possible?

I’m pretty new to reverse engineering, so bear with me... I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
0
votes
0answers
40 views

Identify variable length header encoding

I have a file generated by Microsoft OneNote Online service. It contains a lot of attached binary files and I need to extract all of them. All attachments are stored inside the file in the following ...
-3
votes
1answer
111 views

Identification of AES portion code in binary

I want to locate AES code portion in binary after reverse engineering. I have tried to locate manually and using plugin findcrypt2 but I was not successful. Kindly show me a direction so that I can ...
1
vote
1answer
121 views

r2pipe won't prompt for user input like the binary does in r2 debugger mode

Have a functioning r2pipe script, but there's a need for hitting crtl-c to continue near the breakpoint(not a major issue,) however the script does not pause for input when the crackme asks for user ...
0
votes
1answer
72 views

how to understand branch arm instruction

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? . When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
1
vote
2answers
55 views

How is the IV generated from a timestamp based on this function?

Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
1
vote
1answer
179 views

bypassing anti-VM inside protected samples

This is a good starting point. As you know: Sandboxes and virtual environments (hypervisors) are full of artifacts that betray their analysis environment. Malware can protect itself against these by ...
0
votes
1answer
81 views

IDA Pro Address doesn't correlate to Immunity Debugger address

I'm trying to use immunity debugger to step through a confusing binary. When I open it in IDA Pro, I see certain addresses next to the instructions: .text:01001392 inc eax When I ...
7
votes
2answers
288 views

Radare2 Find command line arguments and location in stack

This might have a simple solution but I can't find it anywhere. $> ./be1 11 AAAAA With gdb, finding argv[] and argc is simple: (gdb) print argv[0]@argc $7 = {0xbffff872 "be1", 0xbffff89a "11", ...
-1
votes
1answer
31 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
0
votes
1answer
35 views

Ldr arm thumb2 must be multiple of 4?

I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4. I run on arm thumb 2 and want run this instruction ldr r0, ...
5
votes
0answers
133 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
0
votes
1answer
49 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
0
votes
2answers
120 views

How to obtain memory address of string literal?

I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
0
votes
1answer
126 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
2
votes
2answers
101 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
1
vote
2answers
74 views

Test malware files in host machine?

To analyze malware files we are using virtual machine and virtual box but some of malware detect the environment and will not do its work properly. I want to know how to test malware files with out ...
0
votes
0answers
89 views

Reversing an APK to replicate API, X-Request-Sign5

I have been reverse engineering an APK in order to create a Desktop client for an app (just for fun to improve my analytical/programming skills). I have, however, hit a snag. Most requests sent to ...
-1
votes
1answer
147 views

Converting object file to LLVM bitcode

Frameworks like mcsema is used to convert an executable file into LLVM bitcode which can be further used to perform program analysis. Is there any way to convert an object file in the similar way?
0
votes
1answer
99 views

reverse engeeneering the 3d file of a game [closed]

I have a problem to find out how to open a file of a game this one seems to have encrypted its files. Currently all I know about the file is that it seems to be a custom 3D file. here is the file ...
1
vote
1answer
186 views

How to add new language to ARM firmware

I have piece of firmware (download from here) and I need to get access to its filesystem. Here is the output of a binwalk scan: root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin ...
3
votes
1answer
169 views

No apparent entry point for stripped, PIE binary using radare2

I am running on 64-bit Windows 7 and am using radare2 to attempt both static and dynamic analysis of a binary executable. The issue is that I cannot seem to find the entry point of where the program ...
0
votes
1answer
40 views

Where Is device specific information kept on smart devices

I am doing a project for school on Emulation of device using its firmware. Using firmadyne, I can start up the smart device unfortunately because it is not a real device, information fields like ...
1
vote
1answer
286 views

Binwalk could not extract the full content

Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files: 360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm I used binwalk to extract content of bin file, ...
0
votes
0answers
34 views

Analyzing game terrain texturing

Recently I've been trying to RE a terrain format from a mobile game. While there are other file types associated with a single world chunk, the terrain file itself seem to contain such info as: - ...
0
votes
0answers
83 views

Understanding static library symbols

I have edited my question and make it more clear by splitting in few subquestions. Why statically linked library does not have symbols on functions ? Why symbols from those libraries exists in main ...
0
votes
0answers
76 views

How to deflate file with unidentified algorithm

I have been getting crazy with this issue since time ago... Here's the file: https://www.sendspace.com/file/lqlvtl Belongs to SH4 embedded device with bootloader, main app, nvram... I found 3 ...
0
votes
1answer
214 views

Identification of D-Link firmware checksum and adding it to OpenWrt firmware

I have this D-Link firmware and would like to identify checksum type used on it and add it to OpenWrt bin file so I could upgrade firmware to OpenWrt instead default crappy D-Link. I did tried to ...
5
votes
2answers
257 views

Flare-ON#3: Problem understanding some parts in the program

I was trying the flare on challenge. When trying the challenge#3 I got into some trouble and could not solve it. After looking into solutions wrote by other I now do know how the program works, but i ...
2
votes
1answer
180 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
1
vote
1answer
263 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
5
votes
3answers
236 views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
1
vote
0answers
116 views

Stack buffer overflow SIGSEGV help

I've been going at this for a couple of days now working through trial and error but I can't seem to pinpoint exactly why I'm still getting a SIGSEGV. Here's the stdout of me stepping through the ...
0
votes
0answers
311 views

Reversing TP Link's TX6610 firmware (header)

I'm working on REing TP Link's TX6610 firmware. I have been able to successfully unpack the files from the firmware by using binwalk (thus the results are not quite accurate). I also have been working ...
1
vote
1answer
1k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?