Questions tagged [hex]
Format in which is visualized the memory content or the variables while memory inspection. Hexadecimal (or 'hex') represents integers in base 16 (with digits taken within `0`-`9` and `a`-`f`).
109
questions
0
votes
0
answers
14
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
0
votes
0
answers
34
views
What does this string mean?
Disclaimer: I am not gonna paste the whole string just in case it contains sensitive data.
The thing is, I have this string I got from a response's payload, and I am trying to understand what it is. I ...
- 1
1
vote
0
answers
20
views
Keycode from a serial PDA keyboard (iPAQ G750)
I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
- 11
0
votes
1
answer
106
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
- 69
0
votes
0
answers
55
views
Disassembling an executable that is packaged with vercel's pkg
I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
- 11
0
votes
2
answers
115
views
I don't understand this hexeditor output
I'm trying extract .wav files from a datafile, and each file has some metadata at the end of it.
It contains a date, '1996-05-16' as shown here:
Most of these dates for the files are correct, but ...
- 123
2
votes
0
answers
282
views
Help Needed With Finding Image Data In DOS Game File
I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
- 69
1
vote
1
answer
457
views
Get friendly disassemble hex file
I'd like to know if there is a way to have a more friendly way to get disassemble hex file coming from Adafruit board.
Let me explain actually I'm working with Adafruit feather 32u4 running with ...
- 131
2
votes
0
answers
89
views
Merge HEX file into existing ELF file in ghidra
I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
- 253
1
vote
0
answers
59
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
0
votes
1
answer
215
views
Editing Binary File with Hex Editor
If I edit out and replace four bytes of a binary file with 00 00 00 00 and the binary crashes when it runs does it mean that there is some sort of security protection? How likely is it that the crash ...
user41618
0
votes
1
answer
669
views
Hexedit / Ghidra Byte Viewer wont allow deletion of bytes
I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
- 175
2
votes
0
answers
1k
views
Differences between hex-editor and Ghidra and how to find strings
I just started playing around with reverse engineering and Ghidra, so please bear with me.
I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
0
votes
1
answer
289
views
Hex editing an IP address of a different length
I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
- 185
1
vote
0
answers
184
views
How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?
I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
- 111
1
vote
2
answers
122
views
What is the best approach to reverse a custom TCP Application Layer?
I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump.
What is the best approach to reverse the custom application layer?
Some data seems to be ascii ...
- 11
2
votes
0
answers
179
views
Hex string to number
I am trying to reverse engineer a datalogger file (parker .scpo I believe).
I think it must be a 16bit format but I cant get the numbers to line up.
Data is stored in the form of a hex string I ...
- 121
0
votes
1
answer
1k
views
Why 0x90 byte is always at top of my file?
Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest.
Back to the topic, I have a python file which I obfuscated it and anytime I ...
- 11
1
vote
1
answer
191
views
Making sense of an encoded JSON string
I extracted a game file, which is in JSON format, it's a bit too long, so I'll omit parts of it:
{name: "\xEE\xB5k~u\u03D7\x80\xF8\xE0\xE2\xC5\xCA\xEE\u04CF\x90\xBE\xD8Cs\xFE\xA5Ec\u007F\u0006\...
- 13
2
votes
2
answers
359
views
HEX code to call DLL function
I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
- 23
0
votes
2
answers
201
views
IDA/Olly changing address bytes after patch during debugging on x86
I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing:
BE E4732201 MOV ESI,App.012273E4
should ...
- 103
4
votes
1
answer
856
views
Deciphering the format of an unknown file
I am attempting to discover the exact format/encoding of a file. These files stem from closed-source analysis software we use on a daily basis. I would like to obtain the format in order to create an ...
- 41
1
vote
1
answer
1k
views
How does Cheat Engine offset calculation work?
I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number.
IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C;
/...
- 153
0
votes
1
answer
246
views
Stuck in finding the algorithm of a save game file CRC/checksum
A sample message-CRC pair looks like this:
00000005 00000000 12121212 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 2F8376FE
...
0
votes
2
answers
138
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
1
vote
1
answer
134
views
Inserting two digits into binary per Hex - without making EXE corrupt
I dont have much knowledge with assemblers. I beg ur pardon in advance.
I need to change an IP address in a win-binary (Net) where the IP its hard-coded.
Just changing the IP with an Hex Editor would ...
- 13
0
votes
1
answer
90
views
Strategies for Deciphering RS-232 Data
I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port.
I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
- 101
1
vote
0
answers
125
views
Unknown binary format (.scp) - No Header
I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
- 11
2
votes
1
answer
138
views
How to determine a type of binary serialization?
I'm trying to analyze the messages that the game sends to the server through WebSockets. I have a simple WebSockets proxy that stands in the middle and prints all messages to the console.
I noticed ...
- 21
1
vote
0
answers
290
views
Editing assembly language to bypass the condition
I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
- 11
2
votes
1
answer
632
views
Checksum in CANbus Message
I'm trying to work out the calculation method for a checksum in a CAN message but I'm having some difficulties.
I am unsure if there are actually 4 separate checksums, or one big one at the end of ...
- 41
0
votes
1
answer
96
views
how to calculate a byte value
We are reversing the method of creating a byte array packet.
These values are obtained by serialport monitor from mediatek metamode usb port.The values of both packets are changed by changing the imei....
- 31
-2
votes
2
answers
1k
views
2
votes
1
answer
543
views
Decoding Hex Data
I'm trying to decode .PLW data acquired by a temperature logger (PicoLog PT-104).
If you convert the .PLW file to a .txt file through the official software you get something like this:
where each row ...
- 23
-1
votes
2
answers
579
views
IDA hex != String
, Hello. to learn reverse engineering, I would like to simply change a string via IDA.
I select my string, get the adress, and select Change Bytes to get the Hex value :
After That, I try to convert ...
0
votes
2
answers
190
views
Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes
I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
- 15
1
vote
1
answer
68
views
I want to modify the data [closed]
I am so newbie about this matter.
I have a file XXXX.record file that contains a data.
When I open the file
How can I read this data and modify the values?
thanks.
- 113
1
vote
1
answer
312
views
Hex editing a program to change variable types
For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand.
...
- 15
1
vote
1
answer
520
views
Passing hex strings to Radare2
I can quickly test hex string arguments in gdb like this:
r $'\x61\x61\x61\x61'
I'd like to do something similar in radare2 but all I can figure out is regular strings:
doo aaaa
I tried this but ...
user28086
4
votes
0
answers
93
views
Any way to edit an ELF binary without hex? [duplicate]
So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way.
I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
- 141
1
vote
0
answers
1k
views
How can I see specific memory value by using Hex view in IDA?
I'm about to use IDA pro.
I have to access to 0018F42C(EAX) by using Hex view in IDA.
Maybe I guess there is EAX value.(String is "happyy", standard input)
but Hex view shows me 0018F410 as in screen1....
- 11
0
votes
2
answers
1k
views
RSA Decryption? [closed]
I am playing a game in my university where you have different puzzles based on cryptography and now in a puzzle named 'rsa', we have 2 files: 'key', 'secret'.
The task for this is to decrypt the ...
- 101
4
votes
1
answer
160
views
Help with a pointer
Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily.
In CheatEngine, 028FA190+374 is pointing to 028F1788. ...
0
votes
1
answer
837
views
Checksum error when flashing modded firmware on embedded device
I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar ...
- 103
0
votes
1
answer
398
views
How to calculate the checksum algorithm with data captures
I have an obsolete control system that I am trying to write an interface into our new control system. I have spent weeks capturing data and figuring out the addressing, polling commands, point ...
- 3
3
votes
1
answer
571
views
Decipher variable length serial protocol
I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
- 33
3
votes
1
answer
11k
views
Basic question: how to input non-printable hex values in GDB / NC? [duplicate]
I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters.
The ...
- 363
-1
votes
1
answer
156
views
Understanding what is represented by function pointers to a block of hex
I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see:
And when I look at those pointers, ...
0
votes
1
answer
436
views
Decoding serial data package
I have an assignment at work, to get information from Jenbacher generator and show values in new SCADA system. It has a B&R CP260 PLC with RS232 port and RS232 to RS485 converter. Currently it’s ...
- 1
1
vote
1
answer
425
views
Hex timestamp decode
I am trying to decode this hex timestamp:
5A24 B103 73AE --> 02/26/2018 15:45:44
5A24 FC03 83BC --> 02/26/2018 17:00:48
5A24 FE03 93E3 --> 02/26/2018 17:02:58
Data is coming from an old ...
- 133