Questions tagged [hex]

Format in which is visualized the memory content or the variables while memory inspection. Hexadecimal (or 'hex') represents integers in base 16 (with digits taken within `0`-`9` and `a`-`f`).

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

Editing Binary File with Hex Editor

If I edit out and replace four bytes of a binary file with 00 00 00 00 and the binary crashes when it runs does it mean that there is some sort of security protection? How likely is it that the crash ...
0 votes
1 answer
53 views

Hexedit / Ghidra Byte Viewer wont allow deletion of bytes

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
1 vote
0 answers
136 views

Differences between hex-editor and Ghidra and how to find strings

I just started playing around with reverse engineering and Ghidra, so please bear with me. I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
0 votes
1 answer
80 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
1 vote
0 answers
57 views

How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?

I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
1 vote
2 answers
77 views

What is the best approach to reverse a custom TCP Application Layer?

I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump. What is the best approach to reverse the custom application layer? Some data seems to be ascii ...
1 vote
0 answers
67 views

Hex string to number

I am trying to reverse engineer a datalogger file (parker .scpo I believe). I think it must be a 16bit format but I cant get the numbers to line up. Data is stored in the form of a hex string I ...
  • 111
0 votes
1 answer
364 views

Why 0x90 byte is always at top of my file?

Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest. Back to the topic, I have a python file which I obfuscated it and anytime I ...
1 vote
1 answer
129 views

Making sense of an encoded JSON string

I extracted a game file, which is in JSON format, it's a bit too long, so I'll omit parts of it: {name: "\xEE\xB5k~u\u03D7\x80\xF8\xE0\xE2\xC5\xCA\xEE\u04CF\x90\xBE\xD8Cs\xFE\xA5Ec\u007F\u0006\...
  • 13
2 votes
2 answers
145 views

HEX code to call DLL function

I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
  • 23
0 votes
2 answers
91 views

IDA/Olly changing address bytes after patch during debugging on x86

I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing: BE E4732201 MOV ESI,App.012273E4 should ...
3 votes
1 answer
294 views

Deciphering the format of an unknown file

I am attempting to discover the exact format/encoding of a file. These files stem from closed-source analysis software we use on a daily basis. I would like to obtain the format in order to create an ...
1 vote
1 answer
334 views

How does Cheat Engine offset calculation work?

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number. IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C; /...
  • 153
0 votes
1 answer
154 views

Stuck in finding the algorithm of a save game file CRC/checksum

A sample message-CRC pair looks like this: 00000005 00000000 12121212 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 2F8376FE ...
0 votes
2 answers
73 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
1 vote
1 answer
79 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
  • 13
0 votes
1 answer
84 views

Strategies for Deciphering RS-232 Data

I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port. I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
1 vote
0 answers
84 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
  • 11
2 votes
1 answer
100 views

How to determine a type of binary serialization?

I'm trying to analyze the messages that the game sends to the server through WebSockets. I have a simple WebSockets proxy that stands in the middle and prints all messages to the console. I noticed ...
  • 21
0 votes
0 answers
91 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
  • 1
0 votes
1 answer
279 views

Checksum in CANbus Message

I'm trying to work out the calculation method for a checksum in a CAN message but I'm having some difficulties. I am unsure if there are actually 4 separate checksums, or one big one at the end of ...
  • 21
0 votes
1 answer
72 views

how to calculate a byte value

We are reversing the method of creating a byte array packet. These values are obtained by serialport monitor from mediatek metamode usb port.The values of both packets are changed by changing the imei....
  • 31
-2 votes
2 answers
775 views

CyberChef Challenge #21

The challenge data/input is: ...
2 votes
1 answer
260 views

Decoding Hex Data

I'm trying to decode .PLW data acquired by a temperature logger (PicoLog PT-104). If you convert the .PLW file to a .txt file through the official software you get something like this: where each row ...
  • 23
-1 votes
2 answers
331 views

IDA hex != String

, Hello. to learn reverse engineering, I would like to simply change a string via IDA. I select my string, get the adress, and select Change Bytes to get the Hex value : After That, I try to convert ...
0 votes
2 answers
155 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
  • 15
1 vote
1 answer
67 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
  • 113
1 vote
1 answer
210 views

Hex editing a program to change variable types

For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand. ...
1 vote
1 answer
372 views

Passing hex strings to Radare2

I can quickly test hex string arguments in gdb like this: r $'\x61\x61\x61\x61' I'd like to do something similar in radare2 but all I can figure out is regular strings: doo aaaa I tried this but ...
's user avatar
3 votes
0 answers
92 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
1 vote
0 answers
662 views

How can I see specific memory value by using Hex view in IDA?

I'm about to use IDA pro. I have to access to 0018F42C(EAX) by using Hex view in IDA. Maybe I guess there is EAX value.(String is "happyy", standard input) but Hex view shows me 0018F410 as in screen1....
  • 11
0 votes
2 answers
1k views

RSA Decryption? [closed]

I am playing a game in my university where you have different puzzles based on cryptography and now in a puzzle named 'rsa', we have 2 files: 'key', 'secret'. The task for this is to decrypt the ...
  • 101
4 votes
1 answer
124 views

Help with a pointer

Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily. In CheatEngine, 028FA190+374 is pointing to 028F1788. ...
0 votes
1 answer
740 views

Checksum error when flashing modded firmware on embedded device

I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar ...
0 votes
1 answer
359 views

How to calculate the checksum algorithm with data captures

I have an obsolete control system that I am trying to write an interface into our new control system. I have spent weeks capturing data and figuring out the addressing, polling commands, point ...
3 votes
1 answer
427 views

Decipher variable length serial protocol

I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
  • 33
3 votes
1 answer
9k views

Basic question: how to input non-printable hex values in GDB / NC? [duplicate]

I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters. The ...
-1 votes
1 answer
138 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
0 votes
1 answer
340 views

Decoding serial data package

I have an assignment at work, to get information from Jenbacher generator and show values in new SCADA system. It has a B&R CP260 PLC with RS232 port and RS232 to RS485 converter. Currently it’s ...
  • 1
1 vote
1 answer
288 views

Hex timestamp decode

I am trying to decode this hex timestamp: 5A24 B103 73AE --> 02/26/2018 15:45:44 5A24 FC03 83BC --> 02/26/2018 17:00:48 5A24 FE03 93E3 --> 02/26/2018 17:02:58 Data is coming from an old ...
  • 133
3 votes
2 answers
882 views

Disassembling Hex to assembly, then what?

I am working on a HEX string, which I figured out is a binary. I would like some pointers on what to do next after I have disassembled from hex to assembly. I'm just assuming that the architecture is ...
6 votes
1 answer
782 views

Issues with reversing LZSS compression algorithm

I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this: I noticed a pattern that ...
  • 73
0 votes
1 answer
136 views

Identifying Checksum?

I bring you either a hard challenge or the easiest challenge you've ever had. I have a save file for this game The first bytes are: F9 29 CE 54 02 4D 71 04 4D 71 00 00 this is the same throughout ...
  • 11
1 vote
0 answers
2k views

Reverse Intel hex to programming code

I have a file in the Intel hex format, which was taken of from a pic16F1705 chip. I need to find a way to disassemble it into some form of human friendly programming language in order to make some ...
  • 11
2 votes
1 answer
2k views

Bypassing av signature with Hex editing

I recently started studying on bypassing AV by finding an AV signature on nc.exe (NetCat) and changing it to see how it works. I have already found the place of signature with splitting method. Then, ...
  • 121
2 votes
1 answer
1k views

File analysis with hexdump - unknown container

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers ...
0 votes
2 answers
186 views

Do .NET functions have function prologs?

If I'm looking at a binary compiled with VC++ in a hex editor and I want to identify the start of functions - I can look for the hex "55 8B" - which is a common function prolog. Is there something ...
  • 125
2 votes
1 answer
387 views

Invalid INDX entries for $I30 on NTFS harddisk

While parsing my NTFS formatted hard disk, I found some invalid entries of INDX while Windows is still able to list all the root directory contents! The structure of the Index Record in NTFS 3.1 is ...
  • 111
1 vote
1 answer
175 views

What does this sequence of numbers mean?

so i'm reversing a file format of game. As far as i can understand the file i'm trying to reverse contains compressed textures. I'm already able to locate the textures and decompress them, but i'm not ...
1 vote
0 answers
265 views

What does the “Offset to the filename” stands for in an Index Record in NTFS

The structure of the Index Record in NTFS 3.1 is clear: Offset Description ------------------------------------- 0x00 MFT Reference of the file 0x08 Size of the index entry 0x0A ...
  • 111