Skip to main content

Questions tagged [hex]

Format in which is visualized the memory content or the variables while memory inspection. Hexadecimal (or 'hex') represents integers in base 16 (with digits taken within `0`-`9` and `a`-`f`).

Filter by
Sorted by
Tagged with
0 votes
0 answers
60 views

How to replicate this encoding algorithm

I am writing a helper script at work for when new people start work and need help setting up respective applications - the application will write configuration files to be loaded into the various ...
Chokehold's user avatar
0 votes
0 answers
67 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
amoebame's user avatar
2 votes
1 answer
67 views

Keycode from a serial PDA keyboard (iPAQ G750)

I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
Xinming Chen's user avatar
0 votes
1 answer
154 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
Edward Winch's user avatar
0 votes
0 answers
142 views

Disassembling an executable that is packaged with vercel's pkg

I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
Yusuf2020's user avatar
0 votes
2 answers
117 views

I don't understand this hexeditor output

I'm trying extract .wav files from a datafile, and each file has some metadata at the end of it. It contains a date, '1996-05-16' as shown here: Most of these dates for the files are correct, but ...
Oli's user avatar
  • 133
2 votes
0 answers
292 views

Help Needed With Finding Image Data In DOS Game File

I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
Edward Winch's user avatar
1 vote
1 answer
682 views

Get friendly disassemble hex file

I'd like to know if there is a way to have a more friendly way to get disassemble hex file coming from Adafruit board. Let me explain actually I'm working with Adafruit feather 32u4 running with ...
simon's user avatar
  • 131
2 votes
0 answers
111 views

Merge HEX file into existing ELF file in ghidra

I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
rollsch's user avatar
  • 253
1 vote
0 answers
76 views

Making an exe file to recognize the Persian/Arabic characters

So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian). Thus I changed it at first Hex Editing using HxD ...
Fariwar Farsian's user avatar
0 votes
1 answer
251 views

Editing Binary File with Hex Editor

If I edit out and replace four bytes of a binary file with 00 00 00 00 and the binary crashes when it runs does it mean that there is some sort of security protection? How likely is it that the crash ...
user avatar
0 votes
1 answer
909 views

Hexedit / Ghidra Byte Viewer wont allow deletion of bytes

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
dcom-launch's user avatar
2 votes
0 answers
2k views

Differences between hex-editor and Ghidra and how to find strings

I just started playing around with reverse engineering and Ghidra, so please bear with me. I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
804b18f832fb419fb142's user avatar
0 votes
1 answer
347 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
securityauditor's user avatar
1 vote
0 answers
224 views

How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?

I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
ChickenOverlord's user avatar
1 vote
2 answers
188 views

What is the best approach to reverse a custom TCP Application Layer?

I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump. What is the best approach to reverse the custom application layer? Some data seems to be ascii ...
Leander 's user avatar
2 votes
0 answers
195 views

Hex string to number

I am trying to reverse engineer a datalogger file (parker .scpo I believe). I think it must be a 16bit format but I cant get the numbers to line up. Data is stored in the form of a hex string I ...
L Selter's user avatar
  • 121
0 votes
1 answer
2k views

Why 0x90 byte is always at top of my file?

Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest. Back to the topic, I have a python file which I obfuscated it and anytime I ...
RickyLo's user avatar
  • 11
1 vote
1 answer
220 views

Making sense of an encoded JSON string

I extracted a game file, which is in JSON format, it's a bit too long, so I'll omit parts of it: {name: "\xEE\xB5k~u\u03D7\x80\xF8\xE0\xE2\xC5\xCA\xEE\u04CF\x90\xBE\xD8Cs\xFE\xA5Ec\u007F\u0006\...
Agnarsh's user avatar
  • 13
2 votes
2 answers
435 views

HEX code to call DLL function

I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
VIRGO's user avatar
  • 23
0 votes
2 answers
246 views

IDA/Olly changing address bytes after patch during debugging on x86

I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing: BE E4732201 MOV ESI,App.012273E4 should ...
FELIPE_RIBAS's user avatar
4 votes
1 answer
1k views

Deciphering the format of an unknown file

I am attempting to discover the exact format/encoding of a file. These files stem from closed-source analysis software we use on a daily basis. I would like to obtain the format in order to create an ...
wptmdoorn's user avatar
1 vote
1 answer
1k views

How does Cheat Engine offset calculation work?

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number. IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C; /...
Sharki's user avatar
  • 153
0 votes
1 answer
268 views

Stuck in finding the algorithm of a save game file CRC/checksum

A sample message-CRC pair looks like this: 00000005 00000000 12121212 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 2F8376FE ...
Andreu Navarro's user avatar
0 votes
2 answers
167 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
t0astym4rsh's user avatar
1 vote
1 answer
151 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
TefoD's user avatar
  • 13
0 votes
1 answer
93 views

Strategies for Deciphering RS-232 Data

I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port. I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
CragMonkey's user avatar
1 vote
0 answers
133 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
Kevin's user avatar
  • 11
2 votes
1 answer
145 views

How to determine a type of binary serialization?

I'm trying to analyze the messages that the game sends to the server through WebSockets. I have a simple WebSockets proxy that stands in the middle and prints all messages to the console. I noticed ...
Lowder's user avatar
  • 21
1 vote
0 answers
347 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
FileEX's user avatar
  • 11
2 votes
1 answer
937 views

Checksum in CANbus Message

I'm trying to work out the calculation method for a checksum in a CAN message but I'm having some difficulties. I am unsure if there are actually 4 separate checksums, or one big one at the end of ...
RNtech's user avatar
  • 41
0 votes
1 answer
99 views

how to calculate a byte value

We are reversing the method of creating a byte array packet. These values are obtained by serialport monitor from mediatek metamode usb port.The values of both packets are changed by changing the imei....
ILYA20's user avatar
  • 31
-2 votes
2 answers
1k views

CyberChef Challenge #21

The challenge data/input is: ...
CtfLover's user avatar
2 votes
1 answer
626 views

Decoding Hex Data

I'm trying to decode .PLW data acquired by a temperature logger (PicoLog PT-104). If you convert the .PLW file to a .txt file through the official software you get something like this: where each row ...
Alvise's user avatar
  • 23
-1 votes
2 answers
717 views

IDA hex != String

, Hello. to learn reverse engineering, I would like to simply change a string via IDA. I select my string, get the adress, and select Change Bytes to get the Hex value : After That, I try to convert ...
twenty94470's user avatar
0 votes
2 answers
204 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
J.Doe's user avatar
  • 15
1 vote
1 answer
68 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
jlc488's user avatar
  • 113
1 vote
1 answer
344 views

Hex editing a program to change variable types

For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand. ...
FightRay's user avatar
1 vote
1 answer
544 views

Passing hex strings to Radare2

I can quickly test hex string arguments in gdb like this: r $'\x61\x61\x61\x61' I'd like to do something similar in radare2 but all I can figure out is regular strings: doo aaaa I tried this but ...
user avatar
4 votes
0 answers
93 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
InxaneNinja's user avatar
1 vote
0 answers
1k views

How can I see specific memory value by using Hex view in IDA?

I'm about to use IDA pro. I have to access to 0018F42C(EAX) by using Hex view in IDA. Maybe I guess there is EAX value.(String is "happyy", standard input) but Hex view shows me 0018F410 as in screen1....
dkdlek's user avatar
  • 11
0 votes
2 answers
2k views

RSA Decryption? [closed]

I am playing a game in my university where you have different puzzles based on cryptography and now in a puzzle named 'rsa', we have 2 files: 'key', 'secret'. The task for this is to decrypt the ...
C. Cristi's user avatar
  • 101
4 votes
1 answer
178 views

Help with a pointer

Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily. In CheatEngine, 028FA190+374 is pointing to 028F1788. ...
Christian Handest's user avatar
0 votes
1 answer
868 views

Checksum error when flashing modded firmware on embedded device

I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar ...
Dukes Mayonnaise's user avatar
0 votes
1 answer
410 views

How to calculate the checksum algorithm with data captures

I have an obsolete control system that I am trying to write an interface into our new control system. I have spent weeks capturing data and figuring out the addressing, polling commands, point ...
ddctech's user avatar
3 votes
1 answer
618 views

Decipher variable length serial protocol

I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
Mike's user avatar
  • 33
3 votes
1 answer
11k views

Basic question: how to input non-printable hex values in GDB / NC? [duplicate]

I'm working on a CTF challenge that is an introduction to smashing the stack. I have the binary working in GDB, and can overwrite the correct part of the stack with printable characters. The ...
BronzeOtter's user avatar
-1 votes
1 answer
164 views

Understanding what is represented by function pointers to a block of hex

I'm working on a disassembly project for my class where I'm trying to bypass a license check, but when I throw the executable into Binary Ninja this is what I see: And when I look at those pointers, ...
user3213722's user avatar
0 votes
1 answer
440 views

Decoding serial data package

I have an assignment at work, to get information from Jenbacher generator and show values in new SCADA system. It has a B&R CP260 PLC with RS232 port and RS232 to RS485 converter. Currently it’s ...
coddr's user avatar
  • 1
1 vote
1 answer
451 views

Hex timestamp decode

I am trying to decode this hex timestamp: 5A24 B103 73AE --> 02/26/2018 15:45:44 5A24 FC03 83BC --> 02/26/2018 17:00:48 5A24 FE03 93E3 --> 02/26/2018 17:02:58 Data is coming from an old ...
fparaggio's user avatar
  • 133