Skip to main content

Questions tagged [hex]

Format in which is visualized the memory content or the variables while memory inspection. Hexadecimal (or 'hex') represents integers in base 16 (with digits taken within `0`-`9` and `a`-`f`).

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

The dumb dvr performs factory settings automatically and does not save the settings

I have a DVR device from Hikvision that does not save any changes or settings, and when it is restarted, it returns to the factory state... I tried another dump, not from the same brand name, and it ...
2 votes
1 answer
67 views

Keycode from a serial PDA keyboard (iPAQ G750)

I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
0 votes
1 answer
158 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
0 votes
0 answers
60 views

How to replicate this encoding algorithm

I am writing a helper script at work for when new people start work and need help setting up respective applications - the application will write configuration files to be loaded into the various ...
0 votes
0 answers
72 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
0 votes
0 answers
148 views

Disassembling an executable that is packaged with vercel's pkg

I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
0 votes
2 answers
117 views

I don't understand this hexeditor output

I'm trying extract .wav files from a datafile, and each file has some metadata at the end of it. It contains a date, '1996-05-16' as shown here: Most of these dates for the files are correct, but ...
2 votes
0 answers
292 views

Help Needed With Finding Image Data In DOS Game File

I have been analysing, an File called FW190AS.PAC from a 16 Bit Game called Secret Weapons Of The Luftwaffe, in a Hex Editor, the Bytes are displayed in Little Endian format. My aim with this game, is ...
1 vote
1 answer
698 views

Get friendly disassemble hex file

I'd like to know if there is a way to have a more friendly way to get disassemble hex file coming from Adafruit board. Let me explain actually I'm working with Adafruit feather 32u4 running with ...
2 votes
0 answers
111 views

Merge HEX file into existing ELF file in ghidra

I have an Infineon Tricore ELF file. I have a HEX file that has been patched with minor changes and new code appended (e.g. the hex from the ELF was exported and then had changes made to it manually ...
1 vote
0 answers
76 views

Making an exe file to recognize the Persian/Arabic characters

So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian). Thus I changed it at first Hex Editing using HxD ...
2 votes
1 answer
959 views

Checksum in CANbus Message

I'm trying to work out the calculation method for a checksum in a CAN message but I'm having some difficulties. I am unsure if there are actually 4 separate checksums, or one big one at the end of ...
3 votes
1 answer
625 views

Decipher variable length serial protocol

I have an ebike consisting of a controller which regulates power to the motor and a smart LCD which can adjust max speed, power output, pedal assist sensitivity etc as well as displaying the current ...
0 votes
1 answer
254 views

Editing Binary File with Hex Editor

If I edit out and replace four bytes of a binary file with 00 00 00 00 and the binary crashes when it runs does it mean that there is some sort of security protection? How likely is it that the crash ...
0 votes
1 answer
924 views

Hexedit / Ghidra Byte Viewer wont allow deletion of bytes

I was playing around with some golang code I wrote, and I modified the Go BuildID. However, I had to pad whatever I wanted the buildID to be with characters so that it was the length of the original ...
2 votes
1 answer
813 views

Unpack .apk file from a PC game (NOT Android related)

I have an old PC game called Air Strike 3D II. I wanted to extract music files but I couldn't figure out how to unpack the .apk file (NOT Android package). 7-zip can't open it. When I open the .apk ...
2 votes
0 answers
2k views

Differences between hex-editor and Ghidra and how to find strings

I just started playing around with reverse engineering and Ghidra, so please bear with me. I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
0 votes
1 answer
352 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
0 votes
1 answer
268 views

Stuck in finding the algorithm of a save game file CRC/checksum

A sample message-CRC pair looks like this: 00000005 00000000 12121212 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 2F8376FE ...
-1 votes
2 answers
725 views

IDA hex != String

, Hello. to learn reverse engineering, I would like to simply change a string via IDA. I select my string, get the adress, and select Change Bytes to get the Hex value : After That, I try to convert ...
1 vote
0 answers
226 views

How do I align a memory dump hex file so that a pointer address matches its location in the memory dump file?

I'm learning C and trying to understand how things like buffer overflows and other memory issues work. I am doing this on Windows for convenience reasons but would have no problem doing it on WSL or a ...
1 vote
1 answer
1k views

Router flash dump unknown filesystem

I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company. Data has been extracted (using ...
1 vote
2 answers
190 views

What is the best approach to reverse a custom TCP Application Layer?

I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump. What is the best approach to reverse the custom application layer? Some data seems to be ascii ...
2 votes
0 answers
195 views

Hex string to number

I am trying to reverse engineer a datalogger file (parker .scpo I believe). I think it must be a 16bit format but I cant get the numbers to line up. Data is stored in the form of a hex string I ...
0 votes
1 answer
2k views

Why 0x90 byte is always at top of my file?

Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest. Back to the topic, I have a python file which I obfuscated it and anytime I ...
1 vote
1 answer
222 views

Making sense of an encoded JSON string

I extracted a game file, which is in JSON format, it's a bit too long, so I'll omit parts of it: {name: "\xEE\xB5k~u\u03D7\x80\xF8\xE0\xE2\xC5\xCA\xEE\u04CF\x90\xBE\xD8Cs\xFE\xA5Ec\u007F\u0006\...
2 votes
2 answers
442 views

HEX code to call DLL function

I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
0 votes
2 answers
250 views

IDA/Olly changing address bytes after patch during debugging on x86

I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing: BE E4732201 MOV ESI,App.012273E4 should ...
4 votes
1 answer
1k views

Deciphering the format of an unknown file

I am attempting to discover the exact format/encoding of a file. These files stem from closed-source analysis software we use on a daily basis. I would like to obtain the format in order to create an ...
1 vote
1 answer
1k views

How does Cheat Engine offset calculation work?

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number. IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C; /...
18 votes
1 answer
24k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
0 votes
2 answers
168 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
1 vote
1 answer
153 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
0 votes
1 answer
93 views

Strategies for Deciphering RS-232 Data

I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port. I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
1 vote
0 answers
133 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
2 votes
1 answer
145 views

How to determine a type of binary serialization?

I'm trying to analyze the messages that the game sends to the server through WebSockets. I have a simple WebSockets proxy that stands in the middle and prints all messages to the console. I noticed ...
1 vote
0 answers
349 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
-2 votes
2 answers
1k views

CyberChef Challenge #21

The challenge data/input is: ...
0 votes
1 answer
99 views

how to calculate a byte value

We are reversing the method of creating a byte array packet. These values are obtained by serialport monitor from mediatek metamode usb port.The values of both packets are changed by changing the imei....
-1 votes
1 answer
1k views

what is best forum to ask about hex reversing? [closed]

i want to create c script extract encrypt package. just can open it in hex editor to view and need knowledge and technique for write script for extract it. Script will work in command-line ( window 10 ...
0 votes
2 answers
205 views

Convert series of hex digits represented as ASCII-characters stored in a .txt file to raw bytes

I recently extracted a bunch of raw bytes (from wireshark) into a regular .txt file. Because these raw bytes are stored in a text file, all those hex-digits are actually written as ASCII characters ...
2 votes
1 answer
631 views

Decoding Hex Data

I'm trying to decode .PLW data acquired by a temperature logger (PicoLog PT-104). If you convert the .PLW file to a .txt file through the official software you get something like this: where each row ...
6 votes
1 answer
1k views

Issues with reversing LZSS compression algorithm

I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this: I noticed a pattern that ...
1 vote
1 answer
68 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
4 votes
1 answer
5k views

Finding, hex-editing date timestamp to correct it

Trying hex-editing to fix the date-time data in file which was generated while the computer system clock was wrong. Some tutorial will be helpful appreciated after my attempts so far. [screen shot ...
3 votes
1 answer
12k views

Making changes in ELF file after dissassembly [duplicate]

I am new to reverse engineering and after some research, I haven't found a clear way to do what I want to do. I have an ELF file, but not the original source code that generated it. It is really ...
1 vote
1 answer
346 views

Hex editing a program to change variable types

For starters guys please don't get mad at me because I really googled this question for a while and couldn't find a satisfying answer. Also if I'm asking an idiotic question, I apologize beforehand. ...
1 vote
1 answer
546 views

Passing hex strings to Radare2

I can quickly test hex string arguments in gdb like this: r $'\x61\x61\x61\x61' I'd like to do something similar in radare2 but all I can figure out is regular strings: doo aaaa I tried this but ...
7 votes
1 answer
2k views

Reverse engineering Earthsiege 2 3D model format

As a personal project I've been trying to reverse engineer the art assets for the old Dynamix game Earthsiege 2 (this game has long been abandonware and was recently released for free by Hi-Rez, the ...
4 votes
0 answers
93 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....