Skip to main content

Questions tagged [networking]

Any kind of communication between computers using a protocol and the infra-structure that allow this communication.

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

What Kind of BLE Handshake is This?

I have a peripheral to which I am trying to connect over BLE. I do not have access to the internals of the peripheral, though I do know it is using a TI CC2540 chip for its BLE implementation (not ...
fbrereto's user avatar
  • 101
0 votes
0 answers
40 views

What is the protocol used in those datas?

I am currently working on analyzing packet exchanges between a computer and an access control system. At present, the computer and this access control system require an intermediary software to ...
Clarface's user avatar
0 votes
0 answers
34 views

Getting corrupted video stream when Reverse Engineering UDP video stream from cheap Indian WiFi camera Drone

enter link description here I have this Quadcopter "Garuda" that can stream video to an Android APP named VS FPV PRO over wifi. I wanted to receive the video stream on my laptop to run some ...
Anish N.'s user avatar
0 votes
0 answers
76 views

How to decrypt and analyse data from desktop application

I have a project where I need to analyse some data from a desktop application (WeChat) on Windows. More specifically, I am looking to extract URLs when I search for articles using a particular keyword....
Nico's user avatar
  • 1
0 votes
0 answers
51 views

Reverse engineering MQTT payload in a (apparently) sophisticated smart lamp

Background I have recently bought a (quite expensive) smart lamp. It is not from a known producer, it's a relatively small company, but they seem to have implemented MQTT in a quite serious way. ...
user3161330's user avatar
0 votes
1 answer
89 views

How would you go about understanding the networking of a game and doing your own server?

I'm trying to reverse the network of a game. The commands are strings, however, it's not as easy as getting the function that encrypts the packet, as it's not encrypted, just encoded in its own way, ...
felipebubu's user avatar
0 votes
0 answers
85 views

Reverse engineering Microsoft Teams web invisible incoming messages

I'm currently looking to inspect the network traffic in Chrome when I receieve incoming messages in microsoft teams, but i can't point out where or how is Teams getting the messages from. When I load ...
chubakueno's user avatar
0 votes
0 answers
29 views

missing caller function in call stack

I'm trying to intercept and locate tcp packets in memory through debugging of windows 10. Suppose I set a break point at TcpReceive, the call stack looks like this kd> kc # Call Site tcpip!...
anonymous bear's user avatar
1 vote
0 answers
183 views

How can I extract the timestamp from this bytestring?

I am missing a piece of the puzzle that is the TCP protocol the Battlefield Bad Company games use to transfer dogtag records to/from the FESL backend. The general packet structure is quite clear and I ...
cetteup's user avatar
  • 11
4 votes
2 answers
290 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
Luca D'Amico's user avatar
4 votes
0 answers
605 views

Decoding the Apple vendor tag in the 802.11 beacon

Background Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
thewade's user avatar
  • 41
2 votes
0 answers
33 views

How to re-create media file from android sender output stream

I would like to perform dynamic analysis on some android apps to check if these apps sending metadata with media files or not. Ideas like the picture below: Step 1: I prepared an image with metadata (...
ThanhLam112358's user avatar
2 votes
0 answers
629 views

Understanding gRPC message

Problem I intercepted a gRPC network request from an application, and I intend to modify the contents and resend the message programmatically. As no tools (except for MitmProxy, see below) were able ...
WanderingCoder's user avatar
2 votes
0 answers
135 views

Where is Zyxel nas326 system log files. and how to see failed login ip

Does anyone know where is log files in the Zyxel nas326? I want to send failed tcp login ip to my server so I know if someone is logging in to my nas and I can block the ip.
UDC's user avatar
  • 31
0 votes
1 answer
191 views

Identifying the source of encryption used by UDP packets in a PCAP file

I have a PCAP file (mediafire link to the file) which basically represents packet captures between 2 machines running the same game connected to each other via LAN inside RPCS3 using RPCN. One of ...
PirateApp's user avatar
  • 103
2 votes
0 answers
92 views

Help MMO Tcp Packet

I'm trying re-send the packets that an MMO sends to the server just to learn more about packets. The game uses TCP. I sent the same message in the game chat "oi" to analyze the packages sent ...
Rck_'s user avatar
  • 21
0 votes
1 answer
180 views

Interpreting Response for Modbus/TCP function code 0x08 Diagnostics

A client application sends a Modbus 0x08 diagnostics query to Schneider modicun PLC over TCP/IP. The software describes itself as designed for Modicon Micro/Compact/Quantum/Momentum/584/984. Payload ...
chentiangemalc's user avatar
1 vote
2 answers
190 views

What is the best approach to reverse a custom TCP Application Layer?

I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump. What is the best approach to reverse the custom application layer? Some data seems to be ascii ...
Leander 's user avatar
1 vote
1 answer
715 views

Decoding API response of unknown encoding?

I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go ...
Nerdsie's user avatar
  • 11
1 vote
0 answers
299 views

Warframe Network Communication

Warframe is a MMO that has both servers and peer to peer networking, I am looking into the server side of things. What I am wanting to achieve is client communication to a emulated server. So far I am ...
BB TheB's user avatar
  • 11
2 votes
2 answers
105 views

Trying to reverse web application connection, but the network tab shows nothing

I've been checking out metaverse-sensation Decentraland (play.decentraland.org) and I'm interested in how they've implemented the massive multiplayer netcode to work well for tens of players at the ...
sigmaxf's user avatar
  • 155
2 votes
0 answers
142 views

Twitter scraping using Python

I've been working on a project to reverse-enginner twitter's app to scrape public posts from Twitter using an unofficial API, with Python. (I want to create an "alternative" app, which is ...
TripleS's user avatar
  • 21
0 votes
0 answers
84 views

SSL pinning deep problem

I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
TrueStar's user avatar
1 vote
0 answers
1k views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
TrueStar's user avatar
1 vote
3 answers
2k views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
Muhammad Yasir's user avatar
1 vote
2 answers
670 views

Identifying hosts on a network with no DHCP

I have a router with an unknown IP address with no functioning DHCP server. I have to connect to the router using a static (non-DHCP) IP (I have tried several including 192.168.1.10). The link LED ...
moo's user avatar
  • 111
1 vote
0 answers
47 views

API-Monitor not logging buffer

I have a problem with API-Monitor. When I try to capture data (here: network traffic), API-Monitor doesn't log the buffer from the recieved data. For send() it works well, but for recv() it doesn't ...
Trac3r's user avatar
  • 31
1 vote
1 answer
280 views

How to read data from android.car.cluster

While performing a vulnerability scan for open ports of an Android Automotive Infotainment system, I found out that port 5151 is open. Doing a netcat on the open port, reveals a continuous stream of ...
gst's user avatar
  • 111
1 vote
1 answer
152 views

Inbound network queries not appearing in developer tools of browser

When trying to understand the behavior of web apps, I find myself stumbling against the fact that some network messages do not appear on the network tab of the web developer tool of the browser. For ...
DevShark's user avatar
  • 111
1 vote
0 answers
104 views

Restoring online functionality of an obsucure Korean PS2 horror game

Last year I posted for help in order to reverse-engineer and translate a Korean exclusive Horror game for the Playstation 2 called Mystic Nights. Here is the Original Post. Thanks to the kind folks ...
Shpack's user avatar
  • 43
0 votes
1 answer
61 views

What browser do during initial web page request?

I am trying to understand why if I do fetch() 4 times on the active web page, after the fifth fetch server returns response that I am a "robot" I am using google chrome I go the following ...
simply good's user avatar
1 vote
1 answer
303 views

Spoofing DNS to intercept iot traffic

I've got a bunch of IoT devices that can only be controlled through the Internet, as all their traffic goes through their own "cloud" server. I want to reclaim full control and low latency ...
dotvav's user avatar
  • 131
0 votes
0 answers
173 views

Where are private keys for Google Play stored on an android device?

I am running an application in BlueStacks that was installed with Google Play and am trying to look at network packets which are encrypted using RSA over TLS. I can see the client key exchange packet ...
REnoob's user avatar
  • 1
1 vote
2 answers
542 views

NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?

I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
leethobbit's user avatar
2 votes
0 answers
641 views

What is the header 'X-Goog-Spatula'?

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not ...
Alexandria's user avatar
0 votes
0 answers
3k views

How to capture specific data packets sent in an online game?

I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
Erdem Tuna's user avatar
1 vote
1 answer
155 views

Which JSON object compact binary serialization is this?

I am trying to reverse engineer an unknown JSON binary serialization format found in a request-response pair between a mobile app, and a server. Does anyone recognize this? I've attached the first ...
Joe's user avatar
  • 11
1 vote
1 answer
206 views

Break when exe send tcp packet

When I debug .exe file with IDA, I want to put a breakpoint before the .exe sends a TCP packet. When I listen with ProcMon I can see that this .exe sends and receives TCP packets. I look at the .exe ...
joif doi's user avatar
0 votes
1 answer
801 views

Determine checksum / CRC algorithm

I am doing reverse engineering on some network protocol. It is client to server communication and I am pretty stuck with identifying checksum (or CRC) algorithm used in packet structure. I tried ...
Tomas's user avatar
  • 1
1 vote
1 answer
187 views

Encoding method of float

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and ...
Ojs's user avatar
  • 203
1 vote
1 answer
213 views

Difficulty obtaining malware traffic

I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
solumnant's user avatar
  • 173
3 votes
0 answers
84 views

Can a device be forced to stop using SSL? [closed]

Lately I’ve become interested in reverse-engineering the APIs used by the Nintendo Switch Online (NSO) services (especially to see if it would be plausible for me to access their Mario Maker 2 API ...
JBagel's user avatar
  • 31
1 vote
0 answers
253 views

Intercept traffic from exe to my Java server

In Windows 10, I can easily intercept traffic of an application using Proxifier and route it to Charles proxy, so that I can inspect and edit the data. exe -> Proxifier (Socks proxy to localhost:...
Saturnix's user avatar
  • 151
1 vote
1 answer
996 views

Windows : Which process sent TCP/IP packet?

How do I find out which process has sent TCP/IP network packet? Are there some tools that can easily do this? Like in Linux.
guest's user avatar
  • 11
0 votes
2 answers
2k views

How to breakpoint exe tcp packet

I am debugging an executable in windows with IDA. My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function ...
Keystone's user avatar
  • 523
3 votes
1 answer
392 views

What Checksum/CRC algorithm in RF packet?

I am banging my head to figure out the checksum of a RF device, it seems to be a simple one but no luck so far... The first 3 bytes is the SyncWord then 9 bytes is the payload and the last byte ...
Rácz Attila's user avatar
1 vote
1 answer
1k views

Reverse engineer CAN-Bus checksum

I am trying to figure out a checksum algorithm. D1 to D6 is data, D7 is a counter obviously and byte 8 must be a CRC, but I didnt have any idea on how to build it. Tried to check if it fits any ...
mike's user avatar
  • 11
1 vote
1 answer
718 views

Network support when emulating firmware with QEMU

Continuing from this question: Firmware analysis and file system extraction? I am trying to run the QNap firmware using QEmu. I have basically the same firmware as is used in the question above. My ...
extremecoder85's user avatar
2 votes
1 answer
511 views

DGA(Domain Generation Algorithm) based malware files

Where i can get DGA (Domain Generation Algorithm) based malware files for analysis? And,Can I get malware family names which is using Domain Generation Algorithm?
xoreax's user avatar
  • 121
3 votes
1 answer
691 views

How to debug packet processing with overlapped socket on Windows

The problem is quite complex so i don't want to run into unneccessary details. I have a network application, that communicates with multiple clients at once via UDP. I haven't written it and there is ...
Youda008's user avatar
  • 141