Questions tagged [tools]
Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag.
183
questions
0
votes
1
answer
90
views
Need help understanding why Netflix prevents me from downloading with VPN
When using Netflix via the Windows desktop app with a VPN, streaming movies works fine but downloading does not. The download gets automatically paused, and after a minute it shows error code DL1-...
- 101
1
vote
1
answer
573
views
What are the substantive differences between radare2 and rizin?
Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two.
I understand that Rizin has rewritten ...
- 187
2
votes
2
answers
470
views
UPX Unpacking tool
Firstly, thank you for your answer.
What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.
Thank ...
- 21
2
votes
0
answers
46
views
I want to learn how to program by orienting myself to the task of reverse engineering
I have to learn programming from scratch and I want to orient my learning in order to be able to reverse engineer to break obfuscators. It would be helpful if you could recommend me what languages, ...
- 21
2
votes
0
answers
32
views
Is there a way to run arbitrary code on a vtech Nitro Vision?
Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
- 21
3
votes
0
answers
71
views
Is there a Capturebat alternative on windows 10 for file capture?
I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit.
I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
- 31
1
vote
1
answer
401
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 113
1
vote
0
answers
587
views
Getting helpful information on classes in Ghidra?
I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
- 11
1
vote
1
answer
2k
views
how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?
I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility
...
- 11
1
vote
1
answer
417
views
Binary diff + patching across versions
What are the current options for binary patching which works across different versions of the binary?
E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
- 61
1
vote
0
answers
190
views
Reversing Logitech G933 Battery Charge Values
I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
- 11
1
vote
1
answer
200
views
IDA Pro - How to remove multi-line bit definitions for register
I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
- 13
1
vote
0
answers
530
views
Miasm VS Triton - which to choose? [closed]
Hello and thank you for reading my question,
I was wondering, which is the right tool for me to choose according to the following:
I will be using it mainly for Malware analysis and for exploit ...
- 11
0
votes
0
answers
2k
views
Need Help with decryption backup config.bin file "ZTE ZXHN H267N v1.1"
hi i'm trying to decrypt config.bin file from new router I got from my company, I tried a tool found on github "https://github.com/mkst/zte-config-utility" I got this ERROR:
python3 examples/...
0
votes
1
answer
262
views
modern instrumentation for reversing and researching [closed]
i am really glad i found this great site and wanted to ask from your expertise regarding the following issue:
i have been doing malware analysis and researching for a few years, and i want to learn ...
- 1
0
votes
2
answers
4k
views
Need help with ZTE router config.bin file decryption and encryption
bin file extracted from a ZXHN H168N V3.1. RouterPassView is able to decrypt the file successfully but the tool can't re-encrypt the file, it gave me some info about the method used to decrypt here ...
- 9
3
votes
3
answers
1k
views
Reverse engineering a partially known binary format
I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
- 43
1
vote
1
answer
5k
views
Decompiling Python Files: ValueError
So I have this python file and I successfully unpacked its content inside of it we have our file.pyc
I appended the magic bytes to it so it went from:
E3 00 00 00 00 00 00 00 00 00 00 00 00
to ...
- 51
1
vote
2
answers
178
views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
- 173
5
votes
1
answer
195
views
Review a collection of executable binaries to determine similarity
I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
- 173
-1
votes
1
answer
1k
views
De-obfuscate JS code [closed]
I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc).
I would like to understand it and incorporate some of the code into a personal project. The script ...
- 99
0
votes
0
answers
204
views
Tools for statistical analysis of binary streams
I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
- 101
1
vote
0
answers
193
views
Alternative for Wireshark for USB packet sniffing
I'm looking for alternative for Wireshark, with this requirements:
Cross-platform (Windows and Linux)
USB packet sniffing
Easy creation of dissectors
Wireshark is great, but Lua API for writing ...
- 141
1
vote
2
answers
439
views
Can I decompile a file if I have a compiler? [closed]
Is it possible to reverse the compiled code using a compiler?
I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file.
...
- 111
2
votes
1
answer
271
views
APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]
I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as:
...
- 41
1
vote
0
answers
79
views
How to speed up panda?
When looking for a reversing tool I discovered PANDA. Unfortunately, its performance is too slow. When I run some large programs in a virtual machine, the whole system becomes very slow and I can't ...
- 11
0
votes
1
answer
319
views
Automatically detecting and carving images from .doc, .docx and spreadsheets
I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
- 173
-1
votes
1
answer
139
views
Logging the Instruction Pointer Register
Is there a tool that logs the value the IP register of a specific process running?
I am trying to compare the instruction excution before and after a file modification.
4
votes
1
answer
3k
views
Lipo alternate for linux
Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
- 233
1
vote
2
answers
848
views
fakenet for apps using SSL
With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data ...
- 11
3
votes
2
answers
4k
views
Can Machine Learning be used to develop better reverse engineering tools? [duplicate]
So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning
I'm not an expert in machine learning and deep learning but it seems ...
- 207
1
vote
0
answers
300
views
Reverse engineering a bar code's check digit
I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...
5
votes
1
answer
674
views
Difference between Proxmark3 rdv4 & Proxmark3 evo
I am an advanced beginner in RFID/NFC reversing / hacking. For now, I have a mifare reader and I want to buy a better reader to able to perform advanced stuffs on both HF and LF (especially emulation ...
- 51
4
votes
2
answers
812
views
What's a decompiler that can be extended to new architecture, and how can I do it?
I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
- 665
1
vote
1
answer
39
views
Find schema and info of MS SQL Server to which I have access to
I have access to an MS SQL Server DB and I'm able to run queries on the databases.
But the since the database is too big, with multiple tables and each table having many columns (whose names aren't ...
- 113
1
vote
0
answers
157
views
Binary Analysis Tool (BAT) no longer maintained - alternatives? [closed]
I read on the BAT github page that BAT is no longer actively maintained.
Why did the project come to an end?
What alternatives are there to unpack all kinds of archives /
firmwares / binary ...
- 1,550
3
votes
2
answers
333
views
Hybrid binary analysis tool
I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
- 131
3
votes
2
answers
71
views
Finding a particular call to an offset within a vtable using pattern matching
Let's say I have a very simple pattern I'm looking for. E.g. the following regex,
mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]
Now, I'm also looking for references to this in which the ...
- 131
7
votes
1
answer
3k
views
What is the info displayed by radare2's afl?
I can't figure out what afl actually outputs. The docs are surprisingly uninformative.
So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns?
...
- 173
-3
votes
1
answer
288
views
Please edit this .exe file. I beg you. At least tell me what can be done(No general answers) Specific please [closed]
There is this game called Mafia 2 and since its release modders hve been trying to access encrypted files in the game. It was not until the years 2013 and 2014 that a Russian modder that goes by the ...
10
votes
1
answer
446
views
What is the meaning of single letters in IDA's functions window?
IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture.
The characters are: ...
- 11.7k
1
vote
1
answer
2k
views
Binwalk extracted images corrupt?
I ran:
$> binwalk --dd='jpeg:jpg' file.bin
The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
- 11
1
vote
1
answer
185
views
Which RE tool is missing?
I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not.
My problem is, that all the filenames and ClassNames are ...
- 111
3
votes
0
answers
3k
views
Tool for JavaScript deobfuscation
I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
user56
0
votes
1
answer
401
views
Tomb Raider I Add Subtitle [closed]
I want to translate Tomb Raider 1 into my language. I am able to change texts in the menu but I also want to add subtitles to cutscenes. Is it possible to add subtitles to cutscene.phd files?
...
7
votes
2
answers
4k
views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
2
votes
1
answer
2k
views
How do reverse engineers commonly detect the format of binary data?
Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
- 123
2
votes
1
answer
309
views
How to detect overlay data in RTF files?
How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
- 21
1
vote
1
answer
472
views
Change sending IP of only certain executable
An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without ...
- 157
3
votes
2
answers
2k
views
Any tool for finding IP that a process use/access?
I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
- 157