Questions tagged [tools]

Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

How to use reverse engineering to get paginated threads id on facebook messenger

I'm trying to replicate websocket request in python. I want to get paginated results of threads id that appears after scrolling down the friends chats section. Seems messenger uses websocket for it. ...
Wippar's user avatar
  • 1
1 vote
1 answer
53 views

Tracing all functions in executable conditionally, to find function of interest

I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/...
tcpie's user avatar
  • 113
0 votes
0 answers
167 views

Need help understanding why Netflix prevents me from downloading with VPN

When using Netflix via the Windows desktop app with a VPN, streaming movies works fine but downloading does not. The download gets automatically paused, and after a minute it shows error code DL1-...
Verpous's user avatar
  • 101
3 votes
1 answer
2k views

What are the substantive differences between radare2 and rizin?

Rizin was forked from Radare2 several years ago, mainly due to human factors. At the time, there weren't any important differences in features between the two. I understand that Rizin has rewritten ...
SRobertJames's user avatar
2 votes
2 answers
2k views

UPX Unpacking tool

Firstly, thank you for your answer. What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such. Thank ...
Alan's user avatar
  • 21
2 votes
0 answers
47 views

I want to learn how to program by orienting myself to the task of reverse engineering

I have to learn programming from scratch and I want to orient my learning in order to be able to reverse engineer to break obfuscators. It would be helpful if you could recommend me what languages, ...
Yosho's user avatar
  • 21
2 votes
0 answers
43 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
Clement's user avatar
  • 21
3 votes
0 answers
87 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
1 vote
1 answer
798 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
markzzz's user avatar
  • 87
1 vote
0 answers
715 views

Getting helpful information on classes in Ghidra?

I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
Josh Tint's user avatar
1 vote
1 answer
2k views

how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?

I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility ...
gsxrk7's user avatar
  • 11
1 vote
1 answer
457 views

Binary diff + patching across versions

What are the current options for binary patching which works across different versions of the binary? E.g. we created a binary patch for a specific version of a binary and want to apply that patch to ...
MRalwasser's user avatar
1 vote
0 answers
219 views

Reversing Logitech G933 Battery Charge Values

I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
webjocky's user avatar
1 vote
1 answer
220 views

IDA Pro - How to remove multi-line bit definitions for register

I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
canadaboy25's user avatar
1 vote
0 answers
597 views

Miasm VS Triton - which to choose? [closed]

Hello and thank you for reading my question, I was wondering, which is the right tool for me to choose according to the following: I will be using it mainly for Malware analysis and for exploit ...
journey1's user avatar
0 votes
0 answers
3k views

Need Help with decryption backup config.bin file "ZTE ZXHN H267N v1.1"

hi i'm trying to decrypt config.bin file from new router I got from my company, I tried a tool found on github "https://github.com/mkst/zte-config-utility" I got this ERROR: python3 examples/...
madiha bout's user avatar
0 votes
1 answer
290 views

modern instrumentation for reversing and researching [closed]

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue: i have been doing malware analysis and researching for a few years, and i want to learn ...
journey's user avatar
0 votes
2 answers
5k views

Need help with ZTE router config.bin file decryption and encryption

bin file extracted from a ZXHN H168N V3.1. RouterPassView is able to decrypt the file successfully but the tool can't re-encrypt the file, it gave me some info about the method used to decrypt here ...
Luser's user avatar
  • 9
3 votes
3 answers
2k views

Reverse engineering a partially known binary format

I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
S. Kalabukha's user avatar
1 vote
1 answer
5k views

Decompiling Python Files: ValueError

So I have this python file and I successfully unpacked its content inside of it we have our file.pyc I appended the magic bytes to it so it went from: E3 00 00 00 00 00 00 00 00 00 00 00 00 to ...
Jimmy Hankey's user avatar
1 vote
2 answers
218 views

Gui disabled program functionality

Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality. Right now there's one button remaining labeled "Encrypt", which is greyed ...
solumnant's user avatar
  • 173
5 votes
1 answer
195 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
solumnant's user avatar
  • 173
-1 votes
1 answer
1k views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
oldboy's user avatar
  • 99
0 votes
0 answers
224 views

Tools for statistical analysis of binary streams

I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
IInspectable's user avatar
1 vote
0 answers
203 views

Alternative for Wireshark for USB packet sniffing

I'm looking for alternative for Wireshark, with this requirements: Cross-platform (Windows and Linux) USB packet sniffing Easy creation of dissectors Wireshark is great, but Lua API for writing ...
GAMELASTER's user avatar
1 vote
2 answers
477 views

Can I decompile a file if I have a compiler? [closed]

Is it possible to reverse the compiled code using a compiler? I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file. ...
Jaffer Wilson's user avatar
2 votes
1 answer
278 views

APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]

I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as: ...
Trey Keown's user avatar
1 vote
0 answers
79 views

How to speed up panda?

When looking for a reversing tool I discovered PANDA. Unfortunately, its performance is too slow. When I run some large programs in a virtual machine, the whole system becomes very slow and I can't ...
xuetr178's user avatar
0 votes
1 answer
331 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
solumnant's user avatar
  • 173
-1 votes
1 answer
146 views

Logging the Instruction Pointer Register

Is there a tool that logs the value the IP register of a specific process running? I am trying to compare the instruction excution before and after a file modification.
Ahmad Abu Doush's user avatar
4 votes
1 answer
3k views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
Rohit saraf's user avatar
1 vote
2 answers
928 views

fakenet for apps using SSL

With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data ...
multicode's user avatar
3 votes
2 answers
4k views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
John P's user avatar
  • 207
1 vote
0 answers
322 views

Reverse engineering a bar code's check digit

I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...
Ernestas Romeika's user avatar
5 votes
1 answer
706 views

Difference between Proxmark3 rdv4 & Proxmark3 evo

I am an advanced beginner in RFID/NFC reversing / hacking. For now, I have a mifare reader and I want to buy a better reader to able to perform advanced stuffs on both HF and LF (especially emulation ...
niosega's user avatar
  • 51
4 votes
2 answers
861 views

What's a decompiler that can be extended to new architecture, and how can I do it?

I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
user202729's user avatar
1 vote
1 answer
39 views

Find schema and info of MS SQL Server to which I have access to

I have access to an MS SQL Server DB and I'm able to run queries on the databases. But the since the database is too big, with multiple tables and each table having many columns (whose names aren't ...
clamentjohn's user avatar
1 vote
0 answers
167 views

Binary Analysis Tool (BAT) no longer maintained - alternatives? [closed]

I read on the BAT github page that BAT is no longer actively maintained. Why did the project come to an end? What alternatives are there to unpack all kinds of archives / firmwares / binary ...
langlauf.io's user avatar
  • 1,560
3 votes
2 answers
341 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
Shawn's user avatar
  • 131
3 votes
2 answers
73 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
zeboidlund's user avatar
7 votes
1 answer
3k views

What is the info displayed by radare2's afl?

I can't figure out what afl actually outputs. The docs are surprisingly uninformative. So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns? ...
rgcalsaverini's user avatar
-3 votes
1 answer
288 views

Please edit this .exe file. I beg you. At least tell me what can be done(No general answers) Specific please [closed]

There is this game called Mafia 2 and since its release modders hve been trying to access encrypted files in the game. It was not until the years 2013 and 2014 that a Russian modder that goes by the ...
osaru badiaru's user avatar
10 votes
1 answer
468 views

What is the meaning of single letters in IDA's functions window?

IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture. The characters are: ...
NirIzr's user avatar
  • 11.8k
1 vote
1 answer
2k views

Binwalk extracted images corrupt?

I ran: $> binwalk --dd='jpeg:jpg' file.bin The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
Justin Clark's user avatar
1 vote
1 answer
188 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
flood's user avatar
  • 111
3 votes
0 answers
3k views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
user avatar
0 votes
1 answer
404 views

Tomb Raider I Add Subtitle [closed]

I want to translate Tomb Raider 1 into my language. I am able to change texts in the menu but I also want to add subtitles to cutscenes. Is it possible to add subtitles to cutscene.phd files? ...
someonewhowantstolearnenglish's user avatar
7 votes
2 answers
4k views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
Viacheslav Kroilov's user avatar
2 votes
1 answer
2k views

How do reverse engineers commonly detect the format of binary data?

Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
Matmarbon's user avatar
  • 123
2 votes
1 answer
318 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
PK19's user avatar
  • 21