All Questions

0
votes
0answers
14 views

IDA change string in rdata

This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php? toquizwammer.github.io Thanks.
0
votes
1answer
64 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
0
votes
0answers
15 views

Is it possible to call external functions?

I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
0
votes
0answers
7 views

replace variable references with its values at once in javascript file

I'm trying to de-obfuscate a Javascript file: Javascript Obfuscated File I have already de-obfuscated the code but it's still hard to read. As you can see in the code below there is a huge list of ...
0
votes
0answers
11 views

Logging the Instruction Pointer Register

Is there a tool that logs the value the IP register of a specific process running? I am trying to compare the instruction excution before and after a file modification.
1
vote
3answers
53 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
2
votes
4answers
2k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
0
votes
0answers
27 views

Unable to extract IP camera firmware

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
0
votes
0answers
18 views

Decoding blob data from a sqlite database into readable format

I have a Sqlite database file that has blob data in it. I only know the the database has blob data and I know what the expected output should be. The blob data's expected output should be a Mac ...
2
votes
0answers
54 views

Help needed to extract u-boot kernel & rootfs - iMX processor

I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive. This board is running a ARM CPU with 32MB of ram and has no vga output. The firmware update comes with 2 ...
0
votes
0answers
26 views

Do all games have static base addresses for values like gold and energy?

I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
8
votes
1answer
4k views

How i can extract TP-LINK firmware from squashfs?

I have installed FMK and binwalk. FMK have an old binwalk that does not work. So, I ran a fresh binwalk (from git) as follow: $> binwalk -e wr741ndv4_ru_3_13_2_up_boot(140521).bin And in the ...
2
votes
0answers
1k views

How to set-up GDB debugging in IDA Pro on Linux via Wine?

I tried running on linux via root terminal: gdbserver --multi localhost:23947 And then at IDA Pro at Wine I use Remote GDB debugger with my local ip and port: However when I start debugging I think ...
0
votes
0answers
16 views

Intel prefixes instructions, checking optimisations problems

I wanted to learn more on ptrace's functions with x86_64 binaries, disassembling instructions. The goal is to check if a byte is one of instructions prefixes. I found some information in the Intel® ...
0
votes
1answer
169 views

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-...
1
vote
1answer
49 views

How to get IOCTLs from all NtDeviceIoControlFile function call?

Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from NtDeviceIoControlFile() syscall. Here is an example of that syscall in Beep() function in KernelBase.dll file: In x86_64 (...
0
votes
1answer
65 views

ISO8859-1 serialization for strings

I am currently investigating a weird layout for storing of what appears to be strings (medical format). Looking at the dump for a bunch of those strings here is what I see: $ hexdump -C out0000 ...
8
votes
1answer
819 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
0
votes
0answers
13 views

Can't use J-Link with ADuC7126 evaluation board

I'm new to embedded, and would like your help. Using uVision/Keil I successfully flashed my ADuC7126 Evaluation Board using the micro-USB. I tried to use a mIDAS-Link JTAG (recognized as J-Link) ...
1
vote
1answer
280 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
1
vote
0answers
30 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
1answer
221 views

Mechanisms to stop serial console accepting input on a Linux system?

I am working on a simple embedded system based around an Olinuxino board. This has a serial console header onboard. TX and RX are both connected to the respective pins on the microcontroller (i.e. ...
3
votes
2answers
104 views

The structure of the Python's marshaled code object (or .pyc file)

Help me to decipher the Python's marshaled code object. The .pyc files are almost the same: The structure of .pyc files. I have: The code object compiled from the source. The marshaled ...
0
votes
1answer
77 views

Finding the correct emulator for programming a renesas sh7722 processor

I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
0
votes
2answers
47 views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
3
votes
2answers
380 views

Writing a file with radare2 `w`?

Radare2 supports a w which writes a string. w foobar write string 'foobar' However, it doesn't seem to work for me, $ touch foo $ radare2 ./foo w foobar The file foo remains empty. Am ...
2
votes
1answer
156 views

Changing parameters in an OS X executable

very new here so please bear with me. I'm an artist trying to realise an idea for a camera that takes photos every X interval during a month. Everything works, except that the app with which I ...
2
votes
2answers
168 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
7
votes
1answer
131 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
0
votes
0answers
20 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
0answers
17 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
43 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
0
votes
1answer
45 views

Windows GUI app without GetMessage imported?

I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself. The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT ...
0
votes
1answer
51 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
4
votes
4answers
24k views

Decoding New Jersey Driver's License Codes

Driver's License numbers in New Jersey aren't random. They follow the format: Affff lllii mmyye, where A is the first letter of the person's last name, ffff is some mapping of the remaining letters of ...
1
vote
0answers
94 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
1answer
84 views

How do tools like objdump find names of functions and their start address in ELF binaries?

I have written a ELF parser that disassmbles the .text section using capstone my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
0
votes
0answers
25 views

Find offset in binary file

I have arm binary file that I can open with Ida, I want to find out the address of some bytes. When I load the binary with Ida there is Image base address that the binary lodded and the offset of the ...
0
votes
1answer
52 views

Bypassing anti-debugging

I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind ...
2
votes
1answer
22 views

When reopening file lose all information in radare2

I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file. any help to avoid this?
-2
votes
1answer
43 views

Can any one de-obfuscator this php code [on hold]

my developer has changed all his contact info and i am unable to contact him and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my ...
1
vote
1answer
1k views

Assistance in Decrypting Lua script that is obfuscated with Base64 > SSL

Can anyone on here help me on decrypting the SSL encryption that protects this LUA script linked at the end of this topic ? Basically they are encoded with Base64 then SSL, but I have no idea how to ...
1
vote
1answer
79 views

How to use aaa in radare2 while in -d (debug) mode?

This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
1
vote
1answer
519 views

ptrace TRACE_PEEKER: Input/output error accessing virtual address contents when traced file is a shared object file

I'm using updated Kali and compiling this for 64- bit Working through Learning Linux Binary Analysis,'simple ptrace-based debugger' on page 57. Source code and testfile to debug included. Problem ...
0
votes
0answers
36 views

Red text Highlight in IDA Pro

Why do some command in IDA have red text highlight around them? e.g.
0
votes
1answer
24 views

Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs

I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
1
vote
2answers
700 views

How to unpack the Fortigate firmware?

I want to unpack the fortigate firmware - FGT_110C-v400-build0092-FORTINET.out. binwalk only gives a hint about gzip compressed data. ~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out ...
0
votes
0answers
25 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
4
votes
1answer
47 views

GetWindowLongPtr with undocumented nIndex of -1

I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such: Does anybody know what that ...
0
votes
0answers
26 views

Log all syscalls inside a qemu vm

I am looking for a way to trace all syscalls which are triggered inside a qemu linux virtual machine. I have no strace command inside the linux vm Is there a way to do that ? Thanks

15 30 50 per page