All Questions

0
votes
0answers
6 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
0
votes
0answers
15 views

(CTF) Speed up assembly by hooking to an static function

For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
0
votes
0answers
9 views

Altering jump address of ELF executable using gdb

I have this very simple code segment: 00000000004012f0 <body>: 4012f0: 48 8b 0c 25 40 40 40 mov 0x404040,%rcx 4012f7: 00 4012f8: 48 3b 0c 25 44 40 40 cmp 0x404044,%rcx ...
0
votes
0answers
9 views

Reverse engineering checksum from RS-485 device

Attempting to reverse-engineer a checksum for a serial timing device that updates a display. Protocol is partly understood, however the checksum calculation specified does not produce the expected ...
0
votes
0answers
7 views

javascript hook comparisons

Look at this very basic javascript code: if (s=='abcd') { if (s2='cdef') { ... } } I want to hook all tests: I want to get this: (s,'==','abcd') (s2,'==','cdef') Is there a way ...
0
votes
0answers
16 views

Finding lua addresses with ida

I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is ...
0
votes
1answer
34 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
0
votes
1answer
49 views

Switching from seg to text in IDA-View

actually i don't know where the problem but i will describe it I am trying to analyse the firmware of a router and i could extract it and i got these files libxmlapi.so libhttpapi.so libcfmapi.so ...
-1
votes
0answers
18 views

Prevent artificial driver error in Windows?

I have a problem with the Nvidia GPU driver which apparently artificially fails with Error 43 in order to prevent you from using their consumer-grade mobile GPUs inside of a virtual machine. People ...
0
votes
0answers
16 views

Taking a luac file and making a modification

I have a luac file for a program I use. I'd like to make a modification to this file to call a function from another luac script. My understanding of the way luac works is the first few bytes are the ...
1
vote
1answer
16 views

Identify ldfld reference in .NET when parsing GetILAsByteArray

I was experimenting with idea of decompiling a PowerShell cmdlet using reflection. While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this ...
0
votes
1answer
29 views

Glitch attack on a SPI flash eeprom

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...
0
votes
1answer
29 views

Is it possible to add new windows form control into compiled assembly using dnSpy?

I am trying to add another button into windows form using dnSpy. Is it possible to add another? I want the end result be like this one. Any help will be highly appreciated.Thanks
1
vote
0answers
19 views

Likely protocol determination by chip IDs and connections?

CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me. GOAL: Replace a damaged ...
0
votes
0answers
29 views

Crack software using ollydbg [on hold]

Does anyone know how to crack softwares otherwords debugging them and i tried to crack it using ollydbg but could not help myself in finding GETDLGITEMTEXT.Thank you.
1
vote
0answers
31 views

REing GameCube model (GCR) and texture (GCT) formats

I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
0
votes
0answers
16 views

How to change iOS registers automatically?

Let's say that there is an app that always passes integer 1 to a register, x1. I reverse engineered it, so I found its address, function, and everything. Is there a tool out there that allows me to ...
0
votes
0answers
29 views

Cramfsswap “Did not find the file…”

I try to get the files from a Firmwarefile but i have a problem with the cramfs. Here is what I tried: $ binwalk FW.ddi DECIMAL HEXADECIMAL DESCRIPTION -----------------------------------...
0
votes
1answer
30 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
1answer
60 views

alphanumeric shellcode

I have generated an alphanumeric shellcode with this command: msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python I am targeting a 32 bits ...
1
vote
2answers
29 views

Idapython: adding links where a function address is loaded into a register

I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor. Unfortunately I can't get a copy of the original C compiler used in order to ...
1
vote
0answers
30 views

Legality on sharing rom dumps on abandoned hardware

I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that. How can I share my process and ...
-1
votes
0answers
39 views

Can any one please explain the following disassembly code [on hold]

I was learning x86 assembly and had huge difficulty in understanding many of these lines.
1
vote
0answers
20 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
-2
votes
0answers
32 views

Can anyone please explain this disassembly code? [on hold]

Disassembly: 0: 6a 05 push 0x5 2: 58 pop eax 3: 31 c9 xor ecx,ecx 5: 51 push ecx ...
2
votes
2answers
79 views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
-1
votes
1answer
80 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
0
votes
1answer
54 views

why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?

the c code: void overflow (char* inbuf) { char buf[64]; strcpy(buf, inbuf); } int main (int argc, char** argv) { overflow(argv[1]); return 0; }
0
votes
1answer
33 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
-1
votes
2answers
65 views

CreateThread returns true but thread doesn't run

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
0
votes
0answers
30 views

How to extract images/3d files from file loaded in runtime memory?

how would you dump runtime memory of a software (that has loaded 3d models and images) and then extract automatically the 3d models or images?
0
votes
0answers
21 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
0
votes
0answers
22 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
59 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
3answers
71 views

Help unpacking U-boot firmware

I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm). I have this tf_recovery.img that's supposedly a U-Boot image, but I can't unpack it either using dumpimage ...
1
vote
1answer
27 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
2answers
60 views

How to 'hack' the chat box in an online game

First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. I play an online game that is predominately played by Spanish speaking players. I'...
0
votes
1answer
89 views

How would I go about finding the 'flag' in this QR image(Capture the Flag)?

How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz ...
-1
votes
1answer
37 views

decomplied apk with bad parameters

I'm trying to reverse engineering an android app API so this is what I tried: First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...
0
votes
0answers
82 views

Reverse engineering a CRC in a RS485 communication

I have been struggling for a week now with reverse engineering a CRC byte in a serial communication of a digital pH probe. Here are some captured bytes from pooling the probe with the original ...
0
votes
1answer
80 views

x64dbg - Locating where data is initially written

I am hoping someone can help me with a question or two. Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...
0
votes
1answer
57 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
1
vote
1answer
47 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
1
vote
1answer
46 views

Is PNF's JEB Reverse Engineering platform written in pure Java?

I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro. While examining the earlier versions of JEB,...
1
vote
0answers
84 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
45 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
0
votes
0answers
26 views

Can I use a message structure thats reverse engineered

The dispaly interface is not open source. It talks to open source firmware on a controller board. My question is if I figure out the message structure can I use this with my own non opensource ...
1
vote
1answer
37 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
2answers
51 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
1
vote
2answers
105 views

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...

15 30 50 per page