All Questions

2
votes
3answers
151 views

Jump in the middle of an instruction Coldfire firmware

I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure. ROM code quality seems pretty low, and I see ...
0
votes
1answer
83 views

Firmware reverse engineering

this question is a follow-up from this previous post: Flash dump binwalk blank, low entropy I need to reverse engineer a firmware from a very secure device. I was able to reverse engineer the PCB ...
0
votes
0answers
53 views

MS DOS virus - version discrepancy [closed]

I am trying to reverse engineer the DOS-7 virus but the one that I have seems to be significantly different from some of the notes I have read online. Particularly, the one I have does not infect the ...
0
votes
1answer
54 views

What is this assembly code, fld qword ptr code here doing? Also, how do I store my own value?

I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced. Basically the health gets stored in the stack and then pops out for displaying on the screen. ...
0
votes
2answers
81 views

Solve an angr function with string parameters

Look at this C code: #include <stdio.h> #include <string.h> int my_function(char *s); int my_function(char *s) { for (int i=0;i<strlen(s);i++) { s[i]++; } if (...
0
votes
0answers
51 views

Decode Rolling Code

I have a motorized curtain, which uses a 433Mhz RF Control. I'm trying to figure out how is it encoded. I could already get the times and converted to HEX representation. Below has 10 samples for ...
0
votes
1answer
60 views

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

This question has already been asked here but for some reason it was deleted, as "dead". I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
-1
votes
0answers
68 views

Bike battery and coded frame [closed]

I'm writing you from France sory if my english is not perfect. I'm trying to repair my bike battery (PANASONIC NKY350B2 8Ah 36V) and there is a coded frame send with UART at the start of the bike. ...
1
vote
1answer
61 views

Understand the CPU cycles of x86 instruction bsr/bsf

I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend bsf/bsr opcode. So high-levelly, these two opcodes can be modeled as a "loop", ...
0
votes
0answers
37 views

Reversing custom JavaScript obfuscation/encryption

I have a js file with no external dependencies. It has two parts, one looking like this: { b: "IxIjACMBQzM=", U: [0], G: [0], k: [1, 18] }, { b: "IxFMTgH+...
0
votes
1answer
32 views

How to print the value of register with Radare 2

I am trying to solve this ELF - Ptrace challenge. I use Radare 2. This is the commands I execute to print the assembly code. radare2 ch3.bin [0x080482f0]> aaa [[anal.jmptbl] Missing cjmp bb in ...
-2
votes
0answers
32 views

How to telnet to a security camera

I have a C63S vstarcam camera and its RTSP servers keep crashing. I'm certain that if I can log into the camera I can at least restart the RTSP server or reboot the camera. The only open ports on the ...
2
votes
1answer
67 views

Radare2 does not display the entire assembler code

I am trying to solve this ELF - Ptrace crack me. Here are the commands I use : I start radare2 with the crack me as argument. radare2 ch3.bin I decide to go to the main and print the assembly code ...
-1
votes
1answer
60 views

Go back to the function call address

My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace ...
1
vote
0answers
22 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
0
votes
1answer
46 views

Significance of link address 2000 8000 7C00;

Can you explain to me the significance of link address 2000 8000 7C00? It's in a MACRO from the GRUB configure script, which checks whether OBJCOPY works for absolute addresses. Here's the snippet ...
1
vote
1answer
63 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
0
votes
1answer
60 views

Combine various sub routines into one sub routine (IDA Pro)

Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
1
vote
0answers
85 views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
1
vote
2answers
147 views

Are there any crackme sites made for cheat engine or to practice game hacking particularly?

I've checked several crack me sites and they're all on reverse engineering applications. However, I would like to practice reverse engineering by manipulating game values. The cheat engine tool ...
1
vote
2answers
66 views

How can I demangle the name in an RTTI Type Descriptor?

I'm currently browsing through RTTI information available in an MSVC++2003 executable (writing an IDAPython script to recreate structs for the class hierarchy). Apparently, as visualized here, the ...
3
votes
2answers
130 views

Which operators use sal, shl, sar or shr

Which operators in C language would result in assembly commands such as sal, shl, sar or shr for example?
2
votes
1answer
44 views

Weird qemu behaviour with Freescale Coldfire MCF5282

I'm trying reverse engineer the firmware, apparently bare metal, of an industrial controller. The device is based on a Coldfire controller, to be more precise, the MCF5282. To track its behavior, I ...
1
vote
2answers
111 views

Emotet invoice, what is the embedded file inside the word document

This pastebin hosts current URLs hosting the fake invoice of Emotet malware, which is the dropper part of the malware. The document is a Office Open XML, and there are two large non textual segments ...
-1
votes
0answers
19 views

How can I debug the following Windows error: “The specified service does not exist as an installed service. (Exception from HRESULT: 0x80070424)”

I have an old program I want to run on a Windows machine inside a Virtualbox. However, I'm getting the following error: The specified service does not exist as an installed service. (Exception from ...
1
vote
1answer
93 views

What's this obfuscation technique?

I'm reverse-engineering a particular dylib on Mac OS X. The dylib is highly obfuscated, but I suspect it's from some well-known technique that I'm not aware of. I'd like to describe it in the hope ...
-1
votes
0answers
31 views

IDA Dalvik debugger on Andoid Device JDWP error: INVALID_OBJECT

IDA Dalvik debugger on Android Emulator throws JDWP error: INVALID_OBJECT, and then IDA hangs and not able to figure out why its happening.
0
votes
1answer
69 views

How to detect md5 and sha256?

I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256. How can I detect md5 in assembly? How can I detect sha256 in assembly? thanks
1
vote
1answer
97 views

Solve a function with angr [closed]

Look at this c program: #include <stdio.h> int my_function(int a, int b); int my_function(int a, int b) { // Imagine a very complex calculation on 'a' and 'b' if (a==0x41 && b=...
0
votes
1answer
64 views

finding file I/O in IDA Pro (actually IDA free)

Am using the free version of IDA pro, and have loaded the program with no apparent problems. I see assembler and stuff. The parts of the program I am interested in is where it reads a file. This is a ...
2
votes
1answer
55 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
0
votes
1answer
43 views

CRC8 reverse engineering

I am creating a CAN Bus on-bench testing solution which replicates the entire vehicle to test a single module. I have a number of messages that require a CRC byte in order to be valid. The messages ...
1
vote
1answer
42 views

Why does vmt hooking not work with instance member in the following case?

Why does the function not get hooked when called with instance member obj.myFunc() ? class Myclass { public: virtual void myFunc() = 0; }; class Derived : public Myclass { public: void ...
-1
votes
0answers
16 views

Asking the meaning of an assembly instruction [duplicate]

I want to know the meaning of following instruction. MOV AL,BYTE PTR DS:[ECX+402158]
1
vote
0answers
33 views

.NET Method Tracing with Parameters

Is there a tool which can profile the .NET binaries (32-bit and 64-bit) during execution to generate an API trace providing details of the methods called and the parameters passed to each method? ...
-1
votes
0answers
25 views

Is the inability to run an application after the editing of a Mach O library due to improper editing or of a verification mismatch?

So there is an application (Audio Hijack specifically) that I am trying to edit after having downloaded it, and it (obviously) only includes the compiled code. This includes a Mach-O 64-bit ...
0
votes
2answers
47 views

Print opcodes in trace - x64dbg

How can I print the opcodes in a trace log? I can use {x:bswap([cip])} but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), ...
0
votes
1answer
61 views

Debugger always paused in ntdll.Kifastsystemcallret

I am using x32dbg to debug a program. I want to find the line which corresponds to a pop up message in my program to put a Break point. But everytime that I set "Pause" after the pop up window's ...
0
votes
1answer
79 views

Decompressing a .replay file

Fortnite has a feature that records your gameplay and saves it as a .replay file, now I don't believe these files are encrypted, only compressed. I wasn't able to find a way online to decompress such ...
0
votes
1answer
47 views

ida pro issue debugging issues with ntdll [closed]

I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s I am facing a problem when i try to put a break point on functions in ...
-2
votes
2answers
207 views

XOR encryption - How to find the key?

I'm trying to solve a crackme which basically uses a XOR encryption scheme in which the password is used as the key to an encrypted buffer which is subsequently executed. The following is the ...
0
votes
1answer
71 views

why code at .rodata executes [closed]

How come the following code executes if buf* is @ rodata segment ? #include <stdio.h> char *buf[] = { "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\...
3
votes
1answer
83 views

Why disassemble multi-thread binary is hard?

Why disassemble multi-thread binary is hard? I also know that some obfuscation techniques are to create unnecessary threads. But why reverse engineering multi-thread program is hard.
2
votes
1answer
48 views

There is something else than a “DllMain” in a module for its initialization?

All right, Actually I am manually mapping a module into a process, actually my mapper calls DllEntryPoint from standard struct IMAGE_NT_HEADERS thus IMAGE_NT_HEADERS::OptionalHeader::...
1
vote
1answer
43 views

Unknown parameters in custom signal handler on Linux

0x0000000008001946: mov 0xa8(%rdx),%rax 0x000000000800194d: lea 0x28(%rdx),%rsi 0x0000000008001951: lea 0x2(%rax),%rdi 0x0000000008001955: add $0xe,%rax 0x0000000008001959: ...
1
vote
1answer
102 views

How does ASLR in Windows work?

I had recently this situation where in a program I was debugging I found: 03CD38D4: 8B15 8C5FF703 MOV EDX, DWORD PTR DS:[3F75F8C] If I look for these bytes in the physical file I found nothing. I ...
1
vote
0answers
37 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
-1
votes
0answers
26 views

Error Exception EOLeSysError class, When execute delphi program

I ran into a error and get the following message and just have EXE Files: Error EOLeSysError class not registered Class Not Registered. How I can find the name of the class which is not registered?...
-1
votes
0answers
17 views

Cisco Payload vulnerability

I'm so curious to know which encoding language the payload inside the code have been used in Cisco IOS 12.2 < 12.4 / 15.0 < 15.6 - Security Association Negotiation Request Device Memory ? ...
0
votes
1answer
34 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...

15 30 50 per page