All Questions

0
votes
2answers
53 views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
0
votes
1answer
41 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
2
votes
1answer
49 views

What's the effect of adding a REP(N(E)) prefix to a JMP instruction?

I'm attempting to reverse engineer an executable packer, and I'm a little stumped on this x86 instruction: F2 EB F5 repne jmp short near ptr unk_88801B According to the Intel manual a repeat ...
1
vote
1answer
38 views

View Array Type in dnSpy

I'm debugging a .NET application and see a declaration of a local array: $ArrayType$$$BY05PAD $ArrayType$$$BY05PAD; I break on an instruction that uses data inside that (char*) array: num9 = <...
4
votes
1answer
46 views

How do I type in hex input into radare2 debug mode?

#include<stdio.h> #include<stdlib.h> int main() { puts("Enter input: "); char buf[100]; fgets(buf, 100, stdin); printf("%s", buf); } Suppose I am debugging a program, such ...
3
votes
1answer
41 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
1
vote
0answers
35 views

deobfuscating/decompiling extremely complicated javascript [on hold]

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
3
votes
4answers
2k views

Is it possible to build an equivalent function just looking at the input and output of the original function?

Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
1
vote
1answer
31 views

Passing hex strings to Radare2

I can quickly test hex string arguments in gdb like this: r $'\x61\x61\x61\x61' I'd like to do something similar in radare2 but all I can figure out is regular strings: doo aaaa I tried this but ...
3
votes
2answers
124 views

The structure of the Python's marshaled code object (or .pyc file)

Help me to decipher the Python's marshaled code object. The .pyc files are almost the same: The structure of .pyc files. I have: The code object compiled from the source. The marshaled ...
1
vote
0answers
23 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
0
votes
0answers
34 views

Cannot rewrite the rip even after disabling all the security features

I was trying to exploit a simple buffer overflow on a self created binary. i have disabled all the security features by compiling with the flags - --fno-stack-protector -z execstack -no-pie. my ...
1
vote
0answers
37 views

How does Ida suspend threads?

I know that Ida uses ptrace function to attach and debug process. How Ida can suspend thread? how is that possible?
0
votes
0answers
57 views

How to securely implement a heartbeat in anti-cheating?

I'm building a generic anti-cheating solution in Golang. I plan on implementing a heartbeat for remotely verifying it's still running. How would I go about implementing this in a secure fashion, so ...
1
vote
0answers
98 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
2
votes
2answers
63 views

dump flash memory with CAN BUS

I want to be able to read Flash memory from Microcontroller using CAN BUS, I was looking for the past few months for some resources to do that but didn't find any, i'm wondering how is that possible ...
0
votes
0answers
17 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
0answers
15 views

Reverseing flash dump from C167 Micro

I'm new to reverse engineering but I love reversing very much, I try to reverse all kind of memories to learn how to that, but only succeded with eeproms, now I want to move to external flash and ...
1
vote
1answer
56 views

Get stack references in Ghidra of a function from the java api

How can one access all references to the stack (also outside of its frame) a function has via the Java Plugin API? Example: This instructions write values outside of the stack frame of the function: ...
0
votes
0answers
58 views

Unable to open PNG file extracted from APK

The file in question doesnt seem to have any PNG or IHDR blocks and I cant get it to work in any image viewers / editors. Here is the first few hexcode: 44 48 47 41 4D 45 53 D0 45 20 F0 D1 35 86 C0 ...
0
votes
1answer
36 views

Java obfuscated methods and params

Try to decompile several classes from jar and found this public static final boolean \u2005\u200e; and if (\u2005\u200e) { final boolean \u2005\u200e = tEstPrOJEcTDEV7i.\u2005\u200e; } ...
0
votes
1answer
30 views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
0
votes
0answers
48 views

How to debug apk/dex files in IDA Pro

Emulator Android 5.x.x Tested on Nox, Memu. Did not give the result. I'm use adb. On emulator android 4.x.x works good.
2
votes
1answer
103 views

Edit an ELF file (language pack)

I have here an ELF file that contains a language pack (German and Chinese) and I want to swap the chinese language to the german language. hex cannot represent Chinese :) here an excerpt from the ...
0
votes
0answers
41 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
1
vote
1answer
35 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
0
votes
0answers
48 views

IDA pro - strange switch statement

I use IDA pro and along the analysis I try to understand the following function. There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing. Am I missing ...
0
votes
0answers
96 views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
0
votes
0answers
15 views

Get and change function definition IDAPython

I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about ...
0
votes
1answer
357 views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
2
votes
0answers
16 views

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled? Context is curiosity. I'm aware that Docker in the ...
0
votes
0answers
20 views

Unity3D Application.genuine implementation

How is Unity3D Application.genuine actually implemented on Android and iOS? Are there any publicly available analyses? Did anyone try to reverse it? I know it is trivial to modify the property and ...
0
votes
0answers
24 views

How to make proper stubs with Exception Handlers?

I'm trying to hook a function to output all its parameters. The hook itself works fine, but the stub somehow crashes the program. I thinks its related to the Exception Handler at the beginning of the ...
0
votes
0answers
29 views

Replacing a function call with it's result in a script

I'm working with a heavily obfuscated Autoit malware script and one of the major problems is that almost all variables and lines of code are obfuscated by a custom function. The problem is that this ...
0
votes
1answer
69 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
0
votes
0answers
67 views

How to Decipher assembled code?

I have an application I am trying to reverse engineer that was built using a graphics engine called Ogre3D. I obviously don't have the original source code that was used to build this particular game. ...
1
vote
2answers
77 views

windbg - Why does the GS register resolve to offset 0x0?

I'm trying to understand how to resolve segment addressing (specifically the GS register in X64). My toy program: int main() { unsigned long long x; __debugbreak(); x = __readgsqword(...
0
votes
0answers
17 views

windbg - What does the “Commit” column of the !vad command output mean?

[cross-posted (but closed the original) from https://stackoverflow.com/q/55438678/254959] As above, when I do a !vad in windbg, what do the values in under the Commit column mean? kd> !vad VAD ...
1
vote
1answer
28 views

windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?

[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959] I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
1
vote
2answers
57 views

Calculating offset from push instruction in exe to string in data section

So I'm looking for some guidance on this topic. If I open up my exe in a Hexeditor and go to the location where the address of the string is pushed as argument I have the following: 68 7C 9D F1 01 - ...
0
votes
1answer
37 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
2
votes
0answers
23 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
3
votes
0answers
52 views

Reverse engineering android native packer

im trying to Reverse engineering an android app and the app have 4 folders in the /data/data/{package} folder ├───app_dexprotector │ 823517D25836B88F1C499C02370A047E.dat │ ...
0
votes
1answer
111 views

Unable to decompile C Code

Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the ...
2
votes
2answers
73 views

Use idapython to print register or memory value when the debugger is running

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment: .text:0FD6268D shr ecx, 4 .text:...
0
votes
0answers
52 views

Does anyone recognise following (USB,HID?) encoding method?

Im reverse engineering a Keyborard RGB LED Control Software and there is a Library called "HidServ.dll" that seems to be the interface between the Keyboard and the Software. Every Function of that ...
1
vote
4answers
150 views

Modify formula by adding a subtraction

I have the following Assembler Code in a x86 Program and I need to modify it as it is buggy: fld ds:(flt_203B8 - 29C48h)[ebx] fdivr dword ptr [esi+44h] fmul ds:(flt_203BC - 29C48h)[ebx] ...
1
vote
1answer
49 views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
-2
votes
0answers
122 views

Hack Linux kernel in order to read all files

I have a linux system. I am not root and i want to read a file. My user account do not have rights to read this file. I have injected a module in the kernel which can read and write memory (kernel ...
1
vote
1answer
55 views

GUARD_PAGE memory breakpoints with gdb?

I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)? Ollydbg, x64dbg and IDA PRO all support these types of ...

15 30 50 per page