All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
1
vote
0answers
67 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
51 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
0answers
15 views

CPU integrated PCI device functions

I'm trying to reverse an Xeon based hardware bios. During the early initialization in the UEFI SEC phase, I stepped into some CPU embedded PCI devices initialization. After few hours researches, I've ...
1
vote
1answer
46 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
0answers
46 views

Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
0answers
39 views

Can I bruteforce an .nc blowfish-448 encrypted (mcrypt2.2)?

Still a freshie at RE, but during my first expedition I came across some encrypted files. To be specific: _login.nc: mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit Any ...
0
votes
1answer
54 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
2answers
55 views

How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
1answer
66 views

Possible to get address of DRIVER OBJECT programmatically?

I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so: 0: kd> !drvobj HEVD 2 Driver object (ffffa70752fdbe30) is for: \Driver\HEVD ...
0
votes
0answers
8 views

App Store IPA - why it would suddenly need a “provisoningProfiles” entry in Info.plist? [closed]

An IPA I have acquired from Apple's App Store has a "provisioningProfiles" in its Info.plist. The "provisioningProfiles" entry was not in previous versions of the IPA file. Looking at another few ...
1
vote
1answer
22 views

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
2
votes
1answer
42 views

Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
1
vote
2answers
85 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
0
votes
1answer
103 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
2
votes
2answers
91 views

Malware Samples that defeats emulators by using uncommon API calls

I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
2
votes
0answers
49 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
0
votes
0answers
28 views

Reverse Engineering MS Access Encryption [closed]

I have an MDB with a column of what I assume to be encrypted data. The application I'm using shows me the unencrypted form of the data so I know what each encrypted string in the MDB column ...
0
votes
0answers
36 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
0
votes
1answer
79 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
0
votes
0answers
44 views

How do I decompile/modify a .dfu file?

I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the ...
1
vote
0answers
31 views

CRC Checksum? (Used in can open system)

We want to put our own messages on a can-open system. (So we can program our own functions to the system). We can put our message on the system, but when we do this, the safety relay stops the system. ...
1
vote
1answer
24 views

Regenerate PEM/DER keys from binary blobs

I have the binary blobs for the components of a private key including modulus, publicExponent, privateExponent, prime1, prime2, exponent1, exponent2 and coefficient, what is the easiest way to ...
1
vote
1answer
49 views

Can I use the Rich Header To Find out Compiler and Linker used?

I heard that I can use look at the RICH HEADER to find out what compiler was used. I looked at the Rich header and I cannot seem to make sense of this. Can I find the Compiler used for this program ...
0
votes
0answers
23 views

Can't find the missing part in this HEX blob encoding

I've tried everything but it feels impossible to find out what is missing: This encryption is generated by SQL Report Server 2012 and it holds an XML security schema that needs to be edited. It's ...
2
votes
1answer
116 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
1
vote
1answer
116 views

Encoding method of float

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and ...
0
votes
0answers
36 views

How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW

Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW i tried every combinanated value but without sucess.
0
votes
0answers
75 views

What kind of compression/encryption could this be?

I am dealing with a file that seems to use some kind of proprietary compression/encryption I can't figure out. I have a lot of sample files as well as different versions of the same file, so I have ...
0
votes
2answers
37 views

Error when changing push 0 to push function

Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure I've searched for a fix for a while to no avail help would ...
0
votes
0answers
36 views

Decrypt TCB, TAD file

I'm developing a Chinese game, it was released 10 years ago. I need decrypt two this files in the client game. My purpose is to redesign the game menu. This is code in exchange.tcb https://filebin....
3
votes
1answer
107 views

Is it possible to view and modify process memory without attaching the debugger in x64dbg?

This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
0
votes
1answer
63 views

I'm trying to understand the SEH mechanism

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
0
votes
0answers
10 views

Can the .idb/.i64 default save location be changed?

By default, IDA Pro saves its .idb (or .i64) files to the same directory as the file being analyzed. Is there a way to change this? I couldn't find anything related to this in Options -> General.
1
vote
0answers
50 views

Ghidra: How to display the contents of an array

I have a long array in a program. I can see the contents of the array in the left view but it is not in a useful format. Is it possible to use ghidra to print the array in a copy-paste friendly format ...
0
votes
1answer
51 views

What do square brackets do in IDA's pseudocode representation?

I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
0
votes
1answer
35 views

How to figure out which button I'm pressing

I'm working on an app, that I'm trying to get to work on a android device that has additional buttons. The device is called a BH95, from BATL. It has 4 side buttons(1 volume up, 1 power button, 2 ...
1
vote
2answers
100 views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
0
votes
0answers
56 views

Mimicking a file format that is actually a zip

Backstory: I have been trying to find a way to automatically turn batches of photos into WhatsApp stickers. I was able to do that, but now I am trying to figure out a way to actually import them into ...
2
votes
1answer
170 views

Simple C program disassembled with Ghidra

I am trying to figure out what is going on with my simple example programs, when I disassemble them with Ghidra. I am not sure whether this is some strange Ghidra behaviour or something that is set by ...
2
votes
1answer
55 views

__security_cookie for function pointers in Windows 10

I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.) Here's an example: Note that the address for indirect function call (or ...
0
votes
0answers
33 views

IDA 7.0 (free) fails to load symbols with message “DWARF: Cannot determine location of DWARF info” during debugging

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM: Then loaded a test PE file and started debugging it (using Local Windows Debugger): ...
0
votes
1answer
49 views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
3
votes
1answer
33 views

What binary value does Thread and Process ID Register contains in Android ARM?

I have following instructions in Android shared library: MRC p15, 0, R3,c13,c0, 3 LDR R3, [R3,#4] MOV R0, #0 STR R0, [R3,#0xC] According to ARM documentation: Reading or writing the Thread and ...
0
votes
0answers
51 views

Radare2 not showing memory value correctly

I am debugging a bootloader running on QEMU i386. The issue is the red value of 0x6069 shown as zero. In reality the value is the same as register al (non zero value) and the following je happens. ...
0
votes
0answers
21 views

Pass arguments to EDB

Is there a way to pass an argument in edb? I've tried Options -> Application Arguments, but to no avail. Here's some simple print code for application arguments to see if it'll work. #include <...
1
vote
1answer
64 views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning. ...
0
votes
1answer
35 views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
0
votes
0answers
33 views

What kind of memory representation is this?

I am reverse engineering a protocol used by an embedded device. This protocol message contains an 8-bit field which I believe to represent an integer number. To analyze the format used to encode such ...
0
votes
1answer
31 views

Find Retdec Address Range in x64dbf

How do I find this function from retdec (https://github.com/avast/retdec) in x64dbg? // Address range: 0x1017dba0 - 0x1017dbda int32_t function_1017dba0(int32_t * a1) { int32_t fileHandle = (...

15 30 50 per page