All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Is it possible to decompile an apk file and create a communication channel? [closed]

The reason I want to decompile the apk file is because I am trying to automate some tasks and I want to make the decompile version of the app be able to communicate or take instructions from a python ...
0
votes
1answer
24 views

Windows PE64 throw error while allocating heap for unknown reason?

For some reason i'm not aware of ( some heap allocation limit ) while allocating memory for some classes, an application ( win64 ) raises this exception: DumpedMini Result[0] Exception Code[...
3
votes
2answers
538 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
2
votes
1answer
31 views

How can you dump the unpacked version of a packed library/plugin from memory on macOS?

I'm dealing with a custom-upx packed library that I'm trying to unpack. System is macOS. Given it's a library/plugin, it doesn't have a standalone entrypoint. I ran it through a disassembler but wasn'...
2
votes
1answer
48 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
2
votes
1answer
55 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
2
votes
0answers
66 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
3
votes
0answers
76 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
1
vote
0answers
46 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
1
vote
1answer
48 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
1answer
73 views

Latest VMProtect vs Latest Themida [closed]

I am working on an app to archive some important files in a compressed-encrypted format, What is the best for me to use (Virtualization) VMProtector or Themida ? Thanks in advance
1
vote
0answers
83 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
33 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
2answers
47 views

Defining operand as offset

I have an idapython script which automatically defines bytes as code by a predefined configuration. The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
0
votes
0answers
173 views

Extracting information from a random cipher or a binary file

I have measured data comes from a various types of sensors. After measurement, the data encrypted and stored in a memory. We monitor the serial data(via:RS232 from the memory), and the data was ...
1
vote
0answers
46 views

Determining the encoding of an unknown image format [closed]

I'm trying to reverse engineer a REST API and there is an endpoint that delivers images. Some of them are jpegs but other ones look like they're base64 encoded, except they don't appear to be, as they ...
1
vote
1answer
41 views

Click-thru a virtual function in IDA

I'm reversing some stuff that has RTTI, so finding vftables is easy. I have an instance of some class some_object, there is a method being called through its __vftable. The method_4 has a type of ...
0
votes
0answers
63 views

Practicing Reverse Engineering To Find Default Password From Router Firmware

I am currently practicing reverse engineering to look for the default password of the Linksys V1.5 firmware here https://www.linksys.com/us/support-article?articleNum=148613 I tried to use binwalk to ...
1
vote
1answer
39 views

Wave File obfuscation

I have this file here, that is supposed to be a wave audio file, but seems to have some obfuscation applied to it. The file header is here: https://pastebin.com/LD5aA1EG Any suggestions where else ...
0
votes
0answers
24 views

Set a breakpoint for a win command without an address

How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address. I don't know what exactly ...
0
votes
1answer
23 views

How to whitelist an address for breakpoint?

If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping? Seems that it is needed to use conditions. How? I use x64dbg, but if you only know a way in ...
-1
votes
1answer
90 views

How can I analyze this code? [closed]

I wanted to analyse the code for some functionality. in my understanding the code contains a logic handling intents with extras. I want to know how these Works! and also how can I pass extras using ...
3
votes
2answers
79 views

Extracting Info from Ghidra Listing Window

I have written a script which extracts all the assembly code from a PE using this code in ghidra instructionList = [] for instr in currentProgram.getListing().getInstructions(True): ...
-3
votes
1answer
97 views

How to reverse engineer apks? [closed]

is it possible to reverse engineer an apk just to unlock hidden/unreleased features?
1
vote
0answers
23 views

ARM 20-pin JTAG header?

I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header: but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
1
vote
1answer
59 views

I have a two pin debug interface, confused on how to use it

I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it ...
-1
votes
0answers
30 views

Understanding hex opcode an r2 dissasembly output

Can anyone explain what the middle column (55, 4889e5, etc.) denotes in this r2 output? Are they assembly hex opcodes or do they relate to the registry? (To my limited knowledge I understand that the ...
1
vote
1answer
46 views

VMware Tools list of all installed files with it

I'm reversing an anti VMware mechanism which detects VGAuthService.exe and vmtoolsd.exe as well as a few registries that I've taken care of and some drivers from C:\Windows\System32\drivers\vm.... I ...
1
vote
1answer
57 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
1
vote
0answers
34 views

Unable to start file “..\ntoskrnl.exe” in ollydbg [What can I do?]

Ollydbg isn't allowing me to open the executable ntoskrnl. I think im missing something but I don't know what it is (Windows 7, Ollydbg10.0,200)
1
vote
1answer
42 views

Results of radare2 are not correct

I am using radare2 to analyze libpng_amd64.so.1.6.34, commands are as follows: r2 = r2pipe.open(binary_file) r2.cmd('aaa') funcs = r2.cmdj('aflj') len(funcs) is 461, but the number of functions got ...
0
votes
1answer
28 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
2
votes
0answers
70 views

Garage door rolling code: identifying the implementation

I'm trying to reverse engineer my garage door remote (we're having robbery problems here, so I check if it's a weak point), here's what I found, listening on 868MHz: There's a "preamble" composed of ...
1
vote
1answer
43 views

How can I get my shellcode to work outside of GDB?

I'm working inside a Warzone VM with no ALSR or NX bit. The program I'm trying to exploit is really simple: #include <stdlib.h> #include <stdio.h> #include <string.h> /* * ...
0
votes
0answers
50 views

What does the code keyword in Ghidra mean?

I'm reversing a binary and I found this strange keyword I haven't seen before called 'code'. I looked up the C++ keywords and there doesn't seem to be one. Could anyone provide me with more ...
1
vote
0answers
14 views

pick dump from a specific process from virtualbox coredump

i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner what i have learned so far that we could use virtualbox to dump the RAM ...
1
vote
1answer
39 views

Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?

I want to implement a full blown import reconstructor into my app without any external dll's or Shell Executes to EXEs. I want to just have the ability to get IAT Import addresses to certain imported ...
1
vote
0answers
21 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
2
votes
0answers
30 views

x64dbg break when hex string is loaded

I'm trying to break execution when a string is loaded in memory. I can´t find the string by using the search for -> string references So I press Alt + M and press Ctrl + B to search my string ...
2
votes
1answer
36 views

How to debugging activeX with Ida

When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well. How can I see this ActiveX code(where ...
1
vote
0answers
24 views

What numeric properties are used in this Unsigned Integer (64bit) -> Floating Vector (128bit) conversion?

Recently I came across the following set of vector instructions: movq xmm0, rcx punpckldq xmm0, 0x4530000043300000 subpd xmm0, 0x4330000000000000 haddpd xmm0, xmm0 The only sensible ...
1
vote
2answers
43 views

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol ...
0
votes
1answer
31 views

Disassemble scanf storage register

I am trying to understand scanf function a have 3 question regarding it. this is c file: #include <stdio.h> #include <stdlib.h> int main(){ int x; printf("Enter X:\n"); scanf(...
2
votes
1answer
98 views

How to prevent Ghidra from removing unreachable blocks?

I am using this extension for loading PS-X executables: https://github.com/lab313ru/ghidra_psx_ldr During decompilation, Ghidra shows some of these warnings: WARNING: Removing unreachable block (...
1
vote
1answer
46 views

How are members of a Structure Type positioned on the stack?

Some of the structure types have members that are not stacked next to each other. Check out the structure type at 0x33E6 in bzip2_base (x86-64) here. There's an int at location offset 0, a char at 4 ...
1
vote
1answer
28 views

Wrong keyboard strokes sent to serial in putty

I am attempting to communicate to a device i have via the onboard rx/tx solder points i found on the board. I am doing this via an arduino uno. The problem i am having is that when i connect to it ...
0
votes
2answers
32 views

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS). push word ptr ds:8401h Since I have ...
0
votes
1answer
41 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
0
votes
0answers
33 views

Can onReceive Stalker callbacks be written in C/CModule?

I posted this exact question as a Frida Issue, but it is pretty inactive there. I have a CModule defined with a transform function and a onReceive callback function: void transform(...
1
vote
1answer
31 views

Displaying Operands as Position Independent in IDA

I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format' lea rdi, format However, when ...

15 30 50 per page