All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
22 views

Is there a way to export all the strings for a certain module in x64dbg?

I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...
3
votes
1answer
157 views

ELF x86 - Why is return address pushed twice?

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there. main: lea ecx, [esp+0x4 {argc}] and esp, 0xfffffff0 ...
1
vote
0answers
51 views

How does IDA provide function names to dynamic calls?

I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to 004019c0. Looking in IDA I notice ...
2
votes
0answers
56 views

radare2 wrong output

I saw rasm2 giving different output each time for x64 Take a look at this: C:\WINDOWS\system32>rasm2 -a x86 -b 64 -d "41f6c7FF" test r15b, 0xff C:\WINDOWS\system32>rasm2 -a x86 -b 64 "test ...
1
vote
0answers
58 views

How to Dump a locked PIC

I have tried these few days to read a PIC18F microcontroller which is locked.it says all protected (0000 E0FF 40FF).then i found out that it is possible to bypass the CRP on some of these ...
1
vote
0answers
71 views

Find File System in Firmware

This is my first attempt at working with firmware. We have some SNMP cards that are flaky & my ultimate goal is to try to make them better. The current firmware version is 12.06.0069. When ...
1
vote
0answers
105 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
0
votes
0answers
49 views

I have a .exe program file compiled using Intel Fortran 8.1. for windows 10. Can I edit the code off the .exe file?

I have a .exe program file compiled using Intel Fortran 8.1 for Windows under WinXP with 64-bit Windows 10 system. Can I edit the code off the .exe file? I need to change a value in the code. Thank ...
3
votes
1answer
104 views

How to identify memory access locations

I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I ...
2
votes
1answer
59 views

Invert stack view in radare2

Is it possible to invert the stack view when debugging in radare2 such that higher addresses are at the top?
0
votes
1answer
51 views

Large number of exports defined in a PE .exe file

I have a (non-malicious) PE exe that I'm analyzing, which is using the Themida/WinLicense packer and noticed that it has 479 defined exports, which seems odd for an exe. Some of the functions are ...
1
vote
1answer
127 views

Changing entry-point of and ELF file

I'm trying to conduct a little experiment which basically consists of changing the EP of an ELF file and executing an exit(9) syscall, without returning to the OEP. As shown in the image everything ...
1
vote
1answer
42 views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
3
votes
0answers
71 views

How does cartridge protection distinguish an original vs fake cartridge?

Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. What is ...
1
vote
0answers
62 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
0
votes
1answer
49 views

accessing nt!Kd_DEFAULT_MASK using dbh.exe

I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the ...
2
votes
0answers
49 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
1
vote
1answer
98 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with virtual machine : the problem is it's not opcode anymore it's bytecode which I don't have any idea about because it's a private virtual ...
1
vote
0answers
34 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
0
votes
1answer
88 views

Storing a string with with x64dbg

I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point. Do I just have to add it to a ...
0
votes
1answer
62 views

What does ds mean?

When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address. But what does mov ds:[address] 0xAA mean?
1
vote
2answers
136 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
0
votes
0answers
61 views

Reverse engineering .NET malware - iloveyou.exe

I have a .NET malware sample whose dynamic behavior I understand. It is also packed. de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
0
votes
1answer
94 views

What does this function actually do?

I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes ...
-1
votes
1answer
124 views

How reverse a stripped binary (Find the main function)

I'm learning the reverse, and I'm trying to reverse a stripped binary (flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped). I manage to go to the entry address ...
2
votes
0answers
99 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
1
vote
1answer
107 views

Call Stack vs Intermodular Calls in Ollydbg

What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
2
votes
0answers
110 views

Decompress from file with crush32

I have some files *.bli, *.ilg, *.pix, etc. These files are from technical documentation LinkOne, and compressed with old C/Win32 compression library crush32.dll. information can be found here ...
1
vote
0answers
39 views

How is sprintf() identified by IDApro? [closed]

#include<stdio.h> int main() { char buffer[50]; int a = 10, b = 20, c; c = a + b; sprintf(buffer, "Sum of %d and %d is %d", a, b, c); // The string "sum of 10 and 20 is 30" ...
1
vote
0answers
91 views

How to export to *.so file after patching in ghidra

I'm using ghidra to patch an *.so file in the Android APK. While exporting the patched file from ghidra, using the "Export program" option from the "File" menu, it don't have *.so in the supported "...
3
votes
1answer
78 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
2
votes
2answers
148 views

Translating a Korean Exclusive PS2 game ~ hangeul encoding?

I got my hands on a copy of Mystic Nights, a survival horror game for the PS2 realeased exclusively in Korea. The game's text is all in Hangeul (Korean writting system). I extracted the ISO and ...
0
votes
0answers
25 views

All referenced strings using ollydbg

i was trying to search for "All referenced strings using ollydbg v1.10 and got some error "could not read memory of debugged processt(77550000..77626fff) kindly help me solve the problem.[ ][1]
1
vote
1answer
78 views

Which file system is this? file type 0x00, folder type 0x01

Inside a internet radio firmware file I found a file system, and I don't know which one it is. What I know: (The first two bytes are 0A 4C (maybe magic byte)) they are actually not part of the file ...
2
votes
2answers
90 views

GetProcAddress with 0 as lpProcName

I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code. The binary is a 10 level reversing game where you get ...
1
vote
1answer
38 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
0
votes
1answer
130 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
40 views

Is it possible to proxify custom windows application without installing any additional software (programatically)

Is it possible somehow to set reverse proxy for a windows application (e.g. by creating a wrapper launcher for this application) that will proxify all HTTP/S requests of this application?
1
vote
1answer
82 views

eip register address not matching with address at breakpoint (breakpoint set at main function)

I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below (gdb) disass main Dump of ...
2
votes
0answers
41 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
1
vote
1answer
64 views

picoCTF be-quick-or-be-dead-1 dcrypt simulation with python

This is be-quick-or-be-dead-1 in picoCTF challenge (Download) in this file we can see decrypt_flag() function, this function return this flag: ./be-quick-or-be-dead-1 Calculating key... Done ...
1
vote
0answers
22 views

Using an arduino or raspberry pi, how can I drive and control a proprietary diehen servomotor?

I’m trying to resurrect this robot from Daihen-I need to determine how this proprietary motor and encoder are wired. Anyone got experience with this?
2
votes
0answers
89 views

Renaming shadowed variables in Ghidra

I'm working on a function in the Ghidra decompiler with a bunch of variables that are re-used across different scopes. I don't see any way to rename this variable on a per-line basis. Is it possible?
1
vote
0answers
64 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. The decoder contains a web server that makes sending/receiving information through the Internet possible. To do so I need to sniff the packets that the ...
2
votes
0answers
90 views

Automate looking for calls to an offset of a structure

I want to automate the search for function calls to a function that does not live in the binary and where the function address is passed, via a pointer to a struct, at runtime through a function ...
0
votes
0answers
77 views

unsquashfs failed to read SquashFS file

I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor. binwalk ...
2
votes
1answer
107 views

Explanation of heap shaping technique and how it is different from heap spraying

Recent RDP vulnerability and exploits have mentioned the use of heap shaping technique. Can anyone please explain in details what is actually involved in using this tactic. Thanks
1
vote
0answers
26 views

Unable to attach java sources to APK being debugged in Android Studio — Option not displayed

This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
2
votes
0answers
58 views

How can I spoof WMI data?

I want to add a fake KB to the OS, and see it using wmic qfe list. So do you know how can I create a faked KB? Or if it is possible to cause WMI to report a specific KB?
1
vote
1answer
41 views

MEMORY macro in IDA Pro pseudocode

I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example: int S_u8init_flag = 0; // ...

15 30 50 per page