All Questions

3
votes
1answer
77 views

Undocumented MSR Machine Specific register

I'm reversing the BIOS of my laptop, for fun and for learning something new. Inside it, I just stepped into this piece of code: mov ecx, 13Ah rdmsr and eax, 1 jnz SkipCacheAsRAM Looking ...
1
vote
1answer
54 views

IDA - large jump table, missing cases in analysis

I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
0
votes
1answer
55 views

Reverse Engineering Grocery Software API

Introduction So I have a peer to peer app that allows customers to request jobs at their own price and have the job fulfilled by a freelancer in the community. The common jobs requested as of recent ...
0
votes
1answer
58 views

rip adress not visible with dr command

I just finished this challenge. This is the content of main function : [0x08048a86]> pdf / (fcn) main 417 | main (int argc, char **argv, char **envp); | ; var int local_16h @ ebp-0x16 |...
0
votes
1answer
55 views

How to identify which iOS kernelcache is installed?

I've an iPhone7 running iOS11.3 (15E216). The ipsw for this build version contains two separate kernelcache files named kernelcache.release.iphone9 and kernelcache.release.iphone10. Neither file is an ...
-2
votes
1answer
47 views

Why dont use memcpy? [closed]

Why using memcpy can cause to stack overFlow? memcpy get the number of bytes to copy, so what is the problem , and how memcpy_s fix it?
0
votes
2answers
122 views

How to identify base64 encode/decode in assembly

How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that? FindCrypt2 Ida plugin not find that
0
votes
2answers
52 views

capturing the sub processes's PID of a process

When a program is executed, some processes may be created by the parent process. Especially, if a program is malware, created (or forked or even injected) sub-processes will be named as a systemic ...
0
votes
1answer
57 views

Show arguments while debugging

I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program. Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
3
votes
1answer
150 views

How to dump firmware from car head-unit (VW Radio)

I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole ...
1
vote
1answer
37 views

UE Megaboom serial protocol

I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control ...
0
votes
1answer
92 views

how to get per-function memory accesses using PIN tool

I am modifying PIN's proccount sample to get the memory access information per function VOID Routine(RTN rtn, VOID *v) { // Allocate a counter for this routine RTN_COUNT * rc = new ...
0
votes
1answer
116 views

Meaning of cmp byte ptr [EBP-9], 0

Looking to find the meaning of this statement. From what I understand its comparing 0 with value of EBP register - 9, but I don't understand what the byte ptr does.
2
votes
1answer
55 views

Debug point not hit with radare2

I am doing this reverse engenering challenge. I executed theses commands to analyse the main function : radare2.exe ch15.exe aaa s main pdf This is the output of the pdf command : [0x004017b8]> ...
1
vote
0answers
56 views

Detect compression algorithm in .NPK archive

I'am trying to unpack Android game archive file (.NPK). The game is "Nvidia Glowball demo" (it has been pre-installed on my android tablet) Archive structure seems to be simple, but I can't ...
2
votes
0answers
53 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
1
vote
2answers
123 views

Lots of mov instructions into ebp+offset - What is happening?

While learning RE I have come across this large segment of instructions that contains a majority of mov [ebp+offset], value instructions. I believe that ebp + offset are local variables? I think? ...
0
votes
1answer
78 views

Confused about a firmware binary

I'm trying to reverse engineer an ARM Thumb2 firmware binary, and I've come across a few oddities. Parts of the file when treated as RGB binary data form perfect images, which seems unusual for a ...
0
votes
1answer
85 views

IDA Interpreting mov instructions in a unusual way

When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset. Hex rerpresentation: 8B 40 0A Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
2
votes
2answers
135 views

Why are there so much more functions in ida than my source code?

I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
2
votes
1answer
50 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
1
vote
1answer
147 views

How to reverse engineer a Black Box?

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console. I have already ...
0
votes
1answer
33 views

How to determine number and/or boundaries of linked object files in a PE generated by Visual Studio 6?

In this analysis of a Portable Executable linked using Microsoft Linker (6.0), down in the Imported Objects section, the website makes some very specific claims: 3 .OBJ Files (COFF) linked with LINK....
6
votes
1answer
280 views

Simplifying assembly

I'm analysing some binary trace, it's pretty much obfuscated. What I need to do is to understand work flow of its alghoritms. However I cannot find any reliable tool which would help me with that. I ...
3
votes
1answer
115 views

How to wrap dump process and execute it in another PC

I debug exe file in Ida , and put breakpoint in some address. I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
0
votes
2answers
62 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
1
vote
1answer
52 views

What are those instructions doing?

I'm having a hard time figuring out whatever the hell this is doing. mov rax, [rbp+var_720] mov [rbp+var_458], rax mov rax, [rbp+var_458] mov [rbp+command_], rax mov rax, [rbp+...
1
vote
1answer
81 views

Can't find debugger in IDA PRO menu

I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files. This is an example when I didn't load any .exe: This is another example when ...
1
vote
0answers
36 views

Android APK is somehow verifying package signatures without calling PackageManager.signatures

I'm reverse engineering a very popular Android app. They perform some type of signature verification on the APK, however they do it without: Calling PackageManager.signatures Calling PackageInfo....
0
votes
2answers
91 views

RSA Decryption? [closed]

I am playing a game in my university where you have different puzzles based on cryptography and now in a puzzle named 'rsa', we have 2 files: 'key', 'secret'. The task for this is to decrypt the ...
1
vote
0answers
55 views

.fpk firmware unpacking

I am working on firmware update file prod-build-Isat2-V02.00.03-DFU.fp2 . I extracted it and I've got some bin files. I analyzed these binary files with binwalk binwalk -E RDA-533.bin . The entropy ...
4
votes
1answer
72 views

Help with a pointer

Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily. In CheatEngine, 028FA190+374 is pointing to 028F1788. ...
1
vote
1answer
90 views

How to decompile ARM (iOS) to Objective-C using IDA?

What are the options to decompile ARM (iOS) to Objective-C using IDA? I've been looking into the REobjc module (https://github.com/duo-labs/idapython), but it can only handle x64 code. Are there ...
2
votes
1answer
100 views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" via the Java Native Interface. My Problem is: The ...
0
votes
1answer
76 views

How do I interpret the mangled functions name?

I am going to start by saying that this is my fourth attempt at reverse engineering a crackme and I'm starting to understand how assembly works, which is cool. I am sorry if this question is wrong or ...
2
votes
2answers
148 views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
2
votes
1answer
83 views

Reversing PE32 executable - CTF Question

So we were playing CTF , and we found this interesting RE challenge . And when we did a statical analysis to the file we found an interesting for loop . for (var_84 = 0x0; var_84 < 0x13; var_84 = ...
2
votes
1answer
53 views

What is __sighandler_t struct and purpose of SIGTRAP signal handler

I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value : .text:08048063 ...
2
votes
1answer
38 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
0
votes
1answer
59 views

Sentinel HASP Hardlock - Where is the Secure Storage Located on disk

I have a provisional license for a program attached to a specific computer. The license according to hasp resides in the "secure storage of your pc" does anyone know where this is? If I reset the pc ...
2
votes
1answer
48 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
1
vote
0answers
25 views

Instrumentation fail when app use far jump 0x33 crash

Do you known any dbi tool that support instrumentation of application that use far jump 0x33? P.S. pin, dymanoRIO don't support far jump 0x33.
0
votes
1answer
111 views

pwntools shellcode narnia2

I'm trying to solve the narnia2 challenge on overthewire. I read a guide for help and managed to overwrite the stack with A's using some python $(python -c "print 'A'*132 + '\xef\xbe\xad\xde'") ...
-1
votes
1answer
65 views

Strange Message after manipulating an exe file

i debugged und reversed an exe file with x64dbg I simply changed an assembly command (je) into nop , patched the file and saved it under a different name. (only one line was changed) When i tried to ...
4
votes
3answers
153 views

How to run part of exe file that is being reversed

I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it. How can I run an exe file from a specific ...
1
vote
1answer
46 views

Explenation about opcode and operand

I need an explanation about the term "opcode". I have found this : An opcode is binary or hex value of the machine instruction in the cpu instruction set. If I understand correctly the ...
1
vote
1answer
141 views

Impossible to execute a program with radare2 : TO DO continue

I am trying to crack a crackme. I already catch the flag because I seen the string variable which represants flag. I would like to catch the flag on an other way, I want to set a breakpoint when there ...
0
votes
1answer
45 views

How to copy video address from tweet?

Twitter has an option to right-click on a video and "copy video address" but this button seems to be broken as it doesn't copy anything to the clipboard, even after I disable Ghostery/adblock. I ...
2
votes
1answer
94 views

How to save (trace) the execution route/sequences in debugger and Replay?

is it possible to save the step-by-step execution route of the program? i.e. lets say in x64dbg the program executes one handle after another and so on, probably hundreds of calls... But according ...
1
vote
1answer
76 views

What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?

I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...

15 30 50 per page