All Questions

0
votes
1answer
58 views

exit() syscall within shellcode not working

int main() { char shellcode[] = "\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80"; int *ret; ret = (int *)&ret + 2; (*ret) = (int)shellcode; } I tried to run the above shellcode ...
0
votes
0answers
14 views

SIGBUS when trying to trace functions?

I am working on a crackme (Mach-O, mac app). Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
0
votes
0answers
45 views

Reverse engineer SharePoint hash algorithm

I'm trying to reverse engineer a hash algorithm used by SharePoint 2016 in MSSCrawlUrl database table. I would like to avoid discussions about the idea itself (which I agree goes against SharePoint ...
0
votes
0answers
29 views

OPENOCD Error codes: How do I fix this?

I have a chip I am trying to use JTAG communications with using openOCD. However, I get the following error: openocd -f ocd.cfg Open On-Chip Debugger 0.10.0 Licensed under GNU GPL v2 For bug reports,...
0
votes
1answer
76 views

What is this assembly doing?

I wrote a very basic crackme to learn how assembly works. Even though I wrote it myself, I am having some trouble understanding a few pieces of the assembly: What I know up to now is: [rbp+rax+...
1
vote
0answers
25 views

Is there any way to execute Hopper scripts from command line?

What should I do if I have a batch of binaries to decompile with Hopper? I know how to run a Hopper script in the UI interface, is there any way to run Hopper scripts from command line? Or any other ...
0
votes
1answer
99 views

Is there any decompiler, which can produce a compilable result?

I would like to decompile a 32bit linux executable to C, modify some parts of it, and then compile it back. I do not care if the C code is not pretty and really hard to maintain. The only thing I care ...
0
votes
2answers
131 views

How the CMP instruction uses condition flags?

I am trying to figure out the behavior of conditional jumps (JE/JNE, JZ/JNZ) in the x86 instruction set familly. Which condition flags CMP instruction sets and how, if the result is equal and if it ...
0
votes
0answers
50 views

How to decompile these LUAs from the Bookworm Adventures games?

I'm trying to decompile the LUCs (customly extensioned LUAs) from both of the games but they won't decompile, they aren't encrypted and use LUA version 5.0.2 (32-bit) according to the game's code. ...
1
vote
0answers
31 views

IDA map one memory address to another

I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
1
vote
1answer
29 views

What this “arw” line means when processing Mach-0 file with Radare2 or Rabin2?

Processing a Mach-0 file with Rabin2 I'm obtaining the following result: $ rabin2 -I mybinaryfile arw ...
0
votes
1answer
140 views

How to increase decompilation timeout in ghidra?

I'm trying to decompile a function with ghidra 9.0. After a (short) while, I get : Exception while decompiling 140062b00: process: timeout I already "succesfully" decompiled this function using IDA ...
0
votes
1answer
59 views

How does the x86 instruction, call 135b<__x86.get_pc_thunk.ax> work?

I think the below instruction is used for position independent code. Could anyone please help me understand how it works? call 135b<__x86.get_pc_thunk.ax> What are the use of the below ...
0
votes
1answer
59 views

x86-64 CALL opcode + disassembly

Working a basic buffer overflow on a 64bit system and putting together some basic shellcode. The main program does a call to puts@plt. When I disassemble main in gdb, the opcodes show as: e8 6b fe ff ...
0
votes
1answer
31 views

What is causing \r\n in libnotify? [closed]

I am trying to look under the hood of libnotify, and ran strace notify-send 'hello' and one of the system calls is: sendto(5, "AUTH\r\n", 6, MSG_NOSIGNAL, NULL, 0) = 6 Surrounded by a: sendmsg(5, {...
-2
votes
1answer
21 views

DT_DEBUG not filled on dlopen [closed]

A target library "lib42.so" has DT_DEBUG entry in the .dynamic section. After dlopen("lib42.so", RTLD_LOCAL | RTLD_NOW) succeded, r_debug->d_un.d_ptr is equal to zero. Why?
1
vote
0answers
57 views

Can anyone make much sense of this binary for an embedded system? [closed]

I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. ...
5
votes
1answer
534 views

Ghidra define c++ string

So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a basic_string class in the symbol tree. Now I want to define a std::...
0
votes
1answer
45 views

Is it possible to change a signed byte to an int in compiled assembly code?

I'm trying to mess around with an old game and I want to reposition a UI element. I found the address of where the x and y position get set (It's set to an X position of 90 and a Y position of 358) ...
0
votes
0answers
39 views

What is causing handles to be opened to crypto/RSA files when debugging with IDA?

When I debug an exe file in IDA and watch what happens in Procmon, I see a couple of calls to CreateFile C:\Users\UserName\AppData\Roaming\Microsoft C:\Users\UserName\AppData\Roaming\Microsoft\Crypto\...
2
votes
2answers
212 views

Can I stop Ghidra from creating extended references?

I'm trying to disassemble some 6502 using Ghidra. The following (prerequisites: POSIX-style shell, Python 2.x) will generate a file called test.dat that demonstrates the issue: python -c "open('test....
0
votes
1answer
29 views

Is there a way to see & keep track of registers in dnSpy?

Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
1
vote
1answer
46 views

Fork and Waitpid calls in a CTF linux binary

I'm doing one of my first linux crackmes. In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
1
vote
1answer
99 views

Does a symbolic disassembler exist?

I would like to know if there are disassemblers based on a symbolic analysis, I'm beginner in RE, but I think that a disassembler based on symbolic techniques can be very interesting and could ...
3
votes
1answer
68 views

How to use windbg to view assembly code of kernel function?

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
2
votes
0answers
43 views

Radare2 cannot place a breakpoint on a MIPS code

I am doing a crack-me challenge, I would like to execute it to see v0 and v1 values. This is the file command's output : ./ch27.bin: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), ...
1
vote
2answers
33 views

IDA - floating point operand type

How do I set the data to floating point number in quickier way than clicking on: Edit>Operand type>Number>Floating point I have a lot of wrongly detected casual DWORD's instead of Float's ...
0
votes
1answer
26 views

How to make IDA load headers of object files?

When I open an executable (a.out), I can see header info: But when I load an object file, headers and segments aren't loaded: The entire header section is skipped. It goes directly to main (starts ...
3
votes
1answer
266 views

How to display the CFG of a function in Ghidra?

I am currently trying Ghidra and, I am looking at a specific function. I have the assembly code and the decompiled version of it. But, I am looking to see if I can have it as a CFG... Does someone ...
1
vote
1answer
71 views

Reversing Arris BGW210 firmware

TL;DR: Trying to mount extracted ubi file system onto /dev/mtd0 gives me the error: libscan: scanning eraseblock 323 -- 100 % complete ubiformat: 324 eraseblocks are supposedly empty ubiformat: ...
0
votes
0answers
62 views

Decipher hexadecimal GPS coordinates from UDP message

I'm trying to get the GPS lat/long data from a UDP message. It's captured on a radio dispatch console on a P25 radio system, if that helps. I captured this UDP message when I sent a simulated ...
0
votes
2answers
53 views

IDA Pro not undefining assembly?

I am not sure if IDA is working correctly or not. I have the instructions call $+5 pop edi If I understand this correctly, the program will jump forward, skipping some junk interpreted as ...
0
votes
1answer
48 views

what does BYTES_REVERSED_HI and BYTES_REVERSED_LO in an PE signify

How can these pe attributes be used to identify malware. I was going though a paper link at page 10 he mentioned. "BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary ...
3
votes
0answers
108 views

Identifying a toner chip and it's communication protocol to re-program it

I need help identifying a chip and how to reset it from a new brother toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer. There is currently no information on ...
0
votes
0answers
44 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
1
vote
1answer
59 views

debugging with radare2

I am using radare2 for disassemble an x86 binary: $ r2 ./mynbinary [0x00001000]> aaa ... [0x00001000]> pdf ;-- section..text: ;-- section.LOAD1: ;-- rip: / (...
1
vote
1answer
50 views

2byte checksum for serial traffic

I'm working on an RFID reader that has partial implementation with ISO/IEC 14443-4 although not specifically compliant. I can decode a lot of the strings and understand the command base but I have not ...
2
votes
1answer
117 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
0
votes
1answer
61 views

Why Ida pseudo-code translate test as AND?

In IDA when disassembling a x86 EXE file there is a line test byte ptr [ebp+XXX], cl Before this line cl has a value of 0x11 The Hex-Rays decompiler plugin translates it as if (v10 &0x11). Why ...
6
votes
1answer
116 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
0
votes
0answers
35 views

Dumping flash from a running Cortex-M

I have a working device with a STM32F405ZGT6 in it. I want to dump the software it runs. As far as I can tell, there's no external flash on the device, so it must be running off of the internal flash....
2
votes
1answer
99 views

How to print eax value with Radare2?

I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
0
votes
0answers
27 views

Determining correct javascript file deobfuscation

I am trying to reverse engineer a game which sends it's data through an Obfuscate and DeObfuscate function to protect itself. The code base is 50k+ lines long (pretty printed), and eval techniques ...
1
vote
2answers
83 views

Recommended way to modify assembler instructions in IDA

What is the easiest way (or is there any) to modify an instruction inside a binary opened inside IDA and save the changes to the original? Is there a builtin assembler who's output I can place at a ...
0
votes
0answers
38 views

Handling __int64 in IDA?

This is probably something very easy that I'm missing. I have this operation length_of_userInput = (signed int)(unsigned __int8)userInput >> 1; And length_of_userInput is currently reading '...
1
vote
2answers
65 views

What does layout of Cutter/Radare2's function dissasembly mean?

Cutter displays functions like this: I'm having trouble understanding the layout of the functions For example: What does 184 mean? What does the green | mean at the beginning of each line? Why ...
0
votes
2answers
69 views

Bitwise operation between byte and 1?

I am having some trouble understanding what this is doing. This is the commented pseudocode. mightGetUserInput(&std::__1::cin, &userInput) ; this fills the buffer with the user input, ...
0
votes
1answer
78 views

Calling imported DLL functions from an injected DLL?

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions? I'm able to find the ...
0
votes
0answers
54 views

Reverse engineer 8 bit check sequence for old unkown protocol

I am using an old piece of hardware which uses an RS485 serial interface. I'm trying to simulate slave node data but I don't have any documentation on the protocol and unfortunately the hardware is ...
1
vote
0answers
63 views

Which architecture is this firmware?

I am currently investigating GSL touch-screen controllers firmwares. A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw In ...

15 30 50 per page