All Questions

Filter by
Sorted by
Tagged with
1
vote
0answers
32 views

Need help : restoring a netgear dgn1000 v3 adsl modem/router

coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909 currently have serial console but i may have borked the u-boot looking for help on how to ...
0
votes
0answers
66 views

R13 off by 2 bytes. Any help?

in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable. I have overwritten RIP register with the address of "...
1
vote
0answers
65 views

Using IDA to find pointer passed to procedure

Loading the source into IDA, I have this function: According to the source for Lua, this function should be passed a pointer to the Lua_State struct: LUA_API int lua_gettop (lua_State *L) { return ...
0
votes
0answers
35 views

Reverse engineering a nexus freescale microcontroller

I'm facing an issue for the past few days.i want to read and write the firmware from a freescale microcontroller MPC 5500,I bought OSBDM interface and it read it successfully using codewarrior.the ...
0
votes
0answers
45 views

How would I sniff kline data packets

I have a board that is using kline to communicate and I have a tool that can read the software from that board. I want to see the communication that is happening between the two to see how the tool is ...
0
votes
0answers
143 views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
2
votes
1answer
311 views

Can Ghidra show me the p-code generated for an instruction?

I'm trying to verify the correctness of a custom processor module in Ghidra. The instruction that I am currently analyzing does some fancy stuff with its p-code. Specifically, it uses a bunch of ...
1
vote
0answers
62 views

Reversing ELF 64-bit LSB pie executable [duplicate]

I have a file crackme, which is an executable. hamuto@hamuto-pc:~/Security/NOOB/FruitSalad$ file crackme crackme: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, ...
1
vote
0answers
24 views

WinDbg does not shows all first chance exceptions

I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this: [14:29:38] Exception: E06D7363.?AVCServicesMDException@@ [14:29:38] Exception: E06D7363.?...
0
votes
0answers
25 views

Detecting what causes edited Javascript file to crash entire browser tab

I'm currently trying to debug a Javascript game that's been made with Haxe 3.4.7. When I'm trying to override the .js file locally, my entire browser seems to crash, or simply not load. I'm thinking ...
2
votes
1answer
123 views

Is this really a function IDA could not decode?

I have the following IDA output: BEGTEXT:00415A2C read_dpc_sub_415928 endp BEGTEXT:00415A2C BEGTEXT:00415A2C ; --------------------------------------------------------------------------- BEGTEXT:...
3
votes
1answer
97 views

String Encoding and Decoding Method

so I came across the following string encoding method in python. def encode(the_string): encoded_string = '' rotations = ord(the_string[-1]) + 5 for i in range(0, len(the_string)): ...
0
votes
0answers
37 views

what is Ida Name Tab

I know what is Function tab (show all function) and what is String tab(show all string) and Import , Export .... But what is Name tab? what should I expect see there? and how Ida get this information ...
1
vote
0answers
138 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
0
votes
0answers
50 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
25 views

Changing a string pointer while debugging

I'm facing an issue, and I'm not sure what is the best way to handle it. While debugging a program (x64, windows), the program copies certain string using errno_t strncpy_s(char *restrict dest, ...
0
votes
1answer
88 views

How to find out address in binary file (like IDA) with python code only?

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
0answers
43 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
0
votes
1answer
77 views

Is it possible to detect visual studio version in compiled .net assembly?

I have a .net exe file I want to find out which version of visual studio is used to compile the assembly.. Is there are any solution to find out the IDE version.?
1
vote
0answers
52 views

How can I extract resource images from Visual Basic 6 Malware

I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I ...
0
votes
0answers
26 views

Can't install sasquatch tool

Ubuntu 16.04 LTS. I'm trying to install sasquatch tool (which should apply patches to the standard unsquashfs utility), but got the issue, every time build process show error in one place: ./build.sh:...
0
votes
1answer
164 views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
0
votes
0answers
35 views

(Help)Apk Decomplied unreadable files

I'm developing an android-based game for my school project. I chose an .apk to reference the visual parts. I've decompiled the .apk file I've specified. I can't view the image files I need. files ...
0
votes
1answer
41 views

How to view registers values in string

Is it possible that radare2 will show registers values also in strings ? For example, when I run ar I am getting the liste of registers and I have: rax = 0x000000042 Is there a way to also show ...
1
vote
1answer
61 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
1
vote
0answers
64 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
0
votes
0answers
12 views

Forwarding Debug messages to winDbg from specific processes

The command ed nt!Kd_Default_Mask 8 in winDbg will get all printouts that generate from OutputDebugStringW from remote machine to the console But In my scenario there are significantly large number ...
0
votes
1answer
106 views

Ida - what is Parse C header file

In ida File->Load file there is option Parse C header file, I want to understand that . If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
2
votes
1answer
201 views

How do I make a hex literal a decimal literal in Ghidra?

There are a few places where the decompiler displays a number as a hex literal when it's much clearer as a decimal literal. How do I change this?
2
votes
1answer
46 views

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here: https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241 https://...
0
votes
1answer
28 views

getting ecx register from caller

i need to get the ecx register from the function that is calling my function (__fastcall convention) i've been trying to get ecx by adding 0x8 to ebp since from my understanding ebp + 0x4 = return ...
1
vote
0answers
83 views

Handling pointer to middle of struct in Ghidra

Sometimes I encounter pointers to the middle of a structure, and the code uses a negative offset to refer to earlier code. This can result in assembly that looks like this, using MIPS as an example ...
-1
votes
1answer
81 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
3
votes
0answers
154 views

Ghidra rename variable below current line

I have been starting to use Ghidra and I find the decompiler view very useful. However, when I rename a variable, the name propagates through all uses of that register or stack pointer throughout the ...
3
votes
1answer
68 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
1
vote
0answers
38 views

Help investigating a printer firmware image

We're having issues with the WiFi connectivity on the printers that we're using on a current project. The printer connects fine, but the ports that should be opened are not opened. They work fine on ...
0
votes
1answer
177 views

Ghidra pseudocode to Java/C

I have this piece of code generated from Ghidra void __cdecl FUNCTION(uint *key,uint *text) { undefined uVar1; ushort uVar2; uint *puVar3; uint *puVar4; uint *puVar5; int iVar6; uint ...
1
vote
0answers
42 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
0
votes
0answers
95 views

Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container

The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original ...
0
votes
0answers
31 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
3
votes
1answer
481 views

How do I import function signatures to Ghidra?

I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
0
votes
0answers
40 views

How to read firmware from an STC microcontroller?

I have some printed circuit boards of a device that is no longer manufactured. I need to repair these boards but there is no replacement for them. I can make other boards, buy the components, but I ...
1
vote
0answers
13 views

How to programmatically add HTML DOM breakpoints in chromium?

I've seen from this post about Chromium DevTools that there exists the possibility to add DOM breakpoints. Given that I've a full range of elements to monitor I was trying to find a way to ...
0
votes
1answer
63 views

How to find the starting address of main function when the binary is stripped and _start doesn't push the absolute address value of main?

So let's say the ELF binary is stripped - meaning no symbol table - and the _start function doesn't push the address of main before calling __libc_start_main. This happened in a binary when compiled ...
0
votes
1answer
68 views

Difficulty decrypting LCG string

I'm trying to analyze some malware. To get the hang of it I am following the decoding process on this website: Here is a description of the string encoding/decoding process: String encoding ...
1
vote
0answers
41 views

How to choose a .NET software protector which will have a small impact on run-time performance speed? [closed]

I am writing a .NET software which is doing calculations and drawing in real-time i.e when the user is moving the mouse. I want to protect this software from being reverse engineered and restrict its ...
1
vote
1answer
100 views

Difficulty in debugging with dnSpy

I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed ...
0
votes
1answer
35 views

How to increment and decrement machine code in radare2?

I watched a video (I believe it was a talk by the author of radare2) of how to increment machine code in radare2 very easily, simply by hitting 'c' and then using + and - to respectively increment and ...
1
vote
0answers
210 views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
0
votes
1answer
134 views

How can I follow virtual function calls in IDA?

I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with ...

15 30 50 per page