All Questions

1
vote
1answer
40 views

What does Scylla/ImpRec are doing? How to reconstruct imports?

Mostly in the tutorials they are telling to use this tool and that tool to magically apply something and make XY work & run. I would love to know how these things are working, how is import ...
1
vote
2answers
57 views

What is this assembly in the `__common` section doing?

I have stumbled upon this: public _oret __common:0000000100018000 _oret: __common:0000000100018000 sub [rdi+4Fh], al __common:0000000100018003 db 4Fh __common:...
0
votes
1answer
31 views

How do I set the return type for this type declaration?

I have a function that seems to calculate the length of a string. I have made this type declaration and it does kind of work as IDA now flags the string correctly. __int64 __fastcall strlen(char ...
0
votes
0answers
58 views

What is this function doing?

I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm. And this is the relevant assembly: mov rdi, [rbp+var_A80] mov rsi, [rbp+var_A88] ...
0
votes
0answers
29 views

Find functions names in .init_array section in unstripped library

Is it possible to find out all instances of static initialization in a elf dynamic library. I can dump the array of function pointers in .init_array section via objdump command like this. objdump -s -...
0
votes
0answers
61 views

Finding function call (with arguments) in ELF file

I have two kinds of ELF files, built from C++. .so files: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, BuildID[sha1]=5e751e769912aef28bc63b888e5e4904b867a180, ...
1
vote
0answers
53 views

1990s non windows software keys [closed]

Hi I am a Service Engineer on some very old ASML stppers that run a system called PAS (Philips automated steppers), these steppers are obsoleted by the manufacturer and no longer supported by anyone. ...
1
vote
2answers
140 views

Assembly that just seems to be a jumble

I've disassembled an old DOS program into assembly and I'm trying to figure out a function call. Here is the ASM: seg000:373C ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦...
1
vote
0answers
68 views

Dump packed dll

I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone ...
0
votes
0answers
20 views

How can I edit .dlls that I see in VS 9 Object Browser, but do not show in VS 2017(only shows version information) [duplicate]

I was given an old server (win server 2008) with old software someone would like to make a change on. After unzipping the .CABs I get a bunch of .dlls that I can view in the servers VS 9 Object ...
7
votes
2answers
1k views

What's this assembly doing?

I have been trying to figure out the assembly for part of a DOS game and there is an operation that keeps getting called that uses all 4 registers. I can see what each line does but I can't for the ...
1
vote
1answer
79 views

How to use aaa in radare2 while in -d (debug) mode?

This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
0
votes
0answers
24 views

How to generate .TEXT only asm output in IDM?

So I tried to do File -> Produce File -> Create ASM File. There are lots of dd stuff that I don't want. So now, what I need is, either an android app where I can view that .asm file ...
1
vote
1answer
64 views

why saved rip changed by push?

I am doing a reverse homework. see the following pictures: as can be seen from this picture, before call push touch3, "saved rip" is at 0x5561dca8, which is equal to the current rsp(0x5561dca8). ...
0
votes
2answers
69 views

fakenet for apps using SSL

With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data ...
0
votes
1answer
87 views

Windows 10 will not run hex edited application

I'm in a reverse engineering class. Our current assignment is to edit a notepad.exe application. Just to start out, I opened my notepad.exe in FlexHex, went to the end of the.rsrc section, changed a ...
1
vote
0answers
29 views

How can I see specific memory value by using Hex view in IDA?

I'm about to use IDA pro. I have to access to 0018F42C(EAX) by using Hex view in IDA. Maybe I guess there is EAX value.(String is "happyy", standard input) but Hex view shows me 0018F410 as in screen1....
0
votes
1answer
87 views

Tricore debugging tools

I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM. Now I would like to learn about Tricore reverse engineering... ECUs mainly. I can obtain the ECU ...
1
vote
0answers
41 views

Saving IDA Graph to PDF format?

I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that? I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
1
vote
0answers
57 views

Need help understanding basic buffer overflow

So I have this sample problem that I need to buffer overflow. Its an elf file that require to be run on a separate terminal then using "nc localhost 'port' " on a separate terminal we can see the ...
1
vote
1answer
59 views

(CTF) Speed up assembly by hooking to an static function

For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
0
votes
1answer
112 views

Reverse engineering checksum from RS-485 device

Attempting to reverse-engineer a checksum for a serial timing device that updates a display. Protocol is partly understood, however the checksum calculation specified does not produce the expected ...
0
votes
0answers
19 views

javascript hook comparisons

Look at this very basic javascript code: if (s=='abcd') { if (s2='cdef') { ... } } I want to hook all tests: I want to get this: (s,'==','abcd') (s2,'==','cdef') Is there a way ...
0
votes
0answers
75 views

Finding lua addresses with ida

I tried to find lua_pcall, lua_newthread, luaL_loadbuffer, lua_tolstring, lua_pushcclosure and lua_pushinteger functions with IDA decompiler but I didn't find them. Can someone please tell me what is ...
0
votes
1answer
50 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
0
votes
1answer
60 views

Switching from seg to text in IDA-View

actually i don't know where the problem but i will describe it I am trying to analyse the firmware of a router and i could extract it and i got these files libxmlapi.so libhttpapi.so libcfmapi.so ...
0
votes
0answers
38 views

Taking a luac file and making a modification

I have a luac file for a program I use. I'd like to make a modification to this file to call a function from another luac script. My understanding of the way luac works is the first few bytes are the ...
1
vote
1answer
21 views

Identify ldfld reference in .NET when parsing GetILAsByteArray

I was experimenting with idea of decompiling a PowerShell cmdlet using reflection. While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this ...
0
votes
1answer
67 views

Glitch attack on a SPI flash eeprom

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...
0
votes
1answer
74 views

What methods exist for adding new windows form controls into compiled assembly using dnSpy?

I am trying to add another button into windows form using dnSpy. Is it possible to add another? I want the end result be like this one. Any help will be highly appreciated.Thanks
1
vote
0answers
37 views

Likely protocol determination by chip IDs and connections?

CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me. GOAL: Replace a damaged ...
1
vote
0answers
62 views

REing GameCube model (GCR) and texture (GCT) formats

I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
0
votes
0answers
17 views

How to change iOS registers automatically?

Let's say that there is an app that always passes integer 1 to a register, x1. I reverse engineered it, so I found its address, function, and everything. Is there a tool out there that allows me to ...
0
votes
0answers
48 views

Cramfsswap “Did not find the file…”

I try to get the files from a Firmwarefile but i have a problem with the cramfs. Here is what I tried: $ binwalk FW.ddi DECIMAL HEXADECIMAL DESCRIPTION -----------------------------------...
2
votes
1answer
49 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
1answer
94 views

alphanumeric shellcode

I have generated an alphanumeric shellcode with this command: msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python I am targeting a 32 bits ...
1
vote
2answers
45 views

Idapython: adding links where a function address is loaded into a register

I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor. Unfortunately I can't get a copy of the original C compiler used in order to ...
1
vote
0answers
37 views

Legality on sharing rom dumps on abandoned hardware

I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that. How can I share my process and ...
1
vote
0answers
45 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
2
votes
2answers
99 views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
-1
votes
1answer
99 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
0
votes
1answer
69 views

why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?

the c code: void overflow (char* inbuf) { char buf[64]; strcpy(buf, inbuf); } int main (int argc, char** argv) { overflow(argv[1]); return 0; }
0
votes
1answer
104 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
-1
votes
2answers
85 views

CreateThread returns true but thread doesn't run [closed]

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
0
votes
0answers
32 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
0answers
63 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
69 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
3answers
187 views

Help unpacking U-boot firmware

I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm). I have this tf_recovery.img that's supposedly a U-Boot image, but I can't unpack it either using dumpimage ...
1
vote
1answer
56 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
2answers
118 views

How to 'hack' the chat box in an online game

First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. I play an online game that is predominately played by Spanish speaking players. I'...

15 30 50 per page