All Questions

0
votes
0answers
2 views

Identify ldfld reference in .NET when parsing GetILAsByteArray

I was experimenting with idea of decompiling a PowerShell cmdlet using reflection. While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this ...
0
votes
0answers
3 views

Glitch SPI flash

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...
0
votes
0answers
13 views

Is it possible to add new windows form control into compiled assembly using dnSpy?

I am trying to add another button into windows form using dnSpy. Is it possible to add another? I want the end result be like this one. Any help will be highly appreciated.Thanks
0
votes
0answers
11 views

Likely protocol determination by chip IDs and connections?

CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me. GOAL: Replace a damaged ...
0
votes
0answers
20 views

Crack software using ollydbg [on hold]

Does anyone know how to crack softwares otherwords debugging them and i tried to crack it using ollydbg but could not help myself in finding GETDLGITEMTEXT.Thank you.
0
votes
0answers
18 views

REing GameCube model (GCR) and texture (GCT) formats

I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
0
votes
0answers
14 views

How to change iOS registers automatically?

Let's say that there is an app that always passes integer 1 to a register, x1. I reverse engineered it, so I found its address, function, and everything. Is there a tool out there that allows me to ...
0
votes
0answers
26 views

Cramfsswap “Did not find the file…”

I try to get the files from a Firmwarefile but i have a problem with the cramfs. Here is what I tried: $ binwalk FW.ddi DECIMAL HEXADECIMAL DESCRIPTION -----------------------------------...
0
votes
0answers
19 views

IDA Python get struct type with dependencies

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
1answer
54 views

alphanumeric shellcode

I have generated an alphanumeric shellcode with this command: msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python I am targeting a 32 bits ...
0
votes
1answer
19 views

Idapython: adding links where a function address is loaded into a register

I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor. Unfortunately I can't get a copy of the original C compiler used in order to ...
0
votes
0answers
27 views

Legality on sharing rom dumps on abandoned hardware

I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that. How can I share my process and ...
-1
votes
0answers
34 views

Can any one please explain the following disassembly code [on hold]

I was learning x86 assembly and had huge difficulty in understanding many of these lines.
0
votes
0answers
12 views

How to use “handle SIGILL nostop noprint” with a gdbserver?

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...
-2
votes
0answers
29 views

Can anyone please explain this disassembly code? [on hold]

Disassembly: 0: 6a 05 push 0x5 2: 58 pop eax 3: 31 c9 xor ecx,ecx 5: 51 push ecx ...
2
votes
2answers
61 views

How can I find my variables in the running process?

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...
-1
votes
1answer
79 views

Can anyone please explain the following dissasembly codes?

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...
0
votes
1answer
49 views

why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?

the c code: void overflow (char* inbuf) { char buf[64]; strcpy(buf, inbuf); } int main (int argc, char** argv) { overflow(argv[1]); return 0; }
0
votes
1answer
31 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
-1
votes
2answers
53 views

CreateThread returns true but thread doesn't run

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...
0
votes
0answers
27 views

How to extract images/3d files from file loaded in runtime memory?

how would you dump runtime memory of a software (that has loaded 3d models and images) and then extract automatically the 3d models or images?
0
votes
0answers
17 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
0
votes
0answers
21 views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
55 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
0
votes
1answer
53 views

Help unpacking U-boot firmware

I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm). I have this tf_recovery.img that's supposedly a U-Boot image, but I can't unpack it either using dumpimage ...
1
vote
1answer
27 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
2answers
55 views

How to 'hack' the chat box in an online game

First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. I play an online game that is predominately played by Spanish speaking players. I'...
0
votes
1answer
81 views

How would I go about finding the 'flag' in this QR image(Capture the Flag)?

How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz ...
-1
votes
1answer
36 views

decomplied apk with bad parameters

I'm trying to reverse engineering an android app API so this is what I tried: First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...
0
votes
0answers
80 views

Reverse engineering a CRC in a RS485 communication

I have been struggling for a week now with reverse engineering a CRC byte in a serial communication of a digital pH probe. Here are some captured bytes from pooling the probe with the original ...
0
votes
1answer
75 views

x64dbg - Locating where data is initially written

I am hoping someone can help me with a question or two. Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...
0
votes
1answer
53 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
1
vote
1answer
46 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
1
vote
1answer
44 views

Is PNF's JEB Reverse Engineering platform written in pure Java?

I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro. While examining the earlier versions of JEB,...
1
vote
0answers
84 views

Password is right, but still wrong?

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
43 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
0
votes
0answers
26 views

Can I use a message structure thats reverse engineered

The dispaly interface is not open source. It talks to open source firmware on a controller board. My question is if I figure out the message structure can I use this with my own non opensource ...
1
vote
1answer
36 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
2answers
51 views

Calculation with not defined variables?

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...
1
vote
2answers
101 views

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...
1
vote
2answers
50 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
0
votes
0answers
57 views

Need help finding compression type used in flash image

I have tried multiple tools already like binwalk or trid hoping to find some information about the image. As far as I know the CPU used is from Imagination Technologies and uses some sort of RISC ...
1
vote
2answers
88 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
0answers
24 views

Directplay8 application

So I am working on an old application that use to run on Directplay8 now deprecated and the company who created this directplay8 game is out of business and has been for some years. I am writing a new ...
2
votes
1answer
61 views

Extract a secret from an Android apk or .so file

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
0answers
68 views

How to extract battle algorithms from an RPG?

I have Final Fantasy X HD Remaster that I'm using for this, as I find their systems quite interesting. Main goal for this is a personal project, but beyond it, it would help with the educational side ...
0
votes
0answers
20 views

Will an iOS app (IPA) that requires a login work if I repack it and install it on the device?

I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...
4
votes
0answers
49 views

How to reverse engineer an elliptical trainer? [closed]

I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful ...
0
votes
0answers
48 views

Disassembly and decryption of internal files of Unity game [closed]

I'm seeking for help and future direction for my work. I'm looking for game data of Ragnarok M: Eternal Love and stuck at point of decryption of LUA files. The game use SLua unity library (c++ ...
1
vote
1answer
48 views

How to convert hex data to decimal degree latitude and longitude? [closed]

I have been trying to decode GPS coordinates (latitude and longitude) which is in HEX format, and the documentation doesn't have a clear explanation, please help me out. I'm adding some examples below....

15 30 50 per page