All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Can machine learning be used to simulate the working of an actual machine?

I have seen one paper on decompiling C code and other software-based reverse engineering (of sorts) been done using machine learning (or claims on doing so). I am interested in finding out if the ...
0
votes
1answer
14 views

Firestick get application binary

I would like to reverse engineer and ultimately patch an application on my Amazon Firestick. To doo this, I want to analyze the app executable. I believe third-party apk's are stored in the /data ...
0
votes
0answers
36 views

Decrypting LUA File

i have a lua file which is decrypted but after looking at normal decryptions for lua it seems that this file is encrypted in a different way or something else (not sure im new to lua and RE) ...
0
votes
0answers
27 views

Advanced Anti-Debugging Techniques

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
0
votes
0answers
28 views

How does windows 10 v.1803 save the password in the SAM file?

I'm doing a search on how windows 10 saves hashed passwords in the SAM file. From this article I suppose that Windows does this: If the password is 123456 and the user has RID 000003E9: CALCULATION ...
0
votes
0answers
24 views

Need help identifying a -possibly- encrypted string

I'm having some trouble building an app that gets data from a database to keep a log of files added to a website. Most URLs are generated from a file ID and a time stamp, some of those URLs are ...
1
vote
1answer
25 views

How to determine target of far call in Windows 3 16-bit protected mode binary

I'm attempting to patch an old 16-bit windows 3 new executable binary which is in protected mode. It's a simple setup executable. Additionally, I'm doing this disassembly on linux and I've used ...
0
votes
1answer
25 views

What would i have to do to get capturebat.exe to work on windows 10?

This is the error message that Im getting: Error loading kernel driver: CaptureProcessMonitor - 0x00000002 Could not open file: C:\Windows\system32\RegistryMonitor.exl Error loading kernel driver: ...
0
votes
1answer
64 views

Change instruction test eax, eax to text eax, 1

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 Try to understand why is 85c0 with this ...
1
vote
2answers
40 views

Bochs x86 16bit and IDA dissasembly

I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...
0
votes
0answers
34 views

How to facilitate reverse engineering the syntax of a bit stream

I am reverse engineering a network protocol (of a game) that is not byte-oriented but bit oriented. Each datagram is individually interpreted as a stream of bits. I have already reverse engineered a ...
1
vote
0answers
17 views

Recreated LZMA differs from the original after 332 bytes

Recently I decompressed an LZMA file from a VxWorks filesystem which was recognized and decompressed by the LZMA SDK with parameters lc = lp = 0, pb = 2 and dictionary size 8MB. When I recompressed it ...
1
vote
0answers
53 views

Static binary instrumentation

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
0
votes
1answer
22 views

SqashFS 3.0 file system has 40 “random” bytes of 0xFF in it

I'm looking at a firmware dump from a NAND flash chip and comparing it against another similar firmware dump I have. I am able to open one of them to see the root folder structure, however the other I ...
1
vote
1answer
25 views

What is an “mpi register base”?

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
0
votes
1answer
21 views

IDAPython newbie question

The following call gets executed many times and jumps to many subroutines. “call [rbp+var_s38]” What do I need to write in the breakline condition to export all the locations it jumps to? import ...
0
votes
0answers
9 views

Recover data from .NET Perst database file

I am working on a project that uses Perst as its persistence system. It stores the database in a file. Do you know any tools that can read/parse unknown Perst database files?
0
votes
1answer
30 views

Find the call function of a string

On a 16bit real mode x86 program I can locate a string that is displayed on screen. How do I go about finding all the places this string is called from to trace back the "print" function?
1
vote
0answers
30 views

How to virtualize part of a code like VMProtect does?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...
1
vote
0answers
38 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
0
votes
1answer
47 views

Change IDA pro dissassembly to linear sweep

I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly ...
2
votes
2answers
150 views

How to identify the encoding performed on this string

I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not, It seams that any word ...
0
votes
1answer
57 views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
2
votes
0answers
21 views

What is actually loaded here and different hexdump outputs on util-linux hexdump and on cutter and ghidra's hexdump

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...
1
vote
2answers
44 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
5
votes
1answer
143 views

Any reason why Ghidra is screwing with this byte in this dissassembly?

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...
2
votes
2answers
64 views

Save Ghidra's control flow graph into a parsable format

I'm working on reverse engineering a firmware which I was able to get its functions control flow graphs to display successfully on Ghidra. I am trying to see if there is a way to save those control ...
2
votes
1answer
67 views

Are there any Java decompilers accurate enough that if I recompiled the result, it should be identical to the original program?

I am trying to decompile minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...
1
vote
0answers
17 views

Parse / statically analyzing .NET binaries using python

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...
0
votes
1answer
26 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
1
vote
1answer
32 views

What does -c mean in this Windbg Command Syntax?

kd> u win32k!impPsIsThreadTerminating+0xe4-c L5 | \ \ \ \ \ / \ \ \ \ \ / \ \ \ \ \ ...
1
vote
0answers
24 views

Obfuscated Config Files: EHI Files for HTTP Injector

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...
1
vote
3answers
181 views

Cyber security student wanting to start learning reverse engineering [duplicate]

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...
0
votes
2answers
44 views

Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. cseg04:3044 loc_105D4: ; ...
0
votes
1answer
39 views

Why won't IDA let me name this variable?

I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. The name didn't propagate over to the program, as you can see in the mov ...
1
vote
1answer
24 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
0
votes
1answer
31 views

Building micro controller memory image in IDA

I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format. Some relevant information from the datasheet: ...
0
votes
0answers
80 views

Router config.bin file edit?

I have a zte zxhn h298a router. I got its all information by routerpassview with router serial number ( i think the number is magic key for file). I tried by phyton but i cant do it. Even if i got ...
0
votes
1answer
45 views

How to find who use these strings?

When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function ...
0
votes
0answers
22 views

IDA taking forever to run autoanalysis on remote Android app?

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
1
vote
1answer
31 views

Dumping and reprogramming the firmware of DarenWaves

I have the following blue color lamp that can move, play music and do a few other things. I'm quite sure it has a Firmware and it's reprogrammable. I'm looking for guidance on where should I look for ...
0
votes
0answers
39 views

Save ida64 database as 32-bit

I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?
1
vote
1answer
40 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
2answers
76 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
1
vote
0answers
47 views

Calling functions of a shared object (.so) extracted from an APK

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...
0
votes
1answer
26 views

IDA Pro jump to offset of DWORD

I have the following instruction in IDAs Decompiler: result = data[3 * a1] + ptr; and would like to know what is at the position if a1=60. So I have to look at data[180]. Unfortunately all I see ...
0
votes
0answers
62 views

Advanced .Net Reverse Engineering [on hold]

Where could I find some advanced .net reversing techniques / tutorials. I'm trying to crack a .net application that's encrypted / obfuscated and packed with anti debug and code virtualization. I'm ...
1
vote
0answers
37 views

Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible)

Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php the problem is the api authors are ...
0
votes
0answers
20 views

converting tablet hexadecimal data to coordinates?

wondering if anybody here knows how to convert a set of hexadecimal leftover capture data to coordinates? I can only tell that its a bamboo tablet CTL-471. here's an example of some data, each of ...
2
votes
0answers
43 views

Can a device be forced to stop using SSL?

Lately I’ve become interested in reverse-engineering the APIs used by the Nintendo Switch Online (NSO) services (especially to see if it would be plausible for me to access their Mario Maker 2 API ...

15 30 50 per page