All Questions

0
votes
0answers
14 views

IDA change string in rdata

This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php? toquizwammer.github.io Thanks.
0
votes
0answers
15 views

Is it possible to call external functions?

I was wondering, assuming I wrote a dll in C++ and could access another application's memory, is it possible to call outside functions if I had the address?
0
votes
0answers
7 views

replace variable references with its values at once in javascript file

I'm trying to de-obfuscate a Javascript file: Javascript Obfuscated File I have already de-obfuscated the code but it's still hard to read. As you can see in the code below there is a huge list of ...
0
votes
0answers
11 views

Logging the Instruction Pointer Register

Is there a tool that logs the value the IP register of a specific process running? I am trying to compare the instruction excution before and after a file modification.
0
votes
0answers
27 views

Unable to extract IP camera firmware

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
0
votes
0answers
18 views

Decoding blob data from a sqlite database into readable format

I have a Sqlite database file that has blob data in it. I only know the the database has blob data and I know what the expected output should be. The blob data's expected output should be a Mac ...
0
votes
0answers
26 views

Do all games have static base addresses for values like gold and energy?

I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
0
votes
0answers
16 views

Intel prefixes instructions, checking optimisations problems

I wanted to learn more on ptrace's functions with x86_64 binaries, disassembling instructions. The goal is to check if a byte is one of instructions prefixes. I found some information in the Intel® ...
0
votes
0answers
13 views

Can't use J-Link with ADuC7126 evaluation board

I'm new to embedded, and would like your help. Using uVision/Keil I successfully flashed my ADuC7126 Evaluation Board using the micro-USB. I tried to use a mIDAS-Link JTAG (recognized as J-Link) ...
0
votes
1answer
65 views

ISO8859-1 serialization for strings

I am currently investigating a weird layout for storing of what appears to be strings (medical format). Looking at the dump for a bunch of those strings here is what I see: $ hexdump -C out0000 ...
1
vote
0answers
30 views

How to find the index of static ilbrary functions in the PLT of the binary?

So right now I'm trying to resolve function calls and their names in my reversing tool the problem I'm having is that library functions such as printf and fwrite and such do not have a corresponding ...
1
vote
3answers
53 views

Is the main function's name in the symbol table of C & C++ programs always 'main'? if not, how to find the name?

So I'm trying to write a reversing tool that parses symbol table to find the main function's address right now all the binaries I'm checking the name of main function is still main in symbol table ...
2
votes
0answers
54 views

Help needed to extract u-boot kernel & rootfs - iMX processor

I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive. This board is running a ARM CPU with 32MB of ram and has no vga output. The firmware update comes with 2 ...
0
votes
0answers
20 views

How can I know what the executable is missing to run?

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing ...
0
votes
0answers
17 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
43 views

What type of function gets called using a register instead of address in the binary? how to find the address statically?

So I'm trying to write a reversing tool right now and trying to make a CALL graph the problem I'm having is some calls are like Call *eax instead Call 'address' I can easily generate the call-graph ...
0
votes
1answer
51 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
0answers
25 views

Find offset in binary file

I have arm binary file that I can open with Ida, I want to find out the address of some bytes. When I load the binary with Ida there is Image base address that the binary lodded and the offset of the ...
0
votes
1answer
52 views

Bypassing anti-debugging

I'm trying to RE Stardew Valley to write cheats for it. The problem is that when I trace the pointers for my health/energy/etc... back more than one level the game crashes. It probably has some kind ...
2
votes
1answer
22 views

When reopening file lose all information in radare2

I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file. any help to avoid this?
0
votes
0answers
36 views

Red text Highlight in IDA Pro

Why do some command in IDA have red text highlight around them? e.g.
0
votes
1answer
24 views

Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs

I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
0
votes
0answers
25 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
0
votes
0answers
26 views

Log all syscalls inside a qemu vm

I am looking for a way to trace all syscalls which are triggered inside a qemu linux virtual machine. I have no strace command inside the linux vm Is there a way to do that ? Thanks
-2
votes
1answer
43 views

Can any one de-obfuscator this php code [on hold]

my developer has changed all his contact info and i am unable to contact him and i want to move my site to another server but because of this obfuscator code in my php script i am unable to move my ...
4
votes
1answer
47 views

GetWindowLongPtr with undocumented nIndex of -1

I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such: Does anybody know what that ...
0
votes
0answers
43 views

Edit unknown binary file

I have here an unknown binary file which contains a graphical user interface. The file has the ending .kzb and it comes from the Kanzi desinger. Unfortunately the Kanzi desinger can no longer edit the ...
0
votes
1answer
23 views

me_cleaner and fwupd, or manipulating UEFI .cab files

I'd like to extract a plain dump of the UEFI firmware of my laptop (1:1 copy of the flash content, often called .bin or .rom files) from the .cap file, so that I can modify it slightly with me_cleaner....
0
votes
1answer
45 views

Windows GUI app without GetMessage imported?

I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself. The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT ...
2
votes
1answer
77 views

IDA “unk_XXXXXX” meaning? [duplicate]

I am new to reverse engineering. Today when looking at IDA, I found this if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 ) but I dont understand the part "unk_4EDC58". So can you help me ? Thank ...
1
vote
1answer
84 views

How do tools like objdump find names of functions and their start address in ELF binaries?

I have written a ELF parser that disassmbles the .text section using capstone my problem is that i dont know how can i segment the text section based on functions and print the name of the function ...
4
votes
0answers
49 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
-2
votes
0answers
17 views

ARM binary running in VM with 8286 tcp port open [closed]

I'm researching some and i get this bin file. When is running, a 8286 tcp port open. I need some ideas to get control remotley. I need to know if it is posible to manipulate or something. Txs
1
vote
0answers
25 views

Help determining pinout for communications port

I have a Panasonic air conditioner that has a header on the mainboard that various optional (expensive) addon communications modules can connect into eg wifi The unit is a Panasonic Split system from ...
0
votes
1answer
77 views

Finding the correct emulator for programming a renesas sh7722 processor

I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
-1
votes
0answers
20 views

How Remove EX4 Expiration Date and Limitation? [closed]

I'm looking for a decompiler that can convert EX4 to MQ4 files it was easy before 600+ Compiler of MetaTrader 4 anyone knows some tools that i can do this?
1
vote
1answer
37 views

De-obfuscating code ran through JScrambler 3x via Eval() functions

I am relatively new to JS and de-obfuscation in general and I am having difficulties reversing some complicated JS. I know the code itself is obsfucated via jscrambler 3-4x and therefore is ran ...
1
vote
0answers
61 views

Debugging Ghidra Script

I want to write a new script for ghidra to extract variuous information from the binary and store it to an external file for future management. I need to perform the analyisis with Ghidra Headless in ...
0
votes
0answers
16 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
0
votes
2answers
47 views

Decode C# binary serialization data

I am trying to decode what seems to be simple C# binary serialization to disk: https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw https://github.com/malaterre/MMCPrivate/raw/master/...
0
votes
1answer
40 views

Best python framework/library for constructing the call-graph from binary?

So i have written a python tool using capstone that disassembles the code section of a ELF binary using capstone. now i want to also create and show the call-graph of this binary in a dot format, I ...
2
votes
1answer
47 views

What's the effect of adding a REP(N(E)) prefix to a JMP instruction?

I'm attempting to reverse engineer an executable packer, and I'm a little stumped on this x86 instruction: F2 EB F5 repne jmp short near ptr unk_88801B According to the Intel manual a repeat ...
1
vote
1answer
38 views

View Array Type in dnSpy

I'm debugging a .NET application and see a declaration of a local array: $ArrayType$$$BY05PAD $ArrayType$$$BY05PAD; I break on an instruction that uses data inside that (char*) array: num9 = <...
4
votes
1answer
41 views

How do I type in hex input into radare2 debug mode?

#include<stdio.h> #include<stdlib.h> int main() { puts("Enter input: "); char buf[100]; fgets(buf, 100, stdin); printf("%s", buf); } Suppose I am debugging a program, such ...
3
votes
1answer
38 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
1
vote
0answers
34 views

deobfuscating/decompiling extremely complicated javascript

I am working with some extremely complicated JavaScript. It is around 70,000 lines long and sections of the code look like this U2xx.l11="0x78920d50";m2xx.r9G="11";b2xx.v3y="0x744ebc37";P2xx.K5h="...
3
votes
4answers
2k views

Is it possible to build an equivalent function just looking at the input and output of the original function?

Imagine you are reverse engineering a software. This software uses a library, which is obfuscated and encrypted. The library contains a function, lets call it secret_function. This function is a pure ...
0
votes
0answers
14 views

How to sign IPA file after Patch? [closed]

I using MachOProtecter to remove some code from Macho Header, it work, but after i can't sign it with any re-sign tool. Any suggestion??? Many thanks
1
vote
1answer
28 views

Passing hex strings to Radare2

I can quickly test hex string arguments in gdb like this: r $'\x61\x61\x61\x61' I'd like to do something similar in radare2 but all I can figure out is regular strings: doo aaaa I tried this but ...
3
votes
2answers
104 views

The structure of the Python's marshaled code object (or .pyc file)

Help me to decipher the Python's marshaled code object. The .pyc files are almost the same: The structure of .pyc files. I have: The code object compiled from the source. The marshaled ...

15 30 50 per page