All Questions
5,715 questions
0
votes
0answers
3 views
Identify ldfld reference in .NET when parsing GetILAsByteArray
I was experimenting with idea of decompiling a PowerShell cmdlet using reflection.
While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this ...
0
votes
0answers
3 views
Glitch SPI flash
I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...
0
votes
0answers
13 views
Is it possible to add new windows form control into compiled assembly using dnSpy?
I am trying to add another button into windows form using dnSpy. Is it possible to add another?
I want the end result be like this one.
Any help will be highly appreciated.Thanks
0
votes
0answers
11 views
Likely protocol determination by chip IDs and connections?
CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me.
GOAL: Replace a damaged ...
0
votes
0answers
20 views
Crack software using ollydbg [on hold]
Does anyone know how to crack softwares otherwords debugging them and i tried to crack it using ollydbg but could not help myself in finding GETDLGITEMTEXT.Thank you.
0
votes
0answers
18 views
REing GameCube model (GCR) and texture (GCT) formats
I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...
0
votes
0answers
14 views
How to change iOS registers automatically?
Let's say that there is an app that always passes integer 1 to a register, x1. I reverse engineered it, so I found its address, function, and everything.
Is there a tool out there that allows me to ...
0
votes
0answers
26 views
Cramfsswap “Did not find the file…”
I try to get the files from a Firmwarefile but i have a problem with the cramfs.
Here is what I tried:
$ binwalk FW.ddi
DECIMAL HEXADECIMAL DESCRIPTION
-----------------------------------...
0
votes
0answers
19 views
IDA Python get struct type with dependencies
Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...
1
vote
1answer
54 views
alphanumeric shellcode
I have generated an alphanumeric shellcode with this command:
msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python
I am targeting a 32 bits ...
0
votes
1answer
19 views
Idapython: adding links where a function address is loaded into a register
I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor.
Unfortunately I can't get a copy of the original C compiler used in order to ...
0
votes
0answers
27 views
Legality on sharing rom dumps on abandoned hardware
I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that.
How can I share my process and ...
-1
votes
0answers
34 views
Can any one please explain the following disassembly code [on hold]
I was learning x86 assembly and had huge difficulty in understanding many of these lines.
0
votes
0answers
12 views
How to use “handle SIGILL nostop noprint” with a gdbserver?
I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error:
"Program received signal SIGILL, Illegal instruction."
I researched a bit and found out that it ...
-2
votes
0answers
29 views
Can anyone please explain this disassembly code? [on hold]
Disassembly:
0: 6a 05 push 0x5
2: 58 pop eax
3: 31 c9 xor ecx,ecx
5: 51 push ecx
...
2
votes
2answers
62 views
How can I find my variables in the running process?
I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program.
#include <iostream>
#include <string>
using ...
-1
votes
1answer
79 views
Can anyone please explain the following dissasembly codes?
Disassembly:
0: 31 c9 xor ecx,ecx
2: f7 e1 mul ecx
4: 51 push ecx
5: 68 2f 2f 73 68 push 0x68732f2f
a: 68 2f 62 69 ...
0
votes
1answer
49 views
why does the following non stack shellcode load /bin/sh string without pushing it onto the Stack?
the c code:
void overflow (char* inbuf)
{
char buf[64];
strcpy(buf, inbuf);
}
int main (int argc, char** argv)
{
overflow(argv[1]);
return 0;
}
0
votes
1answer
31 views
How to load a color theme correctly in IDAPro?
I work late nights and a dark theme like this would be nice with IDAPro.
I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
-1
votes
2answers
53 views
CreateThread returns true but thread doesn't run
I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.
The call to the CreateThread returns a valid handle ...
0
votes
0answers
27 views
How to extract images/3d files from file loaded in runtime memory?
how would you dump runtime memory of a software (that has loaded 3d models and images) and then extract automatically the 3d models or images?
0
votes
0answers
18 views
How to figure out what happens during <ModuleEntryPoint> in OLLYDBG
So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
0
votes
0answers
21 views
Finding lua C functions compiled binary
So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
1
vote
1answer
55 views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
0
votes
1answer
53 views
Help unpacking U-boot firmware
I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm).
I have this tf_recovery.img that's supposedly a U-Boot image, but I can't unpack it either using dumpimage ...
1
vote
1answer
27 views
Compare two traces from ollydbg
I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
0
votes
2answers
55 views
How to 'hack' the chat box in an online game
First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent.
I play an online game that is predominately played by Spanish speaking players. I'...
0
votes
1answer
81 views
How would I go about finding the 'flag' in this QR image(Capture the Flag)?
How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz
...
-1
votes
1answer
36 views
decomplied apk with bad parameters
I'm trying to reverse engineering an android app API so this is what I tried:
First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...
0
votes
0answers
81 views
Reverse engineering a CRC in a RS485 communication
I have been struggling for a week now with reverse engineering a CRC byte in a serial communication of a digital pH probe.
Here are some captured bytes from pooling the probe with the original ...
0
votes
1answer
75 views
x64dbg - Locating where data is initially written
I am hoping someone can help me with a question or two.
Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...
0
votes
1answer
53 views
Compressed PS2 .RAW File
I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
1
vote
1answer
46 views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
1
vote
1answer
44 views
Is PNF's JEB Reverse Engineering platform written in pure Java?
I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro.
While examining the earlier versions of JEB,...
1
vote
0answers
84 views
Password is right, but still wrong?
i am trying to find the password of a binary with radare2 - a crackme again :-)
I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...
1
vote
0answers
43 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
0
votes
0answers
26 views
Can I use a message structure thats reverse engineered
The dispaly interface is not open source. It talks to open source firmware on a controller board. My question is if I figure out the message structure can I use this with my own non opensource ...
1
vote
1answer
36 views
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
2answers
51 views
Calculation with not defined variables?
I am new to reverse engineering and try to solve a crackme with radare2.
My problem is understanding of the following lines:
| 0x000007a9 c745b8000000. mov dword [var_48h], 0
| ...
1
vote
2answers
101 views
IDA Hex-Rays: How to SAFELY fix incorrect function declarations?
Update:
The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions:
.text:00403F2F 074 ...
1
vote
2answers
50 views
Generate software breakpoint other than int3
Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example?
If so, I was wondering why debuggers don't support generating ...
0
votes
0answers
57 views
Need help finding compression type used in flash image
I have tried multiple tools already like binwalk or trid hoping to find some information about the image.
As far as I know the CPU used is from Imagination Technologies and uses some sort of RISC ...
1
vote
2answers
88 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
0answers
24 views
Directplay8 application
So I am working on an old application that use to run on Directplay8 now deprecated and the company who created this directplay8 game is out of business and has been for some years. I am writing a new ...
2
votes
1answer
61 views
Extract a secret from an Android apk or .so file
Context
As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...
0
votes
0answers
68 views
How to extract battle algorithms from an RPG?
I have Final Fantasy X HD Remaster that I'm using for this, as I find their systems quite interesting. Main goal for this is a personal project, but beyond it, it would help with the educational side ...
0
votes
0answers
20 views
Will an iOS app (IPA) that requires a login work if I repack it and install it on the device?
I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...
4
votes
0answers
49 views
How to reverse engineer an elliptical trainer? [closed]
I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful ...
0
votes
0answers
48 views
Disassembly and decryption of internal files of Unity game [closed]
I'm seeking for help and future direction for my work.
I'm looking for game data of Ragnarok M: Eternal Love and stuck at point of decryption of LUA files.
The game use SLua unity library (c++ ...
1
vote
1answer
48 views
How to convert hex data to decimal degree latitude and longitude? [closed]
I have been trying to decode GPS coordinates (latitude and longitude) which is in HEX format, and the documentation doesn't have a clear explanation, please help me out. I'm adding some examples below....