All Questions

I have seen one paper on decompiling C code and other software-based reverse engineering (of sorts) been done using machine learning (or claims on doing so). I am interested in finding out if the ...

I would like to reverse engineer and ultimately patch an application on my Amazon Firestick. To doo this, I want to analyze the app executable. I believe third-party apk's are stored in the /data ...

i have a lua file which is decrypted but after looking at normal decryptions for lua it seems that this file is encrypted in a different way or something else (not sure im new to lua and RE) ...

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?

I'm doing a search on how windows 10 saves hashed passwords in the SAM file. From this article I suppose that Windows does this: If the password is 123456 and the user has RID 000003E9: CALCULATION ...

I'm having some trouble building an app that gets data from a database to keep a log of files added to a website. Most URLs are generated from a file ID and a time stamp, some of those URLs are ...

I'm attempting to patch an old 16-bit windows 3 new executable binary which is in protected mode. It's a simple setup executable. Additionally, I'm doing this disassembly on linux and I've used ...

This is the error message that Im getting: Error loading kernel driver: CaptureProcessMonitor - 0x00000002 Could not open file: C:\Windows\system32\RegistryMonitor.exl Error loading kernel driver: ...

I'm trying to change an instruction in assembly. Try with test eax, eax to test eax, 1. I try modify the opcodes. For example opcode of test eax, eax: 85c0 Try to understand why is 85c0 with this ...

I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...

I am reverse engineering a network protocol (of a game) that is not byte-oriented but bit oriented. Each datagram is individually interpreted as a stream of bits. I have already reverse engineered a ...

Recently I decompressed an LZMA file from a VxWorks filesystem which was recognized and decompressed by the LZMA SDK with parameters lc = lp = 0, pb = 2 and dictionary size 8MB. When I recompressed it ...

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...

I'm looking at a firmware dump from a NAND flash chip and comparing it against another similar firmware dump I have. I am able to open one of them to see the root folder structure, however the other I ...

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...

The following call gets executed many times and jumps to many subroutines. “call [rbp+var_s38]” What do I need to write in the breakline condition to export all the locations it jumps to? import ...

I am working on a project that uses Perst as its persistence system. It stores the database in a file. Do you know any tools that can read/parse unknown Perst database files?

On a 16bit real mode x86 program I can locate a string that is displayed on screen. How do I go about finding all the places this string is called from to trace back the "print" function?

I am a new student in the field of cybersecurity. I would like to learn more about how virtualization used by software such as CodeVirtualizer and VMProtect works, and ideally to be able to ...

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...

I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly ...

I have an old application that stores the username and password in plaintext but encoded by an unknown encoding algorithm to me, it seams like base64, but I think it's not, It seams that any word ...

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...

I was trying to understand what segment of file gets loaded by fourth LOAD header on phdr array. First 6 headers are shown below from readelf Program Headers: Type Offset ...

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...

I'm working on reverse engineering a firmware which I was able to get its functions control flow graphs to display successfully on Ghidra. I am trying to see if there is a way to save those control ...

I am trying to decompile minecraft, to see if I can analyze the code to make a few small changes, but I need a decompiler good enough so I can recompile it in a way that will work. I have tried ...

Which libraries do you use to parse and statically analyze .NET binaries? Is there a python module, or do I have to use a .NET library such as dnlib? Does it make sense to write a python wrapper for ...

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...

kd> u win32k!impPsIsThreadTerminating+0xe4-c L5 | \ \ \ \ \ / \ \ \ \ \ / \ \ \ \ \ ...

So I have an ehi file, which is a configuration file for an Android App called HTTP Injector. Of course when I try to see it as a simple text, I just get random characters. What tool could I use to ...

I'm really interested in learning reverse engineering. Especially in regards to malware. Any help is much appreciated What should I learn before I start to learn reverse engineering? Is learning C/...

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. cseg04:3044 loc_105D4: ; ...

I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. The name didn't propagate over to the program, as you can see in the mov ...

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...

I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format. Some relevant information from the datasheet: ...

I have a zte zxhn h298a router. I got its all information by routerpassview with router serial number ( i think the number is magic key for file). I tried by phyton but i cant do it. Even if i got ...

When i see function like this, im getting confused, because all the strings i need in this function, but how can i find which functions which this strings? how can i know the address of the function ...

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....

I have the following blue color lamp that can move, play music and do a few other things. I'm quite sure it has a Firmware and it's reprogrammable. I'm looking for guidance on where should I look for ...

I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...

Decompiling a regular Android application I noticed that its code uses some native functions. So, unpacking the (.apk) file I found the usual "lib" folder and under that a series of folders for ...

I have the following instruction in IDAs Decompiler: result = data[3 * a1] + ptr; and would like to know what is at the position if a1=60. So I have to look at data[180]. Unfortunately all I see ...

Where could I find some advanced .net reversing techniques / tutorials. I'm trying to crack a .net application that's encrypted / obfuscated and packed with anti debug and code virtualization. I'm ...

Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php the problem is the api authors are ...

wondering if anybody here knows how to convert a set of hexadecimal leftover capture data to coordinates? I can only tell that its a bamboo tablet CTL-471. here's an example of some data, each of ...

Lately I’ve become interested in reverse-engineering the APIs used by the Nintendo Switch Online (NSO) services (especially to see if it would be plausible for me to access their Mario Maker 2 API ...