All Questions

I was experimenting with idea of decompiling a PowerShell cmdlet using reflection. While I got some basics seem to work, how do I resolve the value in OperandField, for example ldfld cmd in this ...

I'm investigating the glitch attacks scenario and in particular, I read about the Nand Glitching with an example here. During my steps into reverse engineering a home router - you can read my steps ...

I am trying to add another button into windows form using dnSpy. Is it possible to add another? I want the end result be like this one. Any help will be highly appreciated.Thanks

CONTEXT: My first post in this stack. Absolute beginner at RE. Also generally a beginner at anything electronics. Please be kind and correct me instead of ridiculing me. GOAL: Replace a damaged ...

Does anyone know how to crack softwares otherwords debugging them and i tried to crack it using ollydbg but could not help myself in finding GETDLGITEMTEXT.Thank you.

I'm attempting to reverse engineer the mesh and texture formats used by the 2005 GameCube game "TimeSplitters: Future Perfect". Unfortunately, I'm not nearly good enough at this kind of thing to ...

Let's say that there is an app that always passes integer 1 to a register, x1. I reverse engineered it, so I found its address, function, and everything. Is there a tool out there that allows me to ...

I try to get the files from a Firmwarefile but i have a problem with the cramfs. Here is what I tried: $ binwalk FW.ddi DECIMAL HEXADECIMAL DESCRIPTION -----------------------------------...

Over the IDA Gui it is possible to export a local type with dependencies to a header file. For example if i export a struct that has one member from type DWORD than the header file also contains "...

I have generated an alphanumeric shellcode with this command: msfvenom -a x86 --platform linux -p linux/x86/exec CMD=/bin/sh -e x86/alpha_mixed BufferRegister=ECX -f python I am targeting a 32 bits ...

I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor. Unfortunately I can't get a copy of the original C compiler used in order to ...

I have an old piece of HP test gear from the 80's that HP no longer supports. I want to add in a feature and need to dump roms and figure things out to do that. How can I share my process and ...

I was learning x86 assembly and had huge difficulty in understanding many of these lines.

I have a program linked against libcrypto.so. If i run the program in gdb i'll get the following error: "Program received signal SIGILL, Illegal instruction." I researched a bit and found out that it ...

Disassembly: 0: 6a 05 push 0x5 2: 58 pop eax 3: 31 c9 xor ecx,ecx 5: 51 push ecx ...

I'm new with reversing and I did the following experiment just intent to help my understanding. I created a very simple 64-bit c++ program. #include <iostream> #include <string> using ...

Disassembly: 0: 31 c9 xor ecx,ecx 2: f7 e1 mul ecx 4: 51 push ecx 5: 68 2f 2f 73 68 push 0x68732f2f a: 68 2f 62 69 ...

the c code: void overflow (char* inbuf) { char buf[64]; strcpy(buf, inbuf); } int main (int argc, char** argv) { overflow(argv[1]); return 0; }

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...

I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions. The call to the CreateThread returns a valid handle ...

how would you dump runtime memory of a software (that has loaded 3d models and images) and then extract automatically the 3d models or images?

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...

I'm trying to unpack (extract) and analyse the firmware of an IP Camera (Xiaomi mjsxj02cm). I have this tf_recovery.img that's supposedly a U-Boot image, but I can't unpack it either using dumpimage ...

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...

First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. I play an online game that is predominately played by Spanish speaking players. I'...

How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz ...

I'm trying to reverse engineering an android app API so this is what I tried: First the app was using Okhttp certificate pinning and I couldn't track the URLs with Charles then I tried this method ...

I have been struggling for a week now with reverse engineering a CRC byte in a serial communication of a digital pH probe. Here are some captured bytes from pooling the probe with the original ...

I am hoping someone can help me with a question or two. Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...

I have seen the JEB decompiler by PNF Software morph from a specialised decompiler to a full fledged reverse engineering platform like Capstone or IDA Pro. While examining the earlier versions of JEB,...

i am trying to find the password of a binary with radare2 - a crackme again :-) I already thought I've found the password ('pass'), but this seems to be not the right one. Or there is a trick I didn'...

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...

The dispaly interface is not open source. It talks to open source firmware on a controller board. My question is if I figure out the message structure can I use this with my own non opensource ...

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...

I am new to reverse engineering and try to solve a crackme with radare2. My problem is understanding of the following lines: | 0x000007a9 c745b8000000. mov dword [var_48h], 0 | ...

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...

I have tried multiple tools already like binwalk or trid hoping to find some information about the image. As far as I know the CPU used is from Imagination Technologies and uses some sort of RISC ...

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....

So I am working on an old application that use to run on Directplay8 now deprecated and the company who created this directplay8 game is out of business and has been for some years. I am writing a new ...

Context As an exercise I am researching all methods of hiding a secret in an android mobile app binary... Yes I know that with more or less effort they can always be extracted with static analyses, ...

I have Final Fantasy X HD Remaster that I'm using for this, as I find their systems quite interesting. Main goal for this is a personal project, but beyond it, it would help with the educational side ...

I downloaded iOS WhatsApp from App Store, decrypted the binary, repacked it, and installed it back onto the device (deleting the app before installing). When I opened it, it only showed me a blank ...

I have a Schwinn 420 Elliptical Trainer (2012 model), and I want to reverse engineer it. Right now it has a big honking console that lets you increase/decrease the resistance and start a small handful ...

I'm seeking for help and future direction for my work. I'm looking for game data of Ragnarok M: Eternal Love and stuck at point of decryption of LUA files. The game use SLua unity library (c++ ...

I have been trying to decode GPS coordinates (latitude and longitude) which is in HEX format, and the documentation doesn't have a clear explanation, please help me out. I'm adding some examples below....