All Questions

900 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11
votes
0answers
405 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
11
votes
1answer
3k views

Howto clone Android RSA SecurID Software Token

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
8
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
8
votes
0answers
797 views

Reverse Engineering 2 byte checksum on RFID card

I am currently researching my studentcard. Money is stored on this card. But the vending machine also checks a checksum on the card. I already did a lot of effort to find it but didn't succeed. The ...
7
votes
1answer
146 views

Radare2 Call $+5 and register-based cross-references not found

I have a library of ~65MB which uses this "technique" as a kind of PIC. First, it gets some kind of base address (it is always the same): 0x00708497 e800000000 call 0x70849c 0x0070849c ...
7
votes
0answers
181 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
7
votes
0answers
237 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
7
votes
2answers
891 views

Automated Static Unpacking Binaries

I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
7
votes
0answers
757 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
6
votes
0answers
344 views

Firmware analysis, can't find file system

I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
6
votes
0answers
197 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
6
votes
0answers
556 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
6
votes
0answers
610 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
6
votes
0answers
342 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
6
votes
0answers
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
6
votes
1answer
4k views

What is a good and reliable C decompiler that support ELF and SH4 Architecture?

I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. I tried Reko Decompiler which said it does not support SH4 and Snowman ...
5
votes
0answers
638 views

Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)

I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
5
votes
0answers
632 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
5
votes
0answers
771 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
5
votes
0answers
4k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
5
votes
0answers
563 views

Reverse engineering an hydrometer's Bluetooth communication

This is a very specific question. I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
5
votes
0answers
179 views

How to find the symbol table in a TI DSP. (TMS320C5510)

That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
4
votes
1answer
270 views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
4
votes
1answer
320 views

How to dump firmware from car head-unit (VW Radio)

I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole ...
4
votes
0answers
329 views

Finding decompress algorithm for unknown compression

I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression. You can see the file here. I think they are using some kind of LZRW 1 ...
4
votes
2answers
247 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
4
votes
0answers
267 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
0answers
187 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
4
votes
0answers
271 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
4
votes
0answers
46 views

Reverse engineering Nord Lead 4 control board

I am reverse engineering a synthesizer named nord lead 4. I want to tap in between the control board and mainboard which has the microprocessor. I didn't start analyzing the signals on the board ...
4
votes
0answers
743 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
4
votes
0answers
388 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
4
votes
0answers
182 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
4
votes
0answers
299 views

Issues with reversing LZSS compression algorithm

I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this: I noticed a pattern that ...
4
votes
0answers
264 views

Trouble finding the right Checksum algorithm

After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now. I can't seem to find on which Checksum this code is based. Background This is a data ...
4
votes
0answers
262 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
4
votes
0answers
167 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
4
votes
0answers
94 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
4
votes
0answers
167 views

What is the pictured x86 technique/area called?

I've been reverse-engineering Windows PE files and I've discovered this pattern used quite often, making it a little more difficult to follow API calls. First, I'll go to the file's imports and then I ...
4
votes
0answers
215 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
4
votes
0answers
168 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
4
votes
0answers
663 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
4
votes
0answers
533 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
4
votes
0answers
3k views

Well-known JSON obfuscator that puts the string “Salted12” in front of obfuscated files?

I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be ...
4
votes
1answer
1k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
4
votes
0answers
391 views

Shotcuts in immunity debugger

Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
4
votes
0answers
758 views

Reverse Engineering XORed string

I am trying to reverse engineer some data received over serial port. The hardware sending the data consists of a gps, compass and a power monitoring unit (which sends information about the battery). ...
4
votes
0answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
4
votes
2answers
583 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
3
votes
0answers
37 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?

15 30 50 per page