All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
24 views

Dumping USB firmware

How do I dump the firmware of a USB stick? What are the steps and what tools do I need? I understand that I may have to take the USB stick apart.
0
votes
1answer
18 views

What's wrong with my mitm to support rr commands with gdbserver on IDA?

First of here is the gdb remote protocol doc. The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
2
votes
2answers
46 views

gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?

I am fairly new to RE and Binary Exploitation, I have learned basic assembly instructions for Binary Exploitation and I was doing Protostar exercises (stack0) in which I have to simply overflow the ...
0
votes
2answers
476 views

How to get better in re?

I'm a junior security researcher, and I'm interested in improving my ability in RE. I am a programmer at Assembly and C (and python and a few more high level lang). I learned and know how to use ...
0
votes
2answers
100 views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
0
votes
2answers
30 views

How to remove bytes/opcodes within IDA Pro database

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
1
vote
1answer
37 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
0
votes
1answer
31 views

x64dbgpy: application unresponsive when trying to automate inside breakpoint callback

When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
0
votes
1answer
48 views

How to use the libc.so.6 file?

I'm new to Linux operating system. Last day, I practice "heap exploitation", and they give me an elf file, and a "libc.so.6" file, and they said I must debug/exploit with that libc file, but I don't ...
1
vote
0answers
13 views

Angr Use argv as initialstate

I am currently trying to use angr, and I need to find a string "Done!" which results in the "good termination" of the program. The input is 32 bits and I need to know the input which leads to the "...
1
vote
2answers
49 views

Can I decompile a file if I have a compiler?

Is it possible to reverse the compiled code using a compiler? I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file. ...
2
votes
1answer
22 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
0
votes
2answers
56 views

Hex-Rays skips code

have using IDA Pro 6.8 (Hex-Rays 2.2), default settings. Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
2
votes
0answers
36 views

How to prepend offset to smart names?

So I'm trying to reassemble an PE to ELF so I can debug it with rr. However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
0
votes
0answers
20 views

<error sending command to monitor>

I'm trying to debug a backtrace created with rr so I type: rr replay -s 50505 -k it displays out: gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target Then ...
0
votes
0answers
31 views

Need help reversing .m4t TTML subtitles format

I am currently trying to create subtitles for some proprietary Sony software. Unfortunatly, it only recognizes Sony's own .m4t subtitles format. After some research I found that this subtitles is also ...
1
vote
1answer
58 views

PE32+ executable : .text segment encryption

I am working on PE segment encryption(in C++). I completed the PE32 .text segment encryption. I added stub segment to the PE that will decrypt .text segment at runtime. Used inline assembly in the ...
0
votes
0answers
22 views

Intel Pin assertion failed: RTN_Valid(x)

I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
0
votes
0answers
22 views

Radare2 produces null bytes on write

I've created a simple program in C that prints the text "Hello, World". I'm learning to use Radare and attempting to change the "Hello, World" string in the binary executable (PE in this case). But ...
0
votes
1answer
36 views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
0
votes
0answers
11 views

Building firmware.bin from mtd partitions

Working on reversing current router firmware here and I can't find any sources from the manufacturer for their firmware and toolchain. I wanted to do this approach. firmware.bin is loaded and ...
1
vote
1answer
183 views

Compressed PS2 .RAW File

I've been trying to translate Fullmetal Alchemist 3, i extracted the CFC.DIG file (Main data file) using a QuickBMS script. but now I'm stuck with these .Raw files from RACJIN games, [same case as ...
0
votes
1answer
42 views

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type: bool __thiscall Player::CanJump(Player *this) that I ...
0
votes
1answer
17 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
3
votes
2answers
78 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
0
votes
0answers
30 views

IDA search results debugging

I used IDA pro to search for some variables, that I know are present in the exe code (it is a function variable). However it doesn't relate to any function, so how can I make use of it and get the ...
0
votes
1answer
114 views

How to read firmware from an STC microcontroller?

I have some printed circuit boards of a device that is no longer manufactured. I need to repair these boards but there is no replacement for them. I can make other boards, buy the components, but I ...
0
votes
0answers
20 views

application does not start after resigning apk

I am trying do to some minor modifications (add a log line) to a third-party android application. However, the basic issue I am facing is that the application does not start, even when the only thing ...
0
votes
1answer
70 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
0answers
19 views

Deobfuscation of sojson or javascript-obfuscator

I'd like to know if there is some method or tool available to decode a javascript file encoded with sojson or javascript-obfuscator, at least to the point where someone can understand what the script ...
0
votes
1answer
68 views

How does ConfuserEx work and what to look out for?

I wanted to learn how to crack some .NET obfuscated programs and I'm wondering how does ConfuserEx (since that seems to be the state-of-the-art) work? What do I have to look out for and why? What ...
0
votes
0answers
27 views

ZynOS decompress tools

is there any tools for decompressing zynos firmware and compress it after edit little things in it ??? I have firmware called ras I'm trying to edit it but couldn't find any thing help it's for tp-...
0
votes
2answers
40 views

What's ScyllaHide's PDBReaderx64.exe Doing?

I just downloaded the binary of ScyllaHide for x64dbg. According to the instructions, I need to generate an NtApiCollection.ini file by running PDBReaderx64.exe or PDBReaderx86.exe. But I've got a ...
0
votes
0answers
50 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
3
votes
1answer
360 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
0
votes
0answers
12 views

Tenda AC10 rebranded firmware Reverse egineering help

So , I'm trying to extract the firmware for the Intelbras ACtion RG1200 , but I'm unable to acess the files. The ACtion is a rebrand from the popular Tenda AC10 that I'm able to extract and edit using ...
2
votes
4answers
735 views

Use ghidra decompiler with command line

Is there a way to run ghidra from command line ? GUI interface is very heavy. What i want is just to get functions list and decompile them in c. Thanks
0
votes
1answer
45 views

Ghidra does not display whole strings

It's pretty annoying. I think I might have changed some setting somewhere... Here's a screenshot of what I'm talking about. See all those "..." ? How do I turn that off ? Thanks in advance.
0
votes
2answers
143 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
0
votes
0answers
45 views

Compressed/encrypted game files [closed]

Hello guys im trying to mod dialogs in this pc game "https://store.steampowered.com/app/838310/Bloodstained_Curse_of_the_Moon/" so i went right for the game files, now just looking at the filenames ...
0
votes
1answer
61 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
74 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
0answers
33 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
1
vote
1answer
54 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
1answer
56 views

Converting 2 bytes into date

I am trying to convert the following bytes into their corresponding dates. I am not 100% on format the dates is stored, this format is returned from the application that read them. Bytes Date ...
0
votes
1answer
74 views

How to decrypt a file who encryption and key is unknown?

Here is the file that I am trying to findout a way to decrypt. settings.ini This file is from the settings of the MetaTrader 5. The same is the name of the application. Kindly suggest a better way so ...
0
votes
1answer
36 views

Why doesn't alloca_probe follow x64 calling convention?

I was practising reverse engineering on some Windows x64 applications when I came across this function: call alloca_probe This alloca_probe function has some strange implementation: EAX is used as ...
0
votes
1answer
98 views

Python Script to get disassembled output of an EXE file

I'm pretty new to Ghidra, and looking to use it's API (headless analyzer) and get the assembled file through command line using python. Here is my code, which is likely far from the correct code. It ...
1
vote
0answers
34 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
0
votes
1answer
131 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...

15 30 50 per page