All Questions

Filter by
Sorted by
Tagged with
1
vote
2answers
8k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ....
0
votes
1answer
148 views

Best way to protect source code of exe that being loaded by Assembly.Load method

I am protecting an exe that being loaded by Assembly.Load... This makes everything difficult because most obfuscators causing it to not work properly or not load at all. I used confuserEx Ameteurz ...
-1
votes
0answers
13 views

Decompiling open source apps

What or where would be a good place to start for a beginner in regards to learning how to add/change the original functioning of an app/apk? I am currently learning how to program & I understand ...
1
vote
2answers
506 views

find cheat engine pointers in ghidra

I find a pointer of my health so a function would have made the pointer and put the health in it (tell me if I'm wrong) how do I look for the function?
0
votes
1answer
36 views

How to found signature xxtea for lua

I not found signature in libgame.so [libgame.so] (https://easyupload.io/oh94nx) And get key for lua (FFSZ) I found xxtea_decrypt (https://pastebin.com/PVS8YXyV) And found xxtea_encrypt (https://...
2
votes
0answers
461 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
0
votes
0answers
15 views

extract firmware from .p7b file

how to extract unsigned firmware from .p7b file? (signed firmware)
0
votes
0answers
25 views

Which languages can be compiled to binary (asm)?

I am doing reverse works such as convert asm to high level code. So I want to collect data to analyze their characteristics. Now I know c/cpp, go, rust will be compiled to binary, anything else?
1
vote
1answer
96 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
0
votes
1answer
41 views

decoding thread context structure in x64dbg

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
1
vote
1answer
42 views

What's purpose of mov ebx, [esp+0]?

I'm disassembling one SO library for fun and was wondering what's purpose of following procedure: sub_3699 proc near mov ebx, [esp+0] retn sub_3699 endp It's widely used across entire library ...
0
votes
1answer
254 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
1
vote
1answer
459 views

Debug 3rd-party apk with .so-files missing debug symbols

Apologies, if this has been asked before. I am reverse engineering a chinese app that connects to a BLE device, so I can inspect how it transmits the data. Using this official guide I decompiled my ...
0
votes
0answers
26 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
0
votes
1answer
25 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
0answers
25 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
0
votes
0answers
32 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
1
vote
0answers
31 views

Bypassing unsupported android TV box!

I have an android TV box called Proximus decoder v4, anyway the android TV box is not supported anymore by the company. When I turn it on I get an update checking, you can't even cancel it, and then I ...
0
votes
1answer
47 views

Reading from buffer and printing output to a text file

00001f10 2846 mov r0, r5 00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0} 00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} ...
1
vote
0answers
2k views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
0
votes
1answer
28 views

ida pro: dwarf fatal error; the dwarf plugin will stop now

I recently observed this bug (error), when I upgraded gcc/g++ from version 9.x to 11.x. Basically, Ida fails to parse debug information. I don't get this error when I compile with gcc 9.x. Note that, ...
0
votes
0answers
42 views

Does loading custom PDB help reversing behemoth program?

What I reverse : Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost. It(they) has the mixtures of their custom structures, classes and directX sdk ...
2
votes
1answer
26 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
0
votes
0answers
60 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
0
votes
0answers
26 views

Decompiled VB 6.0 Application Call Statement

I decompiled a VB application using VB Decompiler pro. It contains the following call statements: Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98)) Can you please ...
1
vote
1answer
178 views

ghidra rename fails

With ghidra 9.2.1 (2020 dec 15) in a decompiled dll, I can rename a variable with L. Sometimes (can't find a repro), when I rename a second local variable (it does not appear in listing/assembly), ...
0
votes
2answers
271 views

Reverse Engineering Javascript - Out of Memory

I found this javascript file on one of those online movie streaming services and was interested in finding out what it does. However, after trying many deobfuscators I am still stuck. A major ...
0
votes
1answer
41 views

Can't find references (xref) to function

I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA. Is there a plug-in or something that I ...
1
vote
1answer
77 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
1
vote
1answer
158 views

convert C++ code to python code

while I'm doing RE using ghidra i saw this code byte bVar1; byte bVar2; uint uVar3; uVar3 = 0; while (bVar2 = (byte)uVar3, (char)bVar2 < '\b') { bVar1 = *(byte *)(uVar3 + param_1) ^...
0
votes
2answers
98 views

Correct target of absolute jmp in IDA

In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution: F000:FEFF : mmap'ed location of function ...
2
votes
2answers
415 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
-2
votes
0answers
42 views

How to find key and signature in APK file

I'm having trouble finding the key and sign to decrypt my program. I have tried everything like IDA but to no avail Link apk file: https://drive.google.com/file/d/1YNNcsFXxJ11ciVUSzxwAUukU06DWUws0/...
1
vote
0answers
23 views

How to derive a state diagram from existing source code

to;dr; What tools or smart method can I use to derive a state (transition) overview from source code with 10 binary and three 16-bit input variables, and several output variables, both 16-bit and ...
1
vote
1answer
164 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
0
votes
1answer
56 views

What is most likely the reason causing this problem?

I'm trying to reverse engineering a obfuscated game, and when I import this related .so file into IDA, it output this : What technique is most likely been used in achieving such obfuscation ?
0
votes
1answer
40 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
0
votes
1answer
148 views

What is the obfuscation method utilised in Playdead's 'LIMBO' video game?

The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
1
vote
0answers
93 views

What type of file has the file signature 'BOOT'?

I have a .bin file which I am trying to disassemble into something that I can edit. Given that binary files can contain just about any binary data, I found it difficult to assess what file data is ...
0
votes
0answers
24 views

How to force IDA to analyze a function immediately?

I think my question is probably related to this one: API to force reanalyze of function (Alt-P) When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
0
votes
0answers
20 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
5
votes
2answers
12k views

Import table vs Import Address Table

What's the difference between the Import Table and the Import Address Table?
0
votes
2answers
201 views

What should I learn in order to reverse elf64 binary files

I'm a little confused. I am using a Linux based system (Ubuntu), 64-bit. and I want to start and reverse 64elf binary files, but there is a lot of things I want to know before. just to be clear, If I ...
0
votes
1answer
27 views

function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?

I need urgent help , I was debugging a software made by Visual basic 6 , and I found vbavarindexload function and I need to know what is doing ? Thanks in advance
-2
votes
0answers
37 views

Need help in assembly language to crack password using IDA

I have to crack the password from the assembly code using IDA. I don't know how to work with it. I was wondering if someone can please help me with this, I would really appreciate it.
1
vote
1answer
16 views

Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?

Background: The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
1
vote
1answer
28 views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
0
votes
0answers
37 views

I have this question here that is solved with assembly language and I want to convert it to C language, Can someone help? [closed]

Question: 3. Write an assembly code to light up alternate LEDs continuously starting with LED1. Use the given Delay routine. LED1 LED2 LED3 ON OFF OFF Delay OFF ON OFF Delay OFF OFF ...
0
votes
0answers
34 views

What is .pb file format?

TL;DR: What file format is this (if it's not a private file format) and how do I parse it? Before I say anything I want to say that I am new to reverse engineering and StackExchange. I am trying to ...
0
votes
0answers
17 views

Extract RFS (rootfs) on UBIFS NAND Dump

I am practicing (studying) hardware reverse engineering. I dumped a NAND flash (smart TV), and managed to remove OOB data and emulate NAND in my environment. I detected that NAND used UBI filesystem, ...

15 30 50 per page
1
2 3 4 5
167