All Questions
9,518
questions
0
votes
0
answers
2
views
Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom
I hope you all are doing well and staying safe.
I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
- 1
0
votes
0
answers
13
views
Recognize API calls of an APK
I have an Apk file for an app that functions as an AI image generator. I want to identify the specific API call responsible for the AI image generation.
How can I do it?
- 101
0
votes
0
answers
5
views
Need help when reading .sam file of cocos2D game
so recently I tried to reverse a dead game apk to get their animation cause it's so unique that me and my friend want to remake it.
But it took so long to just take each part of the image and combine ...
- 11
0
votes
1
answer
54
views
.NET Packer/Protector
I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection
...
- 36.4k
0
votes
1
answer
27
views
Microchip ATSAME70Q21-CN unable to connect with JTAG or SWD
First time delving into hardware reverse engineering and can't seem to connect using JTAG nor SWD. I found two identical devices that I'm trying to understand how they work and see if I can extract ...
- 36.4k
0
votes
0
answers
26
views
What does this string mean?
Disclaimer: I am not gonna paste the whole string just in case it contains sensitive data.
The thing is, I have this string I got from a response's payload, and I am trying to understand what it is. I ...
- 1
1
vote
2
answers
5k
views
Is deobfuscation of my javascript code hard or easy?
I am trying to protect my app code from theft. Since most of it is written in javascript I had to use many obfuscation techniques to make it incomprehensible.
I have written a very small piece of ...
- 1
0
votes
1
answer
47
views
When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?
IDA has the ability to parse C header files (by now a secondary option based on Clang also exists). It is useful to get structs and enums into your database via the Local Types view.
Question: Aside ...
- 36.4k
0
votes
0
answers
35
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
2
votes
1
answer
173
views
Marking DAT section as shellcode in ghidra
I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
CommunityBot
- 1
4
votes
3
answers
2k
views
Unknown CRC calculation
I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes ...
0
votes
0
answers
16
views
Extracting pwsafe.key from memory dump
I am at uni and we have been given coursework to do. This is not asked of us but its something extra i want to try. on the encase image we have been given there is a database.kdb file which i have ...
0
votes
1
answer
168
views
How could I extract a certificate and private key out of a exe?
I’m trying to get API responses from a backend service to make a server emulator for a game called NBA 2k17, but I can't get to them cause they are encrypted so I need to impersonate the client to get ...
CommunityBot
- 1
0
votes
0
answers
31
views
Is game hacking all about memory manipulation?
I wanted to know if game hacking is all about manipulating memory ?
and If we need anything more than, this topics for game hacking ?
memory manipulation
Reverse engineering
Windows internals
C++ ...
- 1
1
vote
0
answers
109
views
Analyse a statically linked binary and extract syscall from it using angr
How to extract all syscalls from analysing a statically linked binary.
I have a script written using angr(Latest - v9.2.78) but when I start my script I get few syscalls and the analysis is like hung ...
- 11
1
vote
0
answers
351
views
Subaru Eyesight Images and collision avoidance systems
I'm new to hardware hacking and I'm not to sure where to go with what I'm doing, any advice or feedback is greatly appreciated. I've been working on a project with the hope of downloading images that ...
- 1
0
votes
1
answer
59
views
Filter BLE UART communications from Android HCI BT Snoop log in Wireshark
I managed to log BLE communications with a Nordic chip based device I am interested in on my Android phone and loaded the log in Wireshark, applying btatt as filter.
It uses some default BLE "...
CommunityBot
- 1
0
votes
1
answer
106
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
CommunityBot
- 1
1
vote
1
answer
84
views
Strange entry point for an old Mac OS X x86 32 bit binary
I wanted to reverse engineer an old game for Mac OS X, but I can't figure out how the entry point jumps to other code. The binary is an x86 Macho-O executable and, according to Detect it Easy, it was ...
CommunityBot
- 1
0
votes
2
answers
54
views
How to make a plugin python function available to IDA's console?
I want to have utility functions shared between all databases, for example:
from idautils import *
from idaapi import *
from idc import *
from ida_name import *
def FindFunctionImpl(...
- 9,178
2
votes
0
answers
32
views
Extracting Audio from a Game
Does anyone know a way which audio can be extracted from PCB boards such as this?
This is what I captured a long time ago from a game from 1998 called Brain Shift, and based on what I asked so far, ...
- 21
32
votes
5
answers
43k
views
What is the meaning of movabs in gas/x86 AT&T syntax?
I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture.
The original amd64 assembly code is:
mov 0x89abcdef, %al
And, after gas ...
- 111
1
vote
1
answer
64
views
IDC script offsets
I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
CommunityBot
- 1
1
vote
0
answers
36
views
How does Play integrity api assures Genuine app binary
I discovered that we can use the Play integrity api instead of safetynet now to assure the integrity off an app that is running. I am wondering if people have a way of bypassing the "Genuine app ...
- 11
4
votes
1
answer
208
views
What is an "mpi register base"?
For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
CommunityBot
- 1
0
votes
0
answers
28
views
decode lua files cocos2dx and protected from Frida and IDA64 for hooking
I want to decode the lua and other resources files. But i cant find the key when i use frida or ida 64 it crash before the game start.
Game is here https://megamonglobal.com/
https://imgur.com/88Habwu
- 53
1
vote
0
answers
38
views
Frida: how to hook a synthetic class
When reverse engineering an APK I came across a class that was marked synthetic.
I have used JADX decompiler. The simplified result I got was:
package com;
public final class zz6 extends B implements ...
2
votes
1
answer
422
views
Nice documentation of the binary analysis tool "angr", to analyse system calls in statically linked binary and hence possibly draw a system call graph
I am a new master's student in CS. I am into the computer systems domain. I was just thinking of analyzing a statically linked binary to get a sort of database of system calls made in the binary and ...
- 11
0
votes
0
answers
25
views
Scylla error on FThunk import (manually unpacking UPX)
I'm trying to practice on manual unpacking starting from UPX.
I'm using putty.exe x64
This is what I'm doing:
upx -o putty_packed.exe putty.exe
Disable Dynamic base (ASLR) using CFF Explorer on ...
- 11
0
votes
1
answer
1k
views
What are some methods to reverse a ex5 file for metatrader 5?
What are some methods to reverse a ex5 file, for metatrader 5? I would like to understand how people crack ex5 files and make them for use. Any ideas of reverse engineering tools for this scenario?
CommunityBot
- 1
0
votes
1
answer
159
views
How to extract ucas and utoc io store container files in unreal engine 5
I tried to use different programs for this, such as fmodel and UnrealPakViewer, but fmodel support only utoc, so I can extract only some part of files and it does not support binka audio files. ...
- 296
0
votes
1
answer
45
views
Function return in machine code (by platform/compiler)
I am asking this question to gather a knowledge base. I know in x86-64, a machine code function can have only one function return, i.e., ret instruction. I know it can be compiler (GCC, clang, etc) ...
- 8,408
0
votes
0
answers
36
views
Address arithmetic in Ida Pro
Can someone tell more about address arithmetic in Ida? I were looking for assembly instructions and saw this
LDR R0, =(byte_255914C - 0xC63D50)
I understood right that in r0 will be an address which ...
- 917
0
votes
1
answer
72
views
Cracking cryptographic function with radare2
I want to reverse engineer an android game, found a method
public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { }
Names are obfuscated, i know that this is a ...
CommunityBot
- 1
2
votes
1
answer
85
views
The Logic Of Incremental Data on Serial Communication Encoding
These are the serial communication reverse values.
I am trying to understand the logic behind this.
I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct.
I tried ...
CommunityBot
- 1
0
votes
2
answers
682
views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
0
votes
1
answer
93
views
How can I debug a UWP application on startup?
I'm trying to debug a UWP application, and break on startup. However, when I start the application with windbg, the breakpoint didn't work.
After further digging I found the process is started by ...
CommunityBot
- 1
1
vote
0
answers
27
views
UTC Timestamp since 1900
While reverse engineering a system I found a time stamp with a peculiar year:
UTC:'20.09.118 17:41:38'
It seems as if this is the UTC timestamp since 1900, which would result in
UTC:'20.09.2018 17:41:...
0
votes
1
answer
88
views
Rename a program's button using x64dbg?
I'm trying to change the name of a button, but I can't find anything that references it. I looked for the CreateWindow function in the intermodular calls, but I only found a reference to the main ...
CommunityBot
- 1
1
vote
0
answers
20
views
Keycode from a serial PDA keyboard (iPAQ G750)
I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
- 11
2
votes
2
answers
3k
views
Need help disassembling Qualcomm QDSP6
Im trying to disassemble a qualcomm QDSP6 modem file. According to the ELF header, there should be 26 sections(modem.b00-b25). However after dumping the device, b.16,b.17,b.25 are missing, making the ...
- 1,829
1
vote
1
answer
67
views
Anyone here capable of removing a launch condition from an old Win32 file having a "Sony InstallLock"?
I would like to extract the BIOS ROM file it contains, but it refuses to run. Even on the model it is intended for since I lack one or more SONY-custom DLLs on my installation. Since Sony decided to ...
CommunityBot
- 1
0
votes
0
answers
23
views
radare2 on an architecture with custom instructions
I am exploring RISC-V binaries that contain custom instructions. Is there a way to add them to the disassembler?
2
votes
1
answer
212
views
Disassembling MS DOS code
cseg01:0001F4D8 mov Disk_Letter, 43h ; 'C'
cseg01:0001F4DF
cseg01:0001F4DF loc_1F4DF: ; CODE XREF: sub_1F4C8+60j
cseg01:0001F4DF xor ...
CommunityBot
- 1
1
vote
2
answers
77
views
reversing pyinstaller compiled exe
i created some compiled binaries using different languages and tried to understand them using x64dbg, the compiled binaries produced by the c language/gcc compiler were pretty easy to understand, then ...
- 882
0
votes
1
answer
44
views
GWT: Deserialize objects sent/received via websocket
I would like to analyze the authentication function of a given GWT web application. When authenticating with my credentials, I could identify that my credentials are sent via websocket in form of a ...
CommunityBot
- 1
1
vote
1
answer
120
views
Merge two function arguments
I have a function with a signature:
int func(undefined8 param_1,int param_2,char *pData,int nDataSize)
I know from a header file that the first two arguments are actually one, a struct that I know ...
CommunityBot
- 1
0
votes
0
answers
53
views
Import function symbols from a reflection system into IDA
I'd like to import structs and functions from a reflection system into IDA.
The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
- 296
0
votes
0
answers
32
views
How can I create a radare2 type for a variable-length struct?
I'm trying to parse a binary file and it has a structure similar to this,
struct foo {
int64_t count_things;
int64_t offset_to_thing[count];
int8_t bytes[];
int64_t other fields;
}
...
- 1,769
1
vote
1
answer
86
views
Unix system with windows-style registry
When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination.
The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-...
- 8,408