All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
2 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
1
vote
2answers
106 views

Use enum for switch case values in ghidra

Is there a way in ghidra to change decompiled switch statement case values to their names? I'm looking at a WndProc function, with a prototype of LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM ...
0
votes
1answer
8 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
0
votes
0answers
26 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
2
votes
2answers
429 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
0answers
16 views

ret2libc: problem getting exploit work without pwntools

I am trying to exploit this program test with ret2libc. Only NX is enabled. #include <stdio.h> void vuln() { char buffer[256]; gets(buffer); } int main() { vuln(); return 0; } ...
2
votes
2answers
1k views

How do I denote and use JMP /5 in byte code

I'm on the OSX platform working with x86_64. I've worked out how to do near jumps with the E9 byte code directive where my relative addresses have 4 bytes (teamed up with RIP) Now I have an instance ...
0
votes
2answers
459 views

Hex-Rays skips code

have using IDA Pro 6.8 (Hex-Rays 2.2), default settings. Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
0
votes
1answer
22 views

Ollydbg - automatically add hardware breakpoint when step over

I put INT3 breakpoint and starting the program. The OllyDbg break at the breakpoint, but when I step over, the OllyDbg put a hardware breakpoint. (Yesterday not happened in OllyDbg, but today during ...
0
votes
1answer
73 views

Getting the object name through the Ghidra Script

I have a script written to work with ghidra. I am doing some analysis in the script and save the results in a file. Right now, I am passing the name when a prompt ask the file name to save upon ...
0
votes
1answer
20 views

Modify framework.dex which is in boot.oat?

I pulled down boot.oat from an API22 Android phone. It's Android 5.1 Lollipop which brought the change from Dalvik to ART and is a bit mistified. As far as I understand, modifying boot.oat is not easy,...
0
votes
0answers
15 views

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E wifi controller and as always nowadays this devices comunicate with Cloud servers first then with you which practically means you need ...
1
vote
1answer
97 views

.dll file pull source from compiled study?

Forgive me, I’m new, and not a programmer, but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
1
vote
0answers
6 views

'… Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript

I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error Unable to get property 'Debugger' of undefined or null reference. Line was simply var ctl = host....
3
votes
0answers
27 views

Cannot load pdb in IDA Free 7.6

I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach. I have just installed the last version of free IDA (7.6) ...
0
votes
0answers
26 views

How does Borland C++ 5 exception handling work?

So, I'm still working on reverse-engineering an 1996 game. I have cleared a lot of roadblocks, but one thing that continues to annoy me is exception handling and RTTI metadata. There is a function ...
1
vote
1answer
96 views

How to make a reference to a different segment?

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment. Now when I look ad ...
0
votes
0answers
13 views

Baksmali services.odex from Android L (5.1, API22)

I'm trying to deodex a system file (/system/framework/arm/services.odex) as I need to modify it. I've tried every possible commands found online, but baksmali complains for "unsupported oat ...
0
votes
1answer
167 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
0
votes
0answers
11 views

Does Golang's cgo now support output with .gopclntab?

I read this page in which the author, Chris Siebenmann, states that binaries created using cgo will not have the gopclntab or the gosymtab sections. However, I see that on go version go1.13.15 linux/...
3
votes
2answers
2k views

x64dbg - see the current position?

i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?
0
votes
0answers
24 views

Can't figure out a crash in IDA “The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)”

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
33 views

What's the meaning of @ tag on proxy dll?

In proxy dll in .def file I can see the following notation: _CreateFrameInfo=PROXY__CreateFrameInfo @1 Others use in the following format: _AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16 ...
2
votes
0answers
71 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
0
votes
0answers
37 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
5
votes
1answer
7k views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
0
votes
1answer
49 views

MPC562 and M58BW016 Flash operations

I am trying to modify the Flash memory of a board with a Freescale MPC562 processor, using an external 2 MB Flash chip M58BW016. So far I've been able to successfully read and write the chip's ...
8
votes
2answers
4k views

Is there a way to set the cursor address in IDA Pro?

In the same way that ScreenEA() returns the current cursor address, is there a way to set the address? Something that would resemble SetScreenEA()?
0
votes
2answers
46 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
1
vote
1answer
129 views

Odd jsr destination in SuperH disassembly w/ Ghidra

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
1
vote
0answers
16 views

Unable to find the pci device mentioned in the processor datasheet

I have following intel processor 4th Generation Core Processor (Haswell U/Y). I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
0
votes
0answers
30 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
21 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
0answers
23 views

Ollydbg - Nag screen location

I am watching part5 of lena151 RE tut. the creator said : do understand that the nag is generated in the above call at 004898FE, but is effectively created in MFC42.dll in this call at 489912 So, How ...
1
vote
1answer
46 views

What is the structure of the Stack in a minidump?

I'm currently trying to understand a minidump file and while [1], [2] and [3] have helped, there are still some holes that aren't covered. The purpose of this is to create a script that can disect ...
0
votes
1answer
448 views

multiple base addresses?

I'm quite new to reverse engineering and I'm currently trying things out on a game called Assault Cube. What I've done so far is finding offsets to my players health, ammo, name, etc.. When doing so I'...
1
vote
1answer
99 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
-1
votes
1answer
68 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
0answers
27 views

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal and I decided that I want more RPMs from my fan. However I wasn't able to find a ...
0
votes
1answer
35 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
0
votes
0answers
42 views

How to bypass anti-debugging C++

so i have a crackme my friend sended to try and crack it but the problem that i cannot bypass the anti-debugging or even patching it i even tried using ScyllaHide at max settings but still it detects ...
2
votes
0answers
28 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
2
votes
1answer
226 views

Proper way of implementing DexGuard RASP device checks

I recently came across an app that is protected with DexGuard. DexGuard claims to offer Runtime Application Self Protection (RASP), which comprises of app obfuscation and various runtime tampering ...
0
votes
1answer
49 views

Where stack canary is located?

Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr so I can't change any registers (while the ...
1
vote
1answer
30 views

IDA Pro 7.5 Breakpoint Python Script: 'invalid non-printable character U+FEFF'

I'm trying to set a python condition breakpoint, but it throws me a weird error and I don't understand what happens: Even if I just return True, it throws the same error when I compile or when press &...
1
vote
1answer
181 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
0
votes
1answer
127 views

Get function return value

Any idea for more ways to get return value? (No hooks, no hw/memory breakpoints, no call functions). thx :) I tried to find a dword maybe that hold the function return, but I didn't find it. I'm ...
1
vote
2answers
2k views

Problem with IDA pro 6.8 disassemble galaxy s6 sboot

I have some problem with galaxy s6 boot loader(sboot.bin). From 0x3F000 of that file, I think that there exists the real boot loader. So I tried to disassemble it with ida 6.8 pro (64bit) But It ...
0
votes
3answers
123 views

Order of arguments in __usercall

i have the following function with five arguments: ; int __cdecl trampolineRegister(void) a4= dword ptr 8 a5= dword ptr 0Ch push ebp mov ebp, esp add eax, ...
3
votes
1answer
58 views

Fujifilm Firmware Checksum

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR. I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera ...

15 30 50 per page
1
2 3 4 5
164