All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
2 views

How can I set a breakpont before the software exits in Dnspy?

I'm trying to reverse a software using Dnspy but after a few seconds, the software exits, how can I find the code that exits the program and modify it? In Ollydbg I would look for the command ...
0 votes
0 answers
2 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
0 votes
0 answers
2 views

how can i Use cutter like ida, trying to search by address

Im new to reverse engineering im trying to get into a disassembler been using reclass for a while now, i was looking at ida pro at that was 7k euros so that was not a option. been trying to use cutter ...
0 votes
1 answer
25 views

Tenda router + Firmware-Mod-kit = Firmware header not supported

I have been working hard for over 1 week trying to get a modified firmware installed on a Tenda AC10 V1 router. It is the original firmware with some modifications to unlock extra features. The ...
1 vote
1 answer
17 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
0 votes
1 answer
104 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
0 votes
0 answers
16 views

How to fix CRC32 checksum in an xz-compressed folder without corrupting the data?

I need to fix the CRC32 checksum of an xz folder that is part firmware. I extracted the files from this folder, made the necessary modifications and recompiled using mksquashfs. The original folder ...
4 votes
2 answers
17k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
0 votes
1 answer
53 views

ASUS RP-AC51 UART doesn't work with any common baud rate

I have an ASUS RP-AC51. It doesn't broadcast any WiFi network when powered on, the management interface cannot be accessed over Ethernet, and the reset button seemingly does nothing. I decided to try ...
-1 votes
1 answer
70 views

How to call and what means: _DWORD *__thiscall

I have one question maybe you can help, I always find this functions in IDA: void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4) And I use them like this: // talkChannel typedef DWORD(...
0 votes
1 answer
86 views

Changing the jne to je instruction causes program to generate error

I'm trying to change the instruction from jne to je I've change an instruction 75 0c jne [some_location] 75 0c is a 2 jump instruction. So, I've a chaged it to from 75 0c to 74 0c which is ...
1 vote
0 answers
18 views

Load to Ida binary with all of SO

I have Linux Arm binary with lot of share libraries. Can I load all of them to one Ida so I can easily negative between functions? For example functions that the binary call and implement in on of ...
0 votes
1 answer
116 views

How to reverse engineer structs in radare2?

Is there any way to indentify structs in radare2? when i tried to look them, they look like normal variables, i seen people using td and tl command but I don't know how to use them. If you know please ...
-1 votes
0 answers
235 views

What does this lowlevel function do?

I am currently reversing a game called Warframe and have gotten quite far. There is just one function which is really making me wanna give up. One hint I can give: The function was found IN another ...
0 votes
1 answer
74 views

help with Ghidra and rewriting assembly

I'm learning reversing and for that i use Ghidra. There is program i'm trying to modify so i can recompile it and make it work. I have a code that ghidra decompile like this: data=function(4) Going ...
1 vote
1 answer
192 views

Determine if exe is written using Java

I'm examining my Windows programs to determine which ones are written in Java, and if so, whether they import a log4j library affected by the log4shell vulnerability. Programs that are packaged as JAR ...
0 votes
0 answers
36 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
2 votes
2 answers
141 views

Changing value of parameter with gdb

I have a file named exploit.c inside which: #include <stdbool.h> #include <stdio.h> const char y1 = 'a'; const char y2 = 'b'; const char y3 = 'x'; const char y4 = 'y'; const char y5 = 'i';...
1 vote
0 answers
21 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
0 votes
1 answer
60 views

Frida hook multiple processes

There was such a situation. I run the frida hook on the process like this: frida -f '..\hack2\hackme.exe' -l .\start.js In the script itself I do this var moduleData = Process.getModuleByName("...
3 votes
1 answer
712 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
2 votes
1 answer
175 views

How i can do several input via rarun2?

How can i do several input via rarun2, if my program requares two input? I try this:
0 votes
1 answer
39 views

Is iOS 15 kernel cache encrypted?

I recently started researching ios kernel security and I've been struggling to find out whether the kernel cache is encrypted for iOS 15. Any help would be really appreciated.
0 votes
0 answers
31 views

Is there any problematic difference in Intel and AMD processors for reverse engineering?

Maybe this question is not fully adapted for this site, I'll delete it if it is the case. I'm considering working in the reverse engineering field. I will also soon get my own pc. One of the main ...
1 vote
1 answer
48 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
0 votes
0 answers
18 views

Decrypting Android game using cocos2dx-lua [closed]

There's an app that I would like decrypting but the process so far has been a pain for me so I'm looking to hire anyone who's interested in making some money. Usually I'd try and do it myself but I ...
0 votes
1 answer
119 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
0 votes
1 answer
47 views

Find the first function that sets the value currently stored in a given register

I'm interested in a general approach to the following problem: Some function F_Init allocates a byte buffer Buffer with a size BufSize. The buffer is allocated each frame/iteration resulting in ...
2 votes
2 answers
2k views

How to unpack the Fortigate firmware?

I want to unpack the fortigate firmware - FGT_110C-v400-build0092-FORTINET.out. binwalk only gives a hint about gzip compressed data. ~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out ...
0 votes
2 answers
171 views

Load Library Android

I work as cybersecurity consultant, and now I am on mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar... the problem that after reverse them I found some native ...
2 votes
1 answer
56 views

How can I make Ghidra have access to external libraries?

I am trying to decompile a executable file, I have the source code of the external libraries that it is using, I wonder if there is a way that I can make Ghidra recognize these libraries, just like it ...
11 votes
2 answers
3k views

Encrypted Mach-o binary cannot be disassembled/traced with GDB

I'm trying to analyze an encrypted Mach-O binary (non-iPhone one), and I am observing the following strange behaviors: when I load this binary into GDB and try to disassemble the code at the address ...
0 votes
0 answers
22 views

Restore debug symbol for a embedded .bin image with an .axf file

I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device. The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
1 vote
1 answer
39 views

How to define an xmmword variable in IDA?

How to define an xmmword variable in IDA? IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords: I also tried to set the type after pressing ...
1 vote
2 answers
68 views

What is the best approach to reverse a custom TCP Application Layer?

I have recorded a TCP Stream using Wireshark, so I have Client/Server Communication as a hex dump. What is the best approach to reverse the custom application layer? Some data seems to be ascii ...
0 votes
0 answers
44 views

Can't get Visual C++ to generate the same code give by Ghidra

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following: ...
-1 votes
0 answers
27 views

ida pro overwrite bytes not increase rom location (Value)

I am using IDA pro and try to edit hex code but when try to edit then it's overwrite the hex code not adding new code. In my IDA pro edit patch already enable but still overwrite and old hex code ...
4 votes
1 answer
269 views

Does pwntools provide any Radare2 integration?

I want to use pwntools with Radare2, since this is my debugger of choice. However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb). Anyone with experience in ...
4 votes
4 answers
2k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

I would like to determine if an instruction a) reads from or b) writes to a memory address. I can currently think of two approaches in IDA: Looking for a list of mnemonics (better: particular opcodes?...
1 vote
1 answer
37 views

IDA Pro S12X flash page references

Trying to analyse a dump from MC9S12X series MCU and can`t get how IDA making cross flash page references and if it could be done without scripts. The project contains 64 code segments with linear ...
1 vote
0 answers
38 views

Reverse engineer CRC Canbus

I am trying to figure out what I believe is a CRC8 value on some 8 byte canbus messages. I have tried "RevEng" without luck. But maybe some of you are able to figure it out. Some messages in ...
0 votes
0 answers
23 views

How can IDA Pro disassemble paged memory from HCS12 processort?

I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory? If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
0 votes
1 answer
60 views

Deobfuscator and decompiler for .NET

Which are the most common and useful deobfuscators and decompilers for .NET .dll files?
0 votes
1 answer
52 views

x64dbg: is there a way to save the complete disassembly of a module to a text file?

Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
1 vote
0 answers
27 views

In IDA is there a way to load the PE headers after the initial loading?

This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it. But suppose I have already worked on an IDB for a while and realize that ...
1 vote
1 answer
3k views

When analysing a PE (.exe) in IDA Pro how can I jump to the 'user code' section and skip all the header/libary code?

Suppose I'm disassembling helloworld.exe (a program that outputs the string "hello world") and want to see the user code or code section for the file in IDA Pro. In what address would the ...
0 votes
1 answer
25 views

Interpreting Response for Modbus/TCP function code 0x08 Diagnostics

A client application sends a Modbus 0x08 diagnostics query to Schneider modicun PLC over TCP/IP. The software describes itself as designed for Modicon Micro/Compact/Quantum/Momentum/584/984. Payload ...
0 votes
0 answers
46 views

Password encryption when transferring from master to PLC

So, there is a PLC and a SoftMaster program to work with it. The PLC works according to the XGFenet protocol. When connecting to the PLC for the first time in SoftMaster, a password must be entered. ...
1 vote
0 answers
53 views

Implementing syscalls under Miasm

I'd like to use Miasm's DSE on a binary. This binary makes use of 2 syscalls: exit and ptrace. Miasm provides an implementation of some syscalls, but unfortunately, not of those two. So I tried to ...
2 votes
1 answer
396 views

Help determining pinout for communications port

I have a Panasonic air conditioner that has a header on the mainboard that various optional (expensive) addon communications modules can connect into eg wifi The unit is a Panasonic Split system from ...

15 30 50 per page
1
2 3 4 5
173