All Questions

Filter by
Sorted by
Tagged with
4 votes
1 answer
46 views

Check if libc.so use tcache

I have ARM libc.so (GLIBC), How can I check if that libc.so used tcache, and what is the value of arena_max? Can I check that information offline?
1 vote
1 answer
23 views
+100

Is it possible to tap into IDAPython from within a (C) plugin? ... or at least use that Python instance?

I'm wondering whether it is possible to write a plugin for IDA and/or Hex-Rays which would use Python callbacks to perform certain tasks. In particular I am wondering if there is an official way to ...
0 votes
2 answers
172 views

Identifying rating algorithm

I'm trying to identify the rating algorithm used to calculate the displayed average of a 1 star to 5 stars rating system. To analyze the data I collated the first and last 1000 ranks and added the ...
1 vote
1 answer
61 views

If i disable a few CPU cores on my laptop how exactly does it work?

I have a 1280P Intel processor and I am running Ubuntu, i notice that i have a little to much power for my everyday task and have been debating on disabling a few CPU cores/threads to see if it will ...
2 votes
1 answer
45 views

When reverse engineering a piece of electronics that uses a "chip on board", what are some good resources for finding out what the chip is?

Example: I have an old digital organizer, a Royal DS 2260. I want to find out what soc it uses. Numbers marked on the PCB are just repeats of the model number or don't lead to anything, and I don't ...
2 votes
1 answer
25 views

GNU strings with --encoding=S

I have two binaries. Both contain the string "precondition failed" (without the quotes). The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the ...
1 vote
1 answer
75 views

What is the best solution to load the correct gpio mapping for atmega328p in ghidra

All the tutorials I found, use the default AVR8 default 16 little gcc configuration when importing the binary. After importing the file with this configuration the gpio register mapping is completely ...
2 votes
1 answer
443 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
3 votes
1 answer
1k views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
3 votes
3 answers
807 views

IDA plugin with visual studio c++ 2019

Hello all and sorry for my bad English I am trying to test an example for developing plugin in C++ with IDA from the book : http://www.binarypool.com/idapluginwriting/idapw.pdf I am using Visual c++ ...
1 vote
0 answers
11 views

Intel Pintools: How to count the number of static and basic blocks?

I am using Intel Pintool BBLs to count the total number of static and dynamic basic blocks. The below is the distinguish between static vs dynamic basic blocks (bbls): A dynamic basic block is ...
2 votes
2 answers
5k views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
7 votes
2 answers
2k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
2 votes
2 answers
194 views

How can I decrypt password of HG8145V5 PPPoE?

I want to convert my ISP given router from route WAN to bridge WAN mode and they are using PPPoE connection. I also have backup of configuration and its file name is "hw_ctree.xml". I was ...
2 votes
1 answer
610 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
1 vote
0 answers
13 views

How do I hook these js methods/functions with Frida?

I want to hook these methods for the purpose to log the string variables (str) just before they are encrypted by a function (encr). I'm showing only the relevant parts for simplicity. 1- protected ...
1 vote
0 answers
16 views

I am having problems while modifying router firmware and uploading it

So, I have an Edimax BR-6208ac V2 router and I would like to modify the firmware to enable telnet on it, however when I repack the firmware and upload it I get an error of it being the wrong filetype. ...
2 votes
1 answer
126 views

What tricks can I use to manually decompile a set of instructions

ELF Binary takes user input and stores it in loc.buffer address 0x4020e8. Further, the registers going into the instruction set are eax ebx ecx edx esi length of user input (min length is 3) 0 ...
6 votes
0 answers
259 views
+50

Compression algorithm from very old tape backup?

I'm recovering data from old tape cartridges from circa 1994, where the user had forgotten what software was used to write them, and it doesn't seem to be any format I recognize. Fortunately the file ...
125 votes
2 answers
113k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
1 vote
0 answers
15 views

How can I find out the way a code is defining colors?

Since the Winning Eleven/Pro Evolution Soccer series was created, the skills of the players had some specific colors. White, green, yellow, orange, and red (the higher the skill, the higher the color ...
1 vote
1 answer
109 views

How devices such as smart Wi-Fi power plugs and Wi-Fi ip cameras connect to a private Wi-Fi network?

How devices such as smart Wi-Fi power plugs and Wi-Fi ip cameras connect to a private Wi-Fi network ? The usual steps are the following : You buy the device You install the maker application on ...
1 vote
0 answers
16 views

PinTools Multi-threaded example (inscount_Tls.cpp): only one thread outputs

I am studying PinTools multithread example inscount_tls.cpp. When I change the number of thread to 3, only 1 thread outputs the result. Is anyone familiar with Intel Pintools instruments that can give ...
2 votes
2 answers
511 views

C++ hide string parameter for string viewer

bool isLaunched = CreateProcessW( L"C:\\Windows\\System32\\Notepad.exe", // Should be shown in any string viewer or decompiler. 0x0, 0x0, 0x0, TRUE, 0, 0x0, ...
2 votes
1 answer
183 views

IDA API: Writing a plugin - How can I ensure that analysis has completed?

I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish. get_auto_state auto_wait auto_is_ok Looking at the API if ...
3 votes
1 answer
1k views

Decrypting Lua files encrypt from apk game

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the lua file. Its from an android game I decompiled the APK and found that all the lua files are encrypted. ...
1 vote
1 answer
772 views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
2 votes
0 answers
573 views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6 wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files not ...
0 votes
0 answers
21 views

Does AnyOne knows how to reverse python file that is encoded into elf binary .cpython-310.so extension? Please Help me Out

Following is the link of the file that I want to reverse. This is the python file that is encoded in cpython or cython and it is now a binary file. please help me to decode it as it is very important ...
118 votes
2 answers
92k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
1 vote
0 answers
51 views

How to deal with msvc runtime integrity?

After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release. I'm actually newbie in ...
1 vote
1 answer
155 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
1 vote
2 answers
270 views

Help in the process arm disassembly

I have an ARM disassembly as follow, I would be happy if you can help me to understand what it does: ldr R14 ,=0X1234 ldr r10 , [r14 , #0x555] mov.w r15, #0x6666 add.w r10,r15,r10,lsl#15 I think ...
2 votes
0 answers
72 views

Weird anti-debugging mechanism

I am trying to grasp an anti-debugging trick used in this program. Upon attaching any debugger (x64dbg, VEH debugger) the software crashes after about 2 seconds. x64dbg shows me that the following ...
1 vote
0 answers
31 views

Overwriting the Global Offset Table + format string vulnerability

I am trying to understand how to overwrite the Global Offset Table. On the book "Hacking: The Art of Exploitation". Following the example I get: objdump -R ./fmt ...
0 votes
0 answers
17 views

Is it possible to enhance CAPEv2 detection?

I have used the Flare-CAPA plugin on IDA to help me with reverse engineering. Could I use these rules to enhance the detection of CAPEv2 sandbox? In general: How to enhance CAPEv2 sandbox detection?
1 vote
0 answers
24 views

Java bytecode dynamic analysis

I've been trying to patch a certain functionality of a jar file, that's essentially a GUI app. I've tried numerous java agents -as it seems to be the only viable option for java- for such a task, ...
7 votes
1 answer
810 views

Determine if an ELF file is signed or not

I need some help in determining if an ELF file is signed or with a valid signature or not. I have used the readelf tool with -S option in order to view the section headers and more specifically, the ...
2 votes
2 answers
1k views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
3 votes
1 answer
185 views

Reverse-engineering a 90s CNC machine (FORTH like) firmware

Here's an undertaking I'm currently in, and would absolutely love someone to assist more directly. I'll list the subjects that I would greatly appreciate more knowledge within. Know anything about one ...
3 votes
1 answer
390 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1 vote
0 answers
35 views

Tracing odd variant of call analysis failed

Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside). ...
1 vote
0 answers
25 views

The execution is not at AddressOfEntryPoint after patching .text section bytes

I have a shellcode and want to inject my shellcode into a PE file (a simple compiled c program that prints Hello World on the screen) . My shellcode size is 0x2a1 and the .text section of my PE file ...
3 votes
1 answer
49 views

How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?

I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool: I can open the image file for that process (from disk) with dnSpyEx, ...
2 votes
1 answer
47 views

Frida hook X509Certificate

I have an android application. It connects to a web socket server and uses the X509Certificate to verify the connection. newBuilder.trustManagers(WebSocketClient.sTrustManagers); By using Frida I ...
0 votes
0 answers
9 views

get thread count remotely with immunity debugger

I am debugging a program on a windows server with immunity debugger. Immunity debugger offers a remote command line client. I can do basic tasks through this command line. But is there a way to get ...
1 vote
1 answer
837 views

Advanced Binary Exploitation CTF

I wanted to ask your assistance: Where can I find advanced ctfs (that hopefully contain solutions) regarding binary/kernel exploitation? I am interested on finding x86_64 linux/windows/arm64 that ...
1 vote
1 answer
31 views

Can ESP point to a global variable

This 3 lines of code are used by some encoders to get EIP into ECX register: fldz fnstenv [esp-C] pop ecx The 2 first instructions push some datas on stack and we get one of this into ECX on the last ...
2 votes
0 answers
37 views

Reverse engineering LCD memory map

I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
5 votes
0 answers
3k views

Can IDA generate C code for ASM assembly without the binary?

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...

15 30 50 per page
1
2 3 4 5
181