All Questions

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
-4 votes
1 answer
24 views

HEEEEEELP PLS AAAAAAAAAH

convert this bullshit(C++) to Phyton: using namespace std; int main() { double z[16]; double s2(0), s3(0); for (int i = 0; i<16; i++); { cin>>z[i]; if (i % 2 == 0) s2+=z[i]; if (i % 3 == 0) ...
1 vote
0 answers
15 views

Does anyone know what algorithm generated these hashes?

Does anyone know what algorithm or method was used to generate the following hashes? 3b6cf49c 1ffdf2b2 d820587d 3b6cf49c 844029f3 c65a92bc 4952d868 a15ca5d4 2209a69d They're 8-letter prefixes of ...
1 vote
0 answers
11 views

GDB breakpoint crashes at a correct memory location

I'm trying to debug binaries of a a firmware running Linux with no ASLR, binaries are not compiled with PIE either so I have no issue getting the memory locations. So after including gdbserver in the ...
1 vote
0 answers
16 views

Assembling BIOS Routine Startup System Checks Op Code

I am really excited.. This is my first post. Anyways, The pressing question is such: "How would one get said bios program to run a routine system check before accessing the magic number?"
1 vote
0 answers
19 views

Trouble understanding disassembled code

I cant seem to figure out what is located in the EAX register after running this disassembly, specifically unclear after the sar and shr occur
0 votes
0 answers
23 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
2 votes
1 answer
37 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
2 votes
1 answer
29 views

x64dbg: Conditional breakpoint: how to log only if register value has changed?

What i'm trying to achieve is to use a conditional breakpoint, that never actually breaks but logs in x64dbg's console the value of r9 only when it changes, to prevent console cluttering. But i do not ...
0 votes
1 answer
21 views

How can I get access to peripheral? [closed]

I'm here because I'd like to learn how to build programs that can change for example an iphone location, or just get access to data by branch my iphone to my computer. I have no idea how this works, I ...
1 vote
0 answers
27 views

debug stripped file

I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
  • 19
1 vote
0 answers
24 views

How to debug a file that can't treat with it directly?

I have a game that has ("ex: GameGate.exe") file to open. I found out later that file is not responsible for opening the game directly but it's just a gate to open another file ("ex: ...
  • 197
1 vote
2 answers
63 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
0 votes
0 answers
23 views

Find out used encryption in an SQLite database

Is it possible to see from a string which encryption an SQLite database uses? Let's say, I can open the database and see this: O45dTrA6NKG6SYeCENMwV7nxp66HR9lbhK12NGHgVnzEhebMjMJUhTmConk= - how do I ...
  • 1
2 votes
0 answers
41 views

Decrypt Keybindings for EVE Online

I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless. I'...
  • 29
3 votes
1 answer
68 views

Figuring out a (possibly 16-bit) CRC algorithm

So, I wanted repurpose some old boarding gate scanners and I'm trying to make use of their commands. Now, I have a dump from an actual boarding gate PC and I've noticed that the commands only work if ...
  • 43
0 votes
0 answers
8 views

Why rarun2 is not behave like it is described?

colleagues. Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
  • 1
1 vote
0 answers
32 views

How to search for a graphical string?

I am trying to search for a string but in my case, that string is not like a normal string but it's a graphical string. As you have seen, that is not a normal string that can search for but it's a ...
  • 197
2 votes
1 answer
116 views

Unusual datetime format

I am looking at the registry keys created for three programs from a now defunct company, one of which is trial software. One entry of interest is the REG_BINARY key InstallTime. I have an idea of what ...
  • 123
1 vote
0 answers
31 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
1 vote
0 answers
41 views

Compression format used for various data (images, text, etc.) in a 1997 video game

I've been trying to reverse engineer the format of data files from the 1997 video game Helicops. I have experience reverse engineering binary files from games of this period but limited exposure to ...
0 votes
1 answer
61 views

Which encryption method has been used?

Anyone please can you tell me which method used to encrypt this kind of codes? im really confused, that would really helps me. This encrypted data created by a PHP. Ibª„bÏ}◊Kì-yNî˜>Efi¶ØÁÇ_^§ ...
1 vote
1 answer
45 views

Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there ...
1 vote
0 answers
17 views

Greenpacket OH-735 onboard header

I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ...
  • 11
1 vote
0 answers
39 views

Huawei HG8245W5 Router PPPoE Password Decryption

My ISP is not providing pppoe accounts but I need to bridge to my server. I only have encrypted password. Password is " $2'4e0YX=y6Q]$\9$c#-+F-h2&Tva4"GYn+qY)x>W$ " Can anyone ...
  • 11
0 votes
0 answers
26 views

Working with IA64 in IDA Pro

When disassembling IA64 code in IDA Pro when I try to open the Local Types window i get an error: Sorry, the current processor doesn't support the type system
  • 132
1 vote
1 answer
32 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1 vote
0 answers
28 views

Access a XREFs with frida

I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
  • 41
1 vote
1 answer
28 views

How can I verify section -> segment mapping for ELFs on linux?

I'm looking at at ELF on linux and I have readelf --segments ./myELF which shows: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align PHDR ...
  • 1,708
1 vote
0 answers
51 views

How would I decode this XOR Cipher

I have been given a XOR Cipher which is a bunch of hexidecimal looking charcters. This cipher is: fa ce fd d3 fa df ed d3 fa ce d3 d3 fa de df d3 fa de df d3 fa de f9 d3 fa ce f9 d3 fa de f1 d3 ...
1 vote
0 answers
36 views

Reverse engineering engine room simulator license management (x32dbg)

folks, I'm marine engineer and recently got in touch with simulator software with my professor at the Simulator Department of my university. Today I thought we could dump the original installation and ...
1 vote
1 answer
83 views

Help in reverse engineering a boarding gate scanner's firmware

I'm working on a custom Access Control system for my local airport that will validate passengers' boarding passes and I've been given two DESKO GRSK 502 scanners. Unfortunately, there's absolutely no ...
  • 43
1 vote
0 answers
26 views

Find caller function by DLL loading in x64dbg

First of all I'm noob at debugging task and I'm try to self-study to learn how to debug exe using x64dbg. I have EXE file packed by themida. i bypassed themida packing using themida plugin in x64dbg....
1 vote
0 answers
68 views

Accessing hidden http API where requests/responses are obfuscated/encrypted?

I'm trying to consume an hidden API which consist of various data related to my car. The goal is to reverse engineer the API so that I can feed my smart home with information regarding the car as to ...
1 vote
2 answers
44 views

ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file

I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
2 votes
0 answers
68 views

How to decompile an APK written in Golang?

I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to ...
  • 21
2 votes
0 answers
36 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
  • 21
1 vote
0 answers
30 views

Assistance with dumped firmware image

I need some assistance in reverse engineering this dumped nor flash image. binwalk yields this after norflash has been dumped (removed the flash chip, dumped it with CH341a and flashrom) DECIMAL ...
1 vote
0 answers
25 views

Ghidra: Ignoring partial resolution of indirect

The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile: uint ...
1 vote
0 answers
22 views

How to list all references to memory from selected memory region in ghidra?

I want to find all peripherals used by firmware dumped from embedded device. I loaded SVD file to add registers into memory map. Now I can find a peripheral in the memory region and check if there are ...
  • 111
1 vote
0 answers
43 views

Access to CPU registers in GMM space

AMD's BIOS and Kernel Developer’s Guide (BKDG) documents GMM registers and access to them: GMMxXXXXX: GPU memory mapped registers; XXXXX specifies the hexadecimal byte address offset (this may be 2 ...
  • 111
2 votes
1 answer
27 views

generate code execution/cpu time flame-graph of library DLL (Noob question)

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
1 vote
0 answers
36 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
  • 11
1 vote
0 answers
33 views

Corrupted IDA database .i64 file (Empty Header)

Im my 10 years using IDA Pro this never happend. I saved using IDA Pro 7.7 when I go to open today I find out that IDA PRO didnt put header on file If I try to open says "File .... is not an IDA ...
  • 11
1 vote
1 answer
63 views

Unable to understand x86 instruction(s)

Recently I have been given a set of assembly instructions which I must learn to understand. I know an extremely basic level of x86 assembly but I'm starting to come across more nuances that are very ...
  • 13
3 votes
0 answers
125 views

Reverse engineering and exactly re-creating a QR code

The Casio FX-991EX calculator has a QR code feature for accessing the current equation from another device. It supports version 3 QR codes for some menus and version 11 for most menus. For example, ...
1 vote
0 answers
28 views

IDA api: get function argument definition

So let's say we have the following code: 0: lea rax, [rbp+8] 1: mov rcx, rax 2: mov rdx, 5 3: call my_fun i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
  • 21
2 votes
0 answers
56 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
2 votes
1 answer
53 views

does arbitrary kernel read write from usermode count as a vulnerability if it requires admin

Does arbitrary kernel read write from usermode count as a vulnerability if it requires admin or is it fine since it requires admin?
  • 23
2 votes
0 answers
39 views

Clean Angr disassemble output

I'm developing a python script for Angr that has to print as output something in the form of: Instruction_disassembled opcode_bytes_of_instruction This is my python script: f = open(sys....
  • 31

15 30 50 per page
1
2 3 4 5
179