All Questions

Filter by
Sorted by
Tagged with
1
vote
0answers
10 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
0
votes
0answers
5 views

Unable to find the pci device mentioned in the processor datasheet

I have following intel processor 4th Generation Core Processor (Haswell U/Y). I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
0
votes
0answers
14 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
10 views

Ollydbg - Nag screen location

I am watching part5 of lena151 RE tut. the creator said : do understand that the nag is generated in the above call at 004898FE, but is effectively created in MFC42.dll in this call at 489912 So, How ...
1
vote
0answers
13 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
0answers
20 views

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal and I decided that I want more RPMs from my fan. However I wasn't able to find a ...
0
votes
0answers
25 views

How to bypass anti-debugging C++

so i have a crackme my friend sended to try and crack it but the problem that i cannot bypass the anti-debugging or even patching it i even tried using ScyllaHide at max settings but still it detects ...
0
votes
0answers
23 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
1answer
41 views

Where stack canary is located?

Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr so I can't change any registers (while the ...
1
vote
1answer
35 views

What is the structure of the Stack in a minidump?

I'm currently trying to understand a minidump file and while [1], [2] and [3] have helped, there are still some holes that aren't covered. The purpose of this is to create a script that can disect ...
1
vote
1answer
29 views

IDA Pro 7.5 Breakpoint Python Script: 'invalid non-printable character U+FEFF'

I'm trying to set a python condition breakpoint, but it throws me a weird error and I don't understand what happens: Even if I just return True, it throws the same error when I compile or when press &...
0
votes
0answers
41 views

Need help reverse engineering an 1995 Arcade game with jackie chan in it for modding purposes, (Motorola 68k)

I am looking for a way to decrypt these files and attempt to balance the game because the top tiers are top and the low tiers are low, also there might be two hidden characters that I would like to ...
2
votes
0answers
27 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
1
vote
0answers
28 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
0
votes
0answers
8 views

Immunity Debugger Trace of Vulnerable Application

I'm trying to trace a vulnerable application while it is being exploited. I'm testing it on the application and exploit pair found at (https://www.exploit-db.com/exploits/36826). the exploit works ...
0
votes
1answer
42 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
2
votes
1answer
63 views

What is Hardware Breakpoint and when we need to use it?

In part 5 of the lena151 RE tutorial I saw the Hardware BP. The explanation he gave was very difficult for me to understand. Can anyone explain what is a hardware breakpoint and when we need to use it?...
2
votes
2answers
96 views

Access data at memory address that is part of a struct

Problem I have a struct of some type, say the DOS header at the beginning of a typical PE file: /DOS/IMAGE_DOS_HEADER pack(disabled) Structure IMAGE_DOS_HEADER { 0 char[2] 2 e_magic "...
0
votes
0answers
32 views

IDA Pro dont understand address extension register in HC16

Source: ROM:13A2 006 ldab #0Fh ; Load B ROM:13A4 006 ldx #0FA27h ; Load IX ROM:13A8 006 tbxk ; Transfer B ...
1
vote
0answers
15 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
3
votes
1answer
56 views

Fujifilm Firmware Checksum

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR. I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera ...
-1
votes
1answer
40 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
2
votes
1answer
73 views

How to analyze dumped process?

I'm trying to reverse engineer a malware which uses a Process Hollow technique. This malware uses an API hashing technique and contains some RC4 encryption algorithm references. I already knew the ...
0
votes
1answer
31 views

IDA Pro Debbuger is debugging the original code and not the patched code

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections?...
0
votes
0answers
18 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
1
vote
0answers
46 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
3
votes
1answer
66 views

Determine if the function has try/catch statement via the static analysis

I need to determine if the function has exception handler via static analysis. Initially I thought that if there's SEH handler prolog in the function, then the function should have try /catch. I.e. I ...
0
votes
0answers
35 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
0
votes
0answers
27 views

Unpacking firmware of TP-LINK IPC firmware

I have some TP-LINK IPC firmware that must be reversed (as a task). But I can not unpack the .bin firmware and extract the file system. Binwalk output: 576 0x240 xz compressed data ...
0
votes
0answers
38 views

Reconstructing “relative” import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
18 views

Decoding a ZTE H188A config. file

I got this router from my ISP it's fairly good but most of the config options are grayed out. I wanted to decrypt the config file and change those options form there. after some research I found this ...
0
votes
0answers
22 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
0
votes
0answers
45 views

IDA: Function arguments detection

I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
1
vote
0answers
43 views

Cocos2d xxtea game lua decrypt

How can I use the 16 byte xxtea byte as python I found the password directly but I want to change the bytecode of the password with 16 bytes as in the picture _BYTE *__fastcall sub_D4CA64(__int64 a1, ...
2
votes
1answer
53 views

How to know when a subroutine starts when reversing an ARM64 file?

I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
0
votes
0answers
85 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
0
votes
0answers
28 views

Identify unknown MEMS sensor

Could someone give me any clue how to identify this chip? It should be a 9D accelerometer-gyroscope-magnetometer but I'm not sure. The case seems to be LGA-14.
0
votes
0answers
22 views

How to reverse engine JS code whose callstacks are hidden?

I am learning how to reverse engine JS code and got a hard exercise, beyond hidding strings this obfuscated JS tries to hide callstacks by spreading and storing partial computations in a bunch of ...
0
votes
0answers
50 views

I and the enemy shares a fixed address but with a changeable offset, How can I change my value but the enemy not?

I am trying to get a gold value in my game (an old game since the 90s, but it's still working). I finally found the gold value and its static address too, but sometimes that address can't get the ...
-1
votes
0answers
43 views

How to convert Pesudo Code IDA to C++ or C?

I'm very skeptical of this section of the code. I see the argument of function, first of argument is string but in code is _DWORD *this. I very don't understand this. However, two and three is int but ...
1
vote
1answer
63 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
1
vote
0answers
30 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
2
votes
2answers
99 views

Ghidra: equivalent to IDA-Pro's “Reset desktop”

I have nearly ruined my Ghidra layout, and was wondering if there is an equivalent to IDA-Pro's Windows->Reset Desktop, which would reset the code browser's layout to its default form. I am aware ...
1
vote
0answers
28 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
0
votes
1answer
32 views

uncompyle6 gives success message but output is not readable

I am trying to use uncompyle6 to decompile a .pyc code. I even tried --verify option. It says # Successfully decompiled file, but the output only contains strings like \xe0\xb3\x0bh\x90. What should I ...
0
votes
0answers
23 views

How to modify a function without disassembling the entire class

If I want to modify a function which has calls to other classes and functions in the application, but I don't want to reverse all of those other classes and leave them as they are, how do I go about ...
0
votes
0answers
21 views

How to add include path in Cutter

Hi I have an program waiting for debug. But the executable is based on another so file, which need to be added into LD_LIBRARY_PATH variable. I have search over the internet but cannot find a way of ...
0
votes
1answer
49 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
1
vote
1answer
80 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
0
votes
0answers
41 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...

15 30 50 per page
1
2 3 4 5
164