All Questions

Filter by
Sorted by
Tagged with
1 vote
0 answers
19 views

How to locate a string in memory with x64dbg

I opened a 32-bit program with x32dbg, I wrote something on a text box like this : How can I find the piece of code that manipulates the string "Goku" ? I searched all string references but ...
user avatar
  • 111
1 vote
0 answers
27 views

How to set global variable type?

I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of. However I can't seem to find a way to do this - ...
user avatar
  • 413
1 vote
0 answers
36 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
user avatar
  • 111
1 vote
1 answer
17 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
user avatar
  • 413
3 votes
0 answers
18 views

Radare2 - Saving information/metadata from a debugging session

I'd like to know how I can save/restore comments or possibly other metadata during a debugging session. I know how to save this data when running radare without the -d flag but I often need to debug ...
user avatar
1 vote
0 answers
52 views

Where can I find the encryption algorithm for this POST request in an Android APP?

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
user avatar
  • 19
0 votes
0 answers
17 views

Assign function type to a pointer in ghidra

In the project I'm currently working on, I have found the following obfuscated access to functions in various libraries. In the following example, libdl is referenced. if (libdl_string_literal[8] != ...
user avatar
  • 101
1 vote
0 answers
35 views

Where can I find these compilers given in the Rich Header of a system BIOS file?

I am working on a project which deals with the BIOS file of a well known manufacturer. I recovered the file from the disk partition which stores and uses the file in case BIOS is corrupted or its ...
user avatar
0 votes
0 answers
25 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
user avatar
2 votes
0 answers
32 views

Why Can't I View Certain USER32.dll API Calls In The Disassembly?

Long story short, I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 DIFFERENT DEBUGGERS (x64dbg and cutter), the API calls responsible for much of the ...
user avatar
0 votes
0 answers
17 views

IDA throws "Module <lib> has no names" error after attaching a remote process

I am using IDA for debugging a remote process. After set IDA_LIBC_PATH to a correct libc.so in my android device to resolve IDA multi thread problems, I cannot get a list of export functions of ...
user avatar
1 vote
1 answer
39 views

Why is JMP ESP required in buffer overflow?

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks. The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
user avatar
0 votes
0 answers
24 views

Convert IDA imagebase to detours

I have succefully hooked a game with imagebase 400000 (Ex: // LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4) Game.SecondaryFunctHookAddress = "0x2D5040" and the ...
user avatar
0 votes
1 answer
56 views

How do I unpack a file protected by MPRESS?

I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
user avatar
  • 1
0 votes
0 answers
31 views

How to solve bad pseudocode format of Hex-Rays Decompiler?

Look at the following pseudocode: void *__cdecl func(const char *a1, int a2, void *a3) { _DWORD *v3; // esi int v5; // ebp int v6; // eax void *v7; // esi _DWORD *v8; // eax int v9; // edx ...
user avatar
  • 119
1 vote
0 answers
25 views

IDA how to remove all uses of a type?

I'm editing an exe which has a function that is used in multiple places with completely different meanings for the return type (a getter that wasn't inlined). I had assigned it a return type to make ...
user avatar
  • 73
0 votes
0 answers
30 views

IDE/RE Program - Installation Questions

I have a few questions about IDE and software setup. Which version of Visual Studio Community is better 2019 or 2022? I do not have internet access at all and wondering if I could download a offline ...
user avatar
0 votes
0 answers
17 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
user avatar
0 votes
0 answers
33 views

Decompile C#, xaml and wpf application

I saw the image of an app and I want to use it's source code but when using some decompiler I get over 500 errors. How do I use the code there are two files? I want to decompile the installer and the ...
user avatar
1 vote
0 answers
30 views

Disable IDA Downloading Symbols Automatically

How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
user avatar
1 vote
0 answers
32 views

Reverse-engineering the S-Note (.spd) file format?

Context Samsung phones have an application called 'S Note' that let you use the stylus/keyboard to take notes in a free-form format, similar to Microsoft OneNote. These notes are stored in files ...
user avatar
0 votes
0 answers
26 views

Reversing Executable Package

I have an .exe file that loads some other files when executed, I need to redirect these files and export them. When debugging I know that there is a subfolder /images/%s.png where the files in ...
user avatar
0 votes
0 answers
16 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
user avatar
0 votes
0 answers
53 views

Is there a debugger that will trace into ring-0 code?

Is there a debugger these days that will trace beyond a syscall or sysenter into ring-0 code? Or is there a technique using a debugger like Windbg? I have read that if you get close enough to the ...
user avatar
1 vote
0 answers
32 views

How do I read/edit a .xuk file extension?

I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
user avatar
  • 11
0 votes
1 answer
63 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
user avatar
  • 1
0 votes
0 answers
36 views

Rebasing program

When I start debug in IDA, it's appears small window "Please wait... Rebasing program", and it's take about 3 minutes. Is it possible eliminate this process named Rebasing program? It take ...
user avatar
  • 113
0 votes
0 answers
23 views

How to find prolog with idapython in non-disassambled function raw bytes?

I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
user avatar
0 votes
1 answer
68 views

What kind of compressing/encoding is this?

Currently, I am trying to understand .amxd file formats. I firstly tried to open it in VIM to see what this contains. Turns out there is a JSON file and others files also in the file (I can see PNG ...
user avatar
0 votes
1 answer
32 views

IDA export settings hotkey

People, good afternoon. Tell me please, can anyone know: how to export hotkey IDA? I understand - IDA saves these settings somewhere in the registry, but I can not find this place
user avatar
  • 1
0 votes
0 answers
53 views

How to byte patch a longer hex/byte from the original?

I am fairly new to IDA PRO I hope this is not some kind of stupid question but please bare with me. How do you change patch a hex/byte that is longer than the original? Example: When I try to byte ...
user avatar
2 votes
0 answers
172 views

What utilities allow you to debug a process without pausing execution?

I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?" The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
user avatar
  • 1,654
1 vote
1 answer
167 views

Examining memory without attaching to the process by using /proc/$PID/mem?

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example. #include <stdio.h> #include <unistd.h> ...
user avatar
  • 1,654
3 votes
1 answer
34 views

How to use software watchpoints in LLDB?

After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use set can-use-hw-watchpoints 0 How do you disable hardware watchpoints in LLDB?
user avatar
  • 144
0 votes
0 answers
17 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
user avatar
3 votes
1 answer
61 views

What is the outcome of mov on non bracket memory locations?

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
user avatar
  • 33
0 votes
0 answers
44 views

Wrong access .data segment

Preface I'm a PHP programmer, in my spare time I've been doing reverse work. Achieved good progress in the analysis game. But there was a big problem on my way. And now, more than ever, i need the ...
user avatar
1 vote
0 answers
34 views

Decompile obfuscated jar file

Tried java-deobfuscator and other things, detect said it was allatori protected so tried the relevant transformers but to no avail. Please can someone help, I'm happy to tip for your help :) https://...
user avatar
0 votes
1 answer
13 views

Gdb hardware watchpoint error on android

After failing to find a solution to this I have started using Gdb and have encountered another error. Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
user avatar
  • 144
0 votes
1 answer
42 views

What is libm_sse2_sin_precise() and how to find it's parameters in IDA?

I'm new to reverse engineering with IDA. I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable. I tried clicking that function but the executable requires the DLLs. ...
user avatar
  • 1
2 votes
1 answer
55 views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
user avatar
  • 144
1 vote
0 answers
53 views

Source code for an mp3 player?

I know this title sounds a little dumb but if you would please bear with me for an explanation. I have a Valoin-made mp3 player I bought close to 3 years ago now. Via a series of interesting ...
user avatar
5 votes
0 answers
81 views

What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?

Background Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page: MRE (MAUI Runtime Environment) is a ...
user avatar
0 votes
0 answers
30 views

SetPixel seem not work on some external window

I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window. To do a test I have created this code: Here my hooked function: My_hooked_function(int a3)...
user avatar
3 votes
1 answer
25 views

Where is the CRC16 checksum in a USB BULK IN transfer?

I'm looking at how MITM works on USB devices. This website states that: Bulk transfers provide error correction in the form of a CRC16 field on the data payload and error detection/re-transmission ...
user avatar
2 votes
1 answer
48 views

TP-Link Manual Installation

Before starting my researches, i was just curious about how my router could work. I found some posts about reversing and emulating TP-LINK routers, so i bought one. First, i successfully extracted the ...
user avatar
0 votes
0 answers
45 views

How to reverse engineer this router firmware using binwalk?

I want to modify router firmware so I can enable telnet. What steps should I take? The router is hg630v2; the firmware can be found at this link. It's Linux based. When I do binwalk --signature --term ...
user avatar
  • 1
1 vote
1 answer
49 views

Modify, unpack, and rebuild an Android App Bundles (.aab) file

My developer has not provided me the source code backup for my listed app in Google Play (his PC was stolen and all codes are gone with it). I logged on to my Play Store developer's account and found ...
user avatar
0 votes
0 answers
28 views

Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++

The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to ...
user avatar
  • 11
2 votes
0 answers
74 views

Lifting x86 machine code to LLVM IR

I would like to translate a simple x86_64 machine code into LLVM IR, which can be later analyzed. For my particular use case, I need to be able to work with just instructions and opcodes directly, and ...
user avatar

15 30 50 per page
1
2 3 4 5
174