All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

Debug Linux Kernel ARM64

I need to extract Initramfs from the kernel. The initramfs archive itself is encrypted and located inside the kernel. I couldn't extract the key. I thought to run the kernel in Qemu, connect with the ...
Ren's user avatar
  • 1
0 votes
0 answers
23 views

Why is an empty binary larger than one with a variable?

On my own self-learning R.E. Starting with understanding ELF and hopefully whats going on with every byte. I build 2 simple binaries: 1 with a variable and 1 without. For some reason, the one without ...
EraserPencil's user avatar
0 votes
0 answers
15 views

Frida, Frida-tools, Android version Problems

I have this environment.. android : 9 version python : 2.7.12 I am not sure which version of Frida and Frida-tools I need to use to be compatible. I'm currently using 12.8.5, but an ascii codec ...
서영재's user avatar
0 votes
0 answers
32 views

How can I debug if the program closes directly?

I'm trying to debug a game and it's closing under few circumstances: When debugging (solved by hooking IsDebuggerPresent to return false when called by the game) When setting a memory/hardware ...
kuhi's user avatar
  • 161
0 votes
0 answers
32 views

Need help reverse engineering an Android app

I want to make a script that allows me to download videos from an online streaming service. For that I need to make a http POST request to an url with the parameters acceptVideo, t and s, like this: ...
Andrei Iosifescu's user avatar
0 votes
0 answers
31 views

microcontroller to microcontroller - is this I2C protocol?

I have a consumer grade hot water boiler that I am trying to interface to get various internal measurements (outlet temp, inlet temp, etc.). The main control board is powered by a defunct Fujitsu ...
DaveInPA's user avatar
0 votes
0 answers
40 views

How can I change the data type of `puVar1` in this C++ function?

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable ...
hanan's user avatar
  • 309
0 votes
0 answers
30 views

Can you help me change the api in a tool?

This tool is dedicated to extracting translation from gohitv.com site Can't extract subtitle files of all episodes only extracts subtitle files of the first two episodes. Because only two episodes can ...
Eikichi Onizuka's user avatar
0 votes
0 answers
49 views

Where to find the Visual C++ 6.0 CRT Source Code?

I want to see MSVCRT's implementation details for the old Microsoft Visual Studio C++ 6.0 compiler. On newer Visual Studio versions, it is located in /VC/crt/src/ directory, but there is no such ...
void_17's user avatar
  • 33
0 votes
0 answers
17 views

Reversing an obfuscated javascript library making heavy use of promises

I am reversing a little javascript library for my private use. This library is using promises to pass data around between different functions. This way, you cannot backtrack the function that is ...
user2276094's user avatar
0 votes
0 answers
31 views

Reverse Engineering a CRC-16

I am looking for help in reverse engineering what I believe to be a CRC-16. I have tried all of the known polynomials as well as bit and byte ordering with no success. I am able to determine that ...
Keith's user avatar
  • 1
0 votes
1 answer
54 views

convert Pdf to Executable

I am taking a intro to reversing course. After learning patching we got a home work to find the flag and write a writeup on how we did it. Part of the riddle is to figure out where exactly to find the ...
Talia Isaacson's user avatar
1 vote
0 answers
46 views

Is this (router) firmware file encrypted?

I am new to reverse engineering. Nice community you folks have here. I am trying to determine if this, VOX3v_CLOSED_19.2.0203.3261005.rbi (https://vfcc.publicacs.vodafone.co.uk/firmware/UK-CC/...
Mohamed Bana's user avatar
0 votes
0 answers
45 views

Debugging [DebuggerHidden] method

My app uses DLL that calls another app with System.RuntimeType.InvokeMember. I decompiled all modules and got source code with VS2022 so I can see the code of System.RuntimeType.InvokeMember, but it's ...
morkovni's user avatar
0 votes
0 answers
59 views

Deobfuscating WPF obfuscated code

The project uses WPF : What should i do for XAML links de4dot supporting that ? I have been trying to deobfuscate an encrypted code for days but no matter what I did, I bypassed the debugger ...
Waltcher's user avatar
0 votes
1 answer
69 views

Flag 200h open file

cseg01:00056938 mov edx, offset var_byte_0004DCC8 cseg01:0005693D mov eax, offset hmi_drv_str cseg01:00056942 call strcpy_ cseg01:00056947 ...
black4's user avatar
  • 333
1 vote
0 answers
66 views

Reverse engineering from sets of data

I'm starting in the world of reverse engineering, for educational purpose, by studying a (supposed-to-be) relatively simple system as black-box. The system uses a NFC Mifare 1k badge to store ...
Jib's user avatar
  • 111
0 votes
0 answers
24 views

How can i generate function call tree in IDA & proper disassembly from obsucated flow?

I'm trying to properly disassembly the following code in IDA but failing to do that because code flow is obfuscated with call / jnz byte ptr [eax-2] how is it supposed to look like for IDA? .text:...
M. Sol's user avatar
  • 1
1 vote
0 answers
39 views

Ghidra 11.0 - What does Function > Analyze Stack option do?

Greetings ladies & gentlemen, I am but a novice at both Ghidra and Reverse Engineering in general. Forgive me if you think this question is dumb or obvious to answer :) While attempting to solve a ...
dvmbCateDoinAStroll's user avatar
0 votes
0 answers
32 views

Symbols in Ghidra based on r/w possible?

Is it possible to have a symbol file with different names for an address based on whether a instruction is accessing the address read or write? For example, I have a hardware address $FF8800 for a ...
Trevor Acton's user avatar
0 votes
0 answers
30 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
HeckMeck's user avatar
0 votes
0 answers
47 views

Attempting to auto reverse XOR

Does anyone know of any helpful tools or a way to automate decryption of XOR in IDA? I know that they have a built in function to do some bare XOR encryption but this one seems a bit more ...
Babyhamsta's user avatar
0 votes
0 answers
48 views

Help determine 3d model vertex structure serialized binary

Help determine 3D model vertex structure serialized binary. Example of single vertex: A3 D0 5D BA C9 27 3F 3A DC 6C 87 3B 2B 75 EE 00 FF FF FF FF 92 2F 29 80 B1 19 64 3F 02 82 1D 3F What I got so far:...
S4TURN's user avatar
  • 1
1 vote
1 answer
85 views

Where is IDA getting this symbol?

I'm currently researching how a certain malware works and patches some stuff in a certain Android's library. Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
Arget's user avatar
  • 13
1 vote
2 answers
55 views

Looking for a packet forwarder on Android that redirects all packets to PC

I want to capture packets from Android apps. I need an packets forwarder on phone that creates a VPN to redirect all TCP packets to PC, then capture them with 'mitmproxy'. I want to use mitmproxy ...
aj3423's user avatar
  • 209
0 votes
0 answers
30 views

Help Extracting a CramFS filesystem from .img binary

I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
cdbrunow's user avatar
0 votes
0 answers
49 views

What is this .Net Obfuscator?

I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is? // Token: 0x0600EE8B RID: 61067 RVA: ...
Gudarzi's user avatar
  • 123
1 vote
1 answer
89 views

Why are these strings padded every other byte?

I've seen this multiple times, through various apps and snooping of hex values. Character strings but every other value is actually a null byte. This particular example is with API Monitor, but I'm ...
Katastic Voyage's user avatar
0 votes
0 answers
32 views

Patch binary while documenting original at the same time in Ghidra

I'm starting work on a simultaneous documentation and patching project on a single binary. Some of the code to be documented will also be overwritten by the patch, but most of it won't, so I need a ...
inakilbss's user avatar
  • 101
0 votes
1 answer
85 views

Patching an old piece of software

First off, let me just start by preemptively apologizing if this isn't the right place to ask this question. If that is indeed the case, let me know and I will delete the post. It's just that I'm ...
Duro Prem's user avatar
0 votes
1 answer
40 views

binwalk guess wrong LZ4 compressed data format

I have a stock Netgear switch firmware file: https://www.downloads.netgear.com/files/GDC/GS316EP/GS316EP_GS316EPP_V1.0.3.7.zip When I do binwalk, it gives me at position 0x769BDC a description as &...
Martin's user avatar
  • 15
1 vote
1 answer
51 views

finding unknown CRC 32 bit algorithm used in a firmware file

I want to modify a firmware image for a WiFi router. The image file consist of an UBI image, 0x04100000 bytes in size. Additonally, 20 bytes of unknown metadata have been appended to the UBI image ...
Shamblr's user avatar
  • 31
0 votes
1 answer
71 views

IDA Pro could not disassemble native function properly

Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly): Is it possible to produce manually more readable assembly?
AseN's user avatar
  • 161
0 votes
0 answers
38 views

Reversing SYSTEM Process

I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port ...
BobNewby's user avatar
0 votes
0 answers
36 views

How to embed PE files to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
LuckyCoder3607's user avatar
0 votes
1 answer
93 views

Ghidra decompiler does not recognize rsp being subtracted

while i'm reversing a PE binary, i got some weird decompiler output. return address is shown on decompiler view. I looked up on google, and i thought setting stack depth and editing a stack frame ...
msh's user avatar
  • 1
0 votes
1 answer
62 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
flying_meatball's user avatar
0 votes
1 answer
31 views

Can't find native library in lldb

・I am analyzing an Android app that was in the CTF. (https://github.com/TRkizaki/cryptoverse2023/tree/main/reverse_java_not_interesting) ・In this app, the input string is checked by the checkvaild ...
momonga's user avatar
  • 11
0 votes
0 answers
40 views

Windbg set conditional breakpoint

Can't get this to work. I want to set a conditional breakpoint in Windbg with the condition to be when eax is 11h (17). I tried: bu xxxxxxxx ".if(eax != 17){gc}" bu xxxxxxxx ".if(@eax !=...
Uddie's user avatar
  • 1
2 votes
1 answer
110 views

How to hook RuntimeException to prevent crashes?

I tried to find out how RuntimeException works internally in cs.android.com so I can understand how to prevent crashes but didn't find anything useful and I have no clue how to analyze components-...
IVs's user avatar
  • 137
0 votes
0 answers
48 views

Windows kernel Dev

I'm writing a basic program that'd allow me to list the running processes on a windows system but by simply trying to go through the ActiveProcessLinks of the _EPROCESS structure.The problem I'm ...
Essole's user avatar
  • 1
0 votes
1 answer
57 views

How to call unexported function in a third party DLL while having its PDB?

I'm new to reverse engineering and recently met with a problem: I have the dll and pdb of a debug version third party module, but I don't have its source codes. Now I want to write a piece of C++ code ...
猫宮かさね's user avatar
0 votes
2 answers
98 views

How to change default pointer size in IDA Pro

so, I'm writing a script to automate analysis, and the code I'm working with is 64bit. the pointer size field shown here is the wrong one: I want to change it from within python to 64bit. I've ...
serv0's user avatar
  • 11
0 votes
1 answer
106 views

Firmware disassembler for c-sky processor (ck803s)

can you tell me why objdump does not correctly disassemble the firmware for the C-SKY (ck803s) processor? what is .long: between the lines, unknown instructions? or am I setting the parameters for ...
Andynvkz's user avatar
0 votes
0 answers
50 views

Resizing variables to improve decompilation results

Consider the following, relatively commonplace decompilation misinterpretation, where variable sizes (not just types) are incorrectly guessed, causing suboptimal results: As you can see, we have what ...
F.Webber's user avatar
  • 101
1 vote
1 answer
100 views

How to read from pointer in python?

I'm using cheat engine to find a multipointer that leads to an address that has value of list of entities. I found said multipointer, but I have no clue how to read it using python.
masterJohnson's user avatar
0 votes
0 answers
53 views

currently dealing with heavly obuscated files obfuscated by jsscrambler. What are some of the tools available to assist in the deobfuscation process?

Can you recommend some tools for speeding up this process?
Mr deob's user avatar
0 votes
0 answers
67 views

Question about anti-debug methods and anti-anti-debug methods

I've come across several binaries that have simple anti-debug methods in place, like checking IsDebuggerPresent(), NtQueryInformationProcess(), etc. But I recently came across a binary that looked ...
Joshua Terrill's user avatar
0 votes
0 answers
42 views

otool shows only single architecture for system fat binaries in macOS

File shows /bin/ls is a fat binary on macOS (Sonoma 14.2.1 on Apple M1) and otool -f confirms that: % file /bin/ls /bin/ls: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit ...
mrn's user avatar
  • 101
0 votes
0 answers
32 views

Microsoft Teams web client: how does Teams knows if a device is allowed or not

In my company I am able to use Ms Teams only inside windows but when I try from a Virtual machine (Hyper-V) running linux it says that this device is not allowed. So how can the Teams Server knows ...
Vince Ricosti's user avatar

15 30 50 per page
1
2 3 4 5
193