All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Why would compiler emit a null pointer assignment

I have been reversing a popular Windows application and ended up in a very interesting place while debugging. What I can clearly see as valid x86 instructions that eventually lead to some sort of &...
0
votes
0answers
18 views

How to deobfuscate Java application

Hi i am unable to deobfuscate the Advanced String Obfuscation Jar on tryHackMe I tried dumping the classes using a dumper javaagent deobfuscate the jar with java-deobfuscator threadtear functions ...
1
vote
0answers
26 views

Bypassing unsupported android TV box!

I have an android TV box called Proximus decoder v4, anyway the android TV box is not supported anymore by the company. When I turn it on I get an update checking, you can't even cancel it, and then I ...
0
votes
1answer
38 views

Reading from buffer and printing output to a text file

00001f10 2846 mov r0, r5 00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0} 00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} ...
0
votes
0answers
22 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
0
votes
1answer
17 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
2
votes
1answer
22 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
0
votes
0answers
56 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
0
votes
0answers
25 views

Decompiled VB 6.0 Application Call Statement

I decompiled a VB application using VB Decompiler pro. It contains the following call statements: Call {EEF18FCD-D67D-4E3C-AA21EC9AF56F90E9}.Method_arg_B8 (global_248, CStr(var_98)) Can you please ...
0
votes
0answers
41 views

Does loading custom PDB help reversing behemoth program?

What I reverse : Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost. It(they) has the mixtures of their custom structures, classes and directX sdk ...
1
vote
0answers
22 views

How to derive a state diagram from existing source code

to;dr; What tools or smart method can I use to derive a state (transition) overview from source code with 10 binary and three 16-bit input variables, and several output variables, both 16-bit and ...
0
votes
0answers
21 views

How to force IDA to analyze a function immediately?

I think my question is probably related to this one: API to force reanalyze of function (Alt-P) When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
0
votes
0answers
17 views

How to keep track of Dynamic Variables

The thing I'm trying to reverse has a lot of variables on allocated memory so I can't comment and keep track of the addresses as every time I re-run the software they will be different.. I'm working ...
0
votes
1answer
24 views

ida pro: dwarf fatal error; the dwarf plugin will stop now

I recently observed this bug (error), when I upgraded gcc/g++ from version 9.x to 11.x. Basically, Ida fails to parse debug information. I don't get this error when I compile with gcc 9.x. Note that, ...
0
votes
1answer
39 views

Can't find references (xref) to function

I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA. Is there a plug-in or something that I ...
-2
votes
0answers
36 views

Need help in assembly language to crack password using IDA

I have to crack the password from the assembly code using IDA. I don't know how to work with it. I was wondering if someone can please help me with this, I would really appreciate it.
-2
votes
0answers
37 views

How to find key and signature in APK file

I'm having trouble finding the key and sign to decrypt my program. I have tried everything like IDA but to no avail Link apk file: https://drive.google.com/file/d/1YNNcsFXxJ11ciVUSzxwAUukU06DWUws0/...
0
votes
0answers
23 views

decoding thread context structure in x64dbg

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
1
vote
0answers
68 views
+50

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
0
votes
0answers
33 views

What is .pb file format?

TL;DR: What file format is this (if it's not a private file format) and how do I parse it? Before I say anything I want to say that I am new to reverse engineering and StackExchange. I am trying to ...
0
votes
0answers
37 views

I have this question here that is solved with assembly language and I want to convert it to C language, Can someone help? [closed]

Question: 3. Write an assembly code to light up alternate LEDs continuously starting with LED1. Use the given Delay routine. LED1 LED2 LED3 ON OFF OFF Delay OFF ON OFF Delay OFF OFF ...
0
votes
0answers
16 views

Extract RFS (rootfs) on UBIFS NAND Dump

I am practicing (studying) hardware reverse engineering. I dumped a NAND flash (smart TV), and managed to remove OOB data and emulate NAND in my environment. I detected that NAND used UBI filesystem, ...
0
votes
0answers
22 views

How are programs like 'StartAllBack' and 'T-Clock' developed?

There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe). How are these hook points discovered in the first ...
0
votes
1answer
26 views

function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?

I need urgent help , I was debugging a software made by Visual basic 6 , and I found vbavarindexload function and I need to know what is doing ? Thanks in advance
1
vote
1answer
28 views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
1
vote
1answer
15 views

Is there a way to find the implementation of methods with MethodImplOptions.InternalCall attribute?

Background: The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For ...
0
votes
0answers
23 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
1
vote
1answer
38 views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
0
votes
1answer
68 views

Translate ASM code x86 32 bits in C

I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language: Dump of assembler ...
1
vote
0answers
19 views

Does COT_HELPER have arguments/operands?

I am trying to learn the hexrays ctree api. I am using the python bindings. The task I am trying to automate is tracing the arguments to wrmsr instructions. I notice that hexrays represents them like ...
1
vote
1answer
74 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
0
votes
0answers
7 views

"Rejecting invalid page" error when using patched private framework binary

The background is - I got tired of my bluetooth headset button opening Apple Music and wanted it to do something useful instead. After some investigation I concluded that on button click a message is ...
0
votes
0answers
22 views

IDA Python: Is it possible to determine whether an instruction operand is a constant rather than a variable?

Here is my use case: I am trying to create a script that finds all instances of a particular instruction (in this case wrmsr) and traces back to find out whether the operands for the instruction are ...
0
votes
1answer
35 views

Branching in arm assembly

This is an example assembly code: function0() 0x0.mov r0, #1 0x8.mov r1, #20 0x10.mov r2, #6 0x18.cmp r1, #16 0x20.b function1 function1() 0x28.cmp r0, #1 0x30.b functionX functionX(...
0
votes
0answers
14 views

Need Help with decryption backup config.bin file "ZTE ZXHN H168N V3.5"

I am trying to decrypt my router config.bin file.( model mentioned above). When i use zcu utility to decompress my backup to Original format it's say payload 4 .. and the key might be your serial. I ...
0
votes
0answers
9 views

RT809H reader socket fails pin test

I have tested/straightened the pins on the TSOP-48 chip a few times under a microscope, but keep getting something like: Is this a poor quality issue with the socket I ordered? I can't seem to select ...
1
vote
1answer
55 views

How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)

Let's say there is a default base address for the application image on both IDA and Ghidra and it is equal to 140 000 000. If the function address is: 140 039 ea0 Does it mean that the offset from the ...
0
votes
0answers
18 views

Trying to find an undefined smd chip

This is my first time reverse engineering a smart band I got a while back. Its got a TI CC2541 2.4-GHz Bluetooth, a KX023-1025 (3-axis accelerometer), and a 32.000 MHZ Standard Clock. What I'm trying ...
0
votes
0answers
59 views

Extracting sprites from old DOS game

I'm trying to extract the sprites from the old dos version of Street Fighter 2 The sprites are spread over a couple files (SPRITES1.SF2, SPRITES2.SF2), there is another binary file called INDEX.SF2, ...
0
votes
0answers
32 views

How to reverse android native libraries? Best resources? [duplicate]

I want to improve myself in Android penetration testing. For this task i need to learn reversing the native libraries of an APK file to detect vulnerabilities. What is the best way and resources for ...
-1
votes
0answers
37 views

Finding registry keys/values using IDA PRO

It's been a while since I've started optimizing my Windows 10 and the great way how to do it, is by using IDA PRO by looking for "strings" from .sys or .dll files. Problem is, that I need to ...
0
votes
0answers
23 views

Question About Buffer Overflow And NOP Sled

I am trying to learn buffer overflow but I have a question about one CTF. In "Buffer Overflows" CTF in Tryhackme, while creating the payload, I can use '0x7fffffffe388' or '0x7fffffffe398' ...
0
votes
0answers
21 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
0
votes
0answers
28 views

Tools to generate code to hidde hardcoded critical data

I have retrieve a code file related to security topic, that contains a piece of code to protect harcoded value of RSA key against static analysis: // Byte values of encrypted key //121, 217, 79, 9, ...
1
vote
1answer
48 views

What is the meaning of SYSTEM_INFO.wProcessorLevel?

I am performing some RE on a malware sample, and they are checking the value of SYSTEM_INFO[32] which is SYSTEM_INFO.wProcessorLevel. The description MS provides is not clear to me. The malware checks ...
0
votes
0answers
49 views

Decoding Game data

I am very new to this whole business so please bear with me. Goal: Am trying to decode data from a post request from game to server starting with Q0. Most of the game data is encoded in Base64, but ...
1
vote
1answer
52 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
1
vote
1answer
69 views

How to debug a .net DLL?

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues: First one: (...
0
votes
0answers
67 views

CRC can bus message

Does anyone know what the CRC algorithm can be used here? crc:0xE8 data:0x0 0x0 0x0 crc:0x43 data:0x1 0x0 0x0 crc:0x2F data:0x2 0x0 0x0 crc:0x7B data:0x3 0x0 0x0 crc:0xD0 data:0x4 0x0 0x0 crc:0xDA ...
-1
votes
0answers
17 views

How can I change the command after running code? Command at an address changes during run. Patches Applied but don't save/app won't run

I am trying to crack a program. There is a jump that I need to adjust to bypass some operations. After adjusting it and patching the patched exe fails to load. And when I open it in the debugger the ...

15 30 50 per page
1
2 3 4 5
167