All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Mounting JFFS2 Filesystem

I dumped the content of a NAND Flash and I let binwalk analyze it. At the beginning binwalk wasn't recognizing anything. I could only find something after I removed the OOB data (xz compressed data ...
0
votes
0answers
5 views

In depth understanding of C++ concepts during Reversing

in my free time, i used to do RE on malware and vuln research. sometimes i came to see complex c++ code, which is a bit difficult to understand. i saw some of the resources and research talks on ...
0
votes
1answer
16 views

Modify function to return a static value

i am learning IDA pro on a test binary and i'd like to return a static value to this function: ; __int64 __fastcall sub_B580(char *name) sub_B580 proc near pai= qword ptr -70h req= addrinfo ptr -68h ...
0
votes
1answer
35 views

Tools for detecting packing and encryption

I'm doing a cert in malware analysis and I'm looking for some up to date tools to automate detection of packing and encryption to aid the reversing process. I've found TitanMist however it seems ...
0
votes
0answers
23 views

Determine checksum / CRC algorithm

I am doing reverse engineering on some network protocol. It is client to server communication and I am pretty stuck with identifying checksum (or CRC) algorithm used in packet structure. I tried ...
0
votes
0answers
8 views

Undefined “app” keyword in PDF Javascript

I'm trying to analyze a malicious PDF file's JS using JSDetox and such tools. The JS does not execute and is stopped app is not defined because of the line elm = app; If I turn this into elm = '...
0
votes
0answers
22 views

Easy way to understand vulnerable functions while Reversing

I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code. As I am new to this stuff, I am getting some issues of ...
0
votes
0answers
26 views

Reverse ASCII checksum algorithm

I am looking to reverse engineer what appears to be a 24-bit ASCII checksum. I tried the standard CRC 16 and 32-bit checksums and they don't work. Any pointers would be appreciated. Here is some ...
0
votes
0answers
20 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
0answers
21 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
0
votes
2answers
35 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
0answers
18 views

How to repack reverse-engineered router firmware?

I managed to unpack the filesystem contents of a TP-Link router .bin file using binwalk, dd and unsquashfs. The squash FS was at the end of the bin file, the part before having a relatively large lzma ...
0
votes
0answers
23 views

How to display processes that are running of computer in LordPE?

I tried to install some LordPE version but all when I open then no program that is running displayed in LordPE.I don't know why? I hope you guys show me the way to fix this problem.I appreciate all ...
2
votes
1answer
89 views

Breakpoint in GDB hit 144 times before first call to function

I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
2
votes
1answer
107 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
1answer
31 views

LOG Urls that APK requests using smali

I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events. ...
0
votes
0answers
53 views

How do you mapped a stripped function back to it's real address?

So basically this is a stripped android 32bit ELF (it's just a linux dll with android handle it a bit different - NDK/JNI), and I unpacked it. Now the function inside is cleaner and you can see ...
0
votes
0answers
25 views

Causeway DOS Extender unpacker?

I've seen an old Causeway Extender unpacker floating around, at some point being on EXETOOLS before they went forum-only, by the name "CauseWay DOS Extender Unpacker v0.17" or "unpcwc.zip". Is there a ...
3
votes
0answers
44 views

Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
1
vote
1answer
50 views

SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
0
votes
0answers
39 views

Packet: Game last byte encrypted?

12:14 WSARecv() C3-73-3E-BE-36-2F-14-37-37 F4-44-09-89-01-18-23-00-00 ------------------------------------------ 12:14 send() C3-73-38-31-0E-35-EE-35-A5-35-7F-34-37-37-8D F4-44-0F-06-39-02-D9-02-92-02-...
0
votes
1answer
67 views

Writing a DLL in C# vs C++? [on hold]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
-1
votes
2answers
59 views

How to add a message box to a PE

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
-1
votes
0answers
31 views

Can any python coder help to port this OLLVM deobfuscator to ida v7 or below? [on hold]

FYI ida plugin can be py script or be c++. This blog written very well on how the deobfuscation concept work. https://rpis.ec/blog/dissection-llvm-obfuscator-p1/ I don't know anything about c++ or ...
0
votes
2answers
100 views

Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" and "retn" ...
0
votes
1answer
61 views

How to make a program to read Unicode control characters

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. ...
0
votes
1answer
46 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
3
votes
1answer
80 views

concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
0
votes
0answers
65 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
34 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
1
vote
0answers
56 views
+100

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
48 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
0answers
15 views

CPU integrated PCI device functions

I'm trying to reverse an Xeon based hardware bios. During the early initialization in the UEFI SEC phase, I stepped into some CPU embedded PCI devices initialization. After few hours researches, I've ...
1
vote
1answer
45 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
0answers
41 views

Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
0answers
36 views

Can I bruteforce an .nc blowfish-448 encrypted (mcrypt2.2)?

Still a freshie at RE, but during my first expedition I came across some encrypted files. To be specific: _login.nc: mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit Any ...
0
votes
1answer
53 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
2answers
54 views

How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
0
votes
1answer
66 views

Possible to get address of DRIVER OBJECT programmatically?

I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so: 0: kd> !drvobj HEVD 2 Driver object (ffffa70752fdbe30) is for: \Driver\HEVD ...
0
votes
0answers
8 views

App Store IPA - why it would suddenly need a “provisoningProfiles” entry in Info.plist? [on hold]

An IPA I have acquired from Apple's App Store has a "provisioningProfiles" in its Info.plist. The "provisioningProfiles" entry was not in previous versions of the IPA file. Looking at another few ...
1
vote
1answer
22 views

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
0
votes
1answer
27 views

‘Purple Fox’ Fileless Malware - debug swf [closed]

In reading TrendMicro's write-up(https://blog.trendmicro.com/trendlabs-security-intelligence/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell/), I ...
2
votes
1answer
41 views

Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
1
vote
2answers
81 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
0
votes
1answer
95 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
2
votes
2answers
90 views

Malware Samples that defeats emulators by using uncommon API calls

I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
2
votes
0answers
49 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
0
votes
0answers
28 views

Reverse Engineering MS Access Encryption [on hold]

I have an MDB with a column of what I assume to be encrypted data. The application I'm using shows me the unencrypted form of the data so I know what each encrypted string in the MDB column ...
0
votes
0answers
36 views

Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
0
votes
1answer
77 views

Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...

15 30 50 per page