All Questions
1,895
questions with no upvoted or accepted answers
14
votes
1
answer
4k
views
Howto clone Android RSA SecurID Software Token
At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
13
votes
0
answers
535
views
Problems calculating checksum for AirConditioner
I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes.
I discovered that the upper and lower nibbles need to be ...
- 131
13
votes
0
answers
1k
views
Reverse Engineering 2 byte checksum on RFID card
I am currently researching my studentcard.
Money is stored on this card.
But the vending machine also checks a checksum on the card.
I already did a lot of effort to find it but didn't succeed.
The ...
- 139
10
votes
0
answers
1k
views
Ghidra loading Linux kernel function signatures
TLTR
I want to load Linux kernel headers vs. 4.19 to Ghidra so that it recognizes kernel structures and function signatures.
Full description
I'm trying to reverse engineer a Linux kernel module (...
- 123
10
votes
0
answers
3k
views
RE Tplink TD-W8960N V7
I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
- 265
9
votes
0
answers
1k
views
Firmware analysis, can't find file system
I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
- 91
9
votes
0
answers
361
views
replicate external bank switching in IDA Pro
I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
- 191
9
votes
1
answer
6k
views
How to unpack manually an upx packed elf file
I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
- 857
8
votes
0
answers
796
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
8
votes
0
answers
2k
views
Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)
I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
- 363
7
votes
0
answers
616
views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
- 71
7
votes
0
answers
276
views
running iOS debugserver on non-jailbroken devices
There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
- 496
6
votes
0
answers
540
views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
- 173
6
votes
0
answers
1k
views
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:
a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
a2ed8: e1a04000 mov ...
- 161
6
votes
0
answers
750
views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
- 428
6
votes
0
answers
945
views
Audio file compression identification
I've been working on reversing file formats from the game of star wars episode 1: the phantom menace.
I have managed to extract the audio files from the .lab file in which they were contained. I ...
- 183
6
votes
0
answers
546
views
How does my S62 engine utilize MAF sensors to convert voltage to mass flow?
We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
- 111
6
votes
0
answers
680
views
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:
Local variables on stack of different types, including types defined in local types window
Local variables of different types ...
- 8,185
6
votes
0
answers
634
views
Shotcuts in immunity debugger
Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
- 1,998
6
votes
0
answers
2k
views
Why does Hex-rays thinks that 32bit PE is 16bit?
I'm using IDA 6.1 32-bit version.
I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
- 233
6
votes
0
answers
217
views
How to find the symbol table in a TI DSP. (TMS320C5510)
That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
- 391
5
votes
0
answers
295
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
5
votes
1
answer
2k
views
Huawei HG8245H, can't read some system files
I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:
SU_WAP>shell
...
- 91
5
votes
1
answer
263
views
Reverse engineer compressed iOS app file
I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
- 51
5
votes
0
answers
6k
views
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.
Basically, I am looking for an apktool for .aab
- 175
5
votes
0
answers
10k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
5
votes
1
answer
303
views
Are there existing automated approaches to reverse engineering the data types in a binary data stream?
Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet.
Are there existing tools that automatically detect (or estimate) the various data types present and their ...
- 151
5
votes
0
answers
266
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
5
votes
0
answers
116
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
5
votes
0
answers
4k
views
Extracting ARM Boot zImage
I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
- 360
5
votes
1
answer
608
views
Difference between Proxmark3 rdv4 & Proxmark3 evo
I am an advanced beginner in RFID/NFC reversing / hacking. For now, I have a mifare reader and I want to buy a better reader to able to perform advanced stuffs on both HF and LF (especially emulation ...
- 51
5
votes
0
answers
844
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
5
votes
0
answers
350
views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
- 170
5
votes
1
answer
1k
views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
- 1,437
5
votes
1
answer
2k
views
GDB find string strange results
I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
5
votes
0
answers
1k
views
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed the tutorial IDA Help: Debugging code snippets with QEMU.
It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:
Should I adjust ...
- 51
5
votes
0
answers
371
views
Static Address in Dynamically Loaded DLL
I am trying to re-write the following function in my injected DLL.
mov edi,edi
push ebp
mov ebp,esp
mov eax, [sound.dll+1AE0]
push eax
mov ecx,[ebp+08]
mov eax,[ecx]
mov eax,[eax+0C]
push eax
call ...
- 309
5
votes
0
answers
636
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
- 135
5
votes
0
answers
3k
views
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
- 151
5
votes
0
answers
877
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
5
votes
0
answers
3k
views
Load multiple modules in one IDA database
I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
- 51
5
votes
0
answers
1k
views
Emulate TP-Link WR841N using Qemu
I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points.
Following instructions ...
- 51
5
votes
0
answers
731
views
Page Fault Handler in Windows
Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.
When a Page Fault occurs and nt!KiTrap0E ...
- 317
5
votes
0
answers
857
views
Reverse Engineering XORed string
I am trying to reverse engineer some data received over serial port.
The hardware sending the data consists of a gps, compass and a power monitoring unit (which sends information about the battery).
...
- 59
5
votes
1
answer
2k
views
Understanding AutoIT "compilation"
I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support.
I have tried looking for 3rd party ...
- 215
5
votes
2
answers
722
views
Getting empty files using firmware modification kit
im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far.
I got the admin ...
- 51
4
votes
0
answers
320
views
Reverse engineering CRC8 algorithm
I am trying to reverse-engineer a protocol which includes a final byte that is (possibly) a CRC-8 with some unknown parameters.
I have collected some data, however, the downside is the fixed length
&...
- 41
4
votes
0
answers
1k
views
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg
I tried using pkg-unpacker however the output is ...
- 41
4
votes
0
answers
216
views
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"
The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
- 1,694