All Questions

1,336 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12
votes
1answer
3k views

Howto clone Android RSA SecurID Software Token

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
11
votes
0answers
454 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
10
votes
1answer
2k views

Anti debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can i bypass that?

So im debugging this process which has a lot of anti debugging techniques in it, and i faced something new which i dont know how to bypass yet. Changing the code dynamically causes exceptions to ...
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
9
votes
0answers
964 views

Reverse Engineering 2 byte checksum on RFID card

I am currently researching my studentcard. Money is stored on this card. But the vending machine also checks a checksum on the card. I already did a lot of effort to find it but didn't succeed. The ...
8
votes
0answers
100 views

Extracting strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries that will work cross architecture? The problem with Go is that strings are stored without a null terminator so you can't use the "...
8
votes
0answers
578 views

Firmware analysis, can't find file system

I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
7
votes
0answers
312 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
7
votes
0answers
432 views

Analyzing a Revit project file

I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
7
votes
0answers
796 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
7
votes
1answer
7k views

What is a good and reliable C decompiler that support ELF and SH4 Architecture?

I have a ELF file, which is a partial firmware of a navigation module(my BMW idrive CCC), I need to decompile the elf file. I tried Reko Decompiler which said it does not support SH4 and Snowman ...
6
votes
1answer
1k views

Can I define custom enum-type to be used in Ghidra as a data type?

I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI: I was able to retype gpfnCommCtrlAPI into char*[14] ...
6
votes
2answers
443 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
6
votes
0answers
1k views

Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)

I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
6
votes
0answers
281 views

How to find if a given library function is used in a binary?

Assuming that library X is statically linked, is there a way to know with an acceptable grade of confidence if a function from it was used in the binary? I am currently using this approach: Convert ...
6
votes
0answers
223 views

replicate external bank switching in IDA Pro

I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
6
votes
0answers
601 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
6
votes
0answers
4k views

How to unpack manually an upx packed elf file

I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
6
votes
0answers
731 views

Audio file compression identification

I've been working on reversing file formats from the game of star wars episode 1: the phantom menace. I have managed to extract the audio files from the .lab file in which they were contained. I ...
6
votes
0answers
422 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
5
votes
0answers
121 views

Radare2 8051 code bank switching

Some of 8051 chips use bank switching to extend accessible code memory. Good example is Silabs C8051F12x. Another example is here. Code area in range 0x0000..0x7ffff is common always accessible code ...
5
votes
0answers
292 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
5
votes
0answers
897 views

Generating symbol file for closed-source binary by hand

I have a closed-source binary (minecraft-pi). For a given section of the assembly like so: a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr} a2ed8: e1a04000 mov ...
5
votes
0answers
880 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
5
votes
0answers
595 views

Reverse engineering an hydrometer's Bluetooth communication

This is a very specific question. I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
5
votes
0answers
724 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
5
votes
0answers
565 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
5
votes
1answer
1k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
5
votes
0answers
188 views

How to find the symbol table in a TI DSP. (TMS320C5510)

That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
4
votes
0answers
62 views

QEMU Translation block

I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so ...
4
votes
0answers
77 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
4
votes
0answers
1k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
4
votes
0answers
92 views

How does cartridge protection distinguish an original vs fake cartridge?

Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. What is ...
4
votes
0answers
479 views

Finding decompress algorithm for unknown compression

I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression. You can see the file here. I think they are using some kind of LZRW 1 ...
4
votes
0answers
428 views

How do I perform concolic execution with Angr and collect constraints on input?

I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
4
votes
0answers
426 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
4
votes
0answers
52 views

Reverse engineering Nord Lead 4 control board

I am reverse engineering a synthesizer named nord lead 4. I want to tap in between the control board and mainboard which has the microprocessor. I didn't start analyzing the signals on the board ...
4
votes
0answers
824 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
4
votes
0answers
652 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
4
votes
0answers
213 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
4
votes
0answers
305 views

Trouble finding the right Checksum algorithm

After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now. I can't seem to find on which Checksum this code is based. Background This is a data ...
4
votes
0answers
378 views

Radare2 project opening

When I open a project r2 -p mypoject I get a bunch of errors with some numbers: 0 0 Cannot add reference to non-function Cannot add reference to non-function 1482 I use latest version of radare2 ...
4
votes
0answers
214 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
4
votes
0answers
104 views

DSi Data Recovery Process?

I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it. After looking closely at the system, it appears that the memory must be integraded onto ...
4
votes
1answer
1k views

Understanding AutoIT “compilation”

I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support. I have tried looking for 3rd party ...
4
votes
0answers
1k views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
4
votes
1answer
804 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
4
votes
0answers
182 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
4
votes
0answers
3k views

Well-known JSON obfuscator that puts the string “Salted12” in front of obfuscated files?

I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be ...
4
votes
0answers
667 views

Need help figuring out compression used on a PKDPX file from a Nintendo DS game

So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky. So far most formats were pretty easy to reverse, until I stumbled on a ...

15 30 50 per page
1
2 3 4 5
27