All Questions

Filter by
Sorted by
Tagged with
0
votes
2answers
129 views

Load Library Android

I Work as cybersecurity consultant and now i am on mission to reverse engineering of mobile app. I always reverse it using Jadx and dex2jar... the problem that after reverse them i found some native ...
1
vote
1answer
43 views

What is data only exploitation?

I was wondering, and after trying to read for the past several months I got totally lost and don't understand this concept. Could someone please explain in simple words the concept of data only ...
2
votes
1answer
32 views

Find all x-ref with specific argument with IdaPython

I have function at 0xabcd that is called a few times like Func(1,2,3), Func(4,4,5) I want to find all the references where the third argument is 5. import idautils for f in list(idautils.XrefsTo(...
2
votes
1answer
106 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
1
vote
1answer
47 views

How can I find out the size of heap allocations?

While I debug with GDB I see the address of a buffer that's located on the heap. How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated? When I ...
1
vote
3answers
496 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
4
votes
1answer
7k views

How to scan the ECU Delphi MT05?

The ECU (Engine Control Unit) MT05 from Delphi is used today in many motorbikes and ATV's: Regal Raptor (Raptor, Daytona and Spider 350) AJP (PR7) Benelli (BN600) CFmoto (Terralander X8) Zongshen (...
1
vote
1answer
96 views

Connect remotely with GDBSERVER to pid

When I run gdbserver to listen for port and connect remotely with gdb: Gdbserver command: gdbserver --multi 0.0.0.0:4444 Gdb command: target remote 192.168.1.99 4444 In gdb . How can I connect to pid ...
0
votes
1answer
47 views

Ghidra: Iterating over function's codeUnits returns only 1st instruction

public void run() throws Exception { var cp = currentProgram; var nsSymbols = ghidra.app.util.NamespaceUtils.getSymbols("myNameSpace", cp); var glNS = nsSymbols.get(0)...
1
vote
1answer
345 views

How to read dnSpy code from assembly_csharp.dll

So I have managed to retrieve the assembly_csharp.dll using the il2cpp tool from an android apk, however my issue is that when I go to read the dll using dnSpy I have all the correct looking function ...
4
votes
1answer
85 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
0
votes
0answers
26 views

Identify the index of .swf files within Flash Projector .exe

I have a Flash projector .exe file that has multiple .swf file compiled within it, and while trying to decompile that .exe file to extract the embedded .swf files. I did manage to extract them with ...
2
votes
3answers
290 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
3
votes
2answers
1k views

Finding a place to inject shellcode

I am following the tutorial for ROP Primer, level 0. The tutorial sets the memory at the beginning of [vdso] writeable and executable and copies the shellcode there. I do not know why, but it seems ...
1
vote
1answer
42 views

How to change string-detection rule in IDA Pro?

I'd like to debug a Firmware (ARM-based) which contains a lot of C-Strings. IDA Pro 7.2 seems to have problems detecting strings having special chars (above 7-Bit ASCII) in it. Here is one example of ...
0
votes
1answer
492 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
0
votes
0answers
41 views

IDA does not load PDB file

I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol ...
0
votes
0answers
232 views

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E Wi-Fi controller, and as always nowadays these devices communicate with Cloud servers first, then with you, which practically means you ...
0
votes
0answers
43 views

Execute Python code/script inside a game with statically linked Python lib

I'm playing a game that's made in C++ and embeds Python (2.7) for the client interface and most of its functions. At first, this game used to have dynamically linked Python lib for embedding. So I ...
0
votes
2answers
8k views

Reverse engineering binary file to find flag

The binary is from here: https://files.fm/u/qtqmhhdd I've been attempting this a couple of days. It's an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by ./...
1
vote
1answer
51 views

Finding the hash algorithm for these payload-crc pairs

I have a remote for a LED panel which sends following 4 bytes data and last byte some sort of CRC/counter byte. I already know that the first 2 bytes are remote-id, the third byte is panel-id and the ...
0
votes
0answers
28 views

Hardware Breakpoint wont work on address created during runtime

I am currently trying to crack a crackme.exe. Before the jump, it compares the following (0 == not registered): cmp byte ptr ds:[eax+0x15FC], 0x0 If I normally load the .exe and try to go to the ...
2
votes
1answer
2k views

Why can't gdb read memory if pwntools is used to send input?

Here is the program which gdb is attached to: prog.c #include <stdio.h> void dummy(char* s) { } int main() { char buf[512]; scanf("%s", buf); printf("%s\n", ...
62
votes
7answers
125k views

What are the possibilities for reverse engineering an IPA file to its source?

I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
0
votes
0answers
28 views

Immunity Debugger not running on Windows 10

I'm experiencing some issues with Immunity Debugger where when I'm ready to run the program, I'll push the "play/start" button and nothing will happen. I've gone through the process already ...
2
votes
2answers
453 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
32 views

Reverse engineering STM32F303 firmware udpate

I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its ...
1
vote
1answer
517 views

pyelftools relocation section symbols

I have been trying to get into reverse engineering as of late and after playing with Radare2 I realized I was playing with a lot of things without really understanding what I was doing. In an effort ...
0
votes
1answer
241 views

How to calculate Opcode Length from Ollydbg

Suppose I reverse a dll, and searching for a Function, say for instance Send(), I have reversed the ws2_32.dll now How Can i calculate the number of bytes from there to know that i need 5 bytes of ...
0
votes
0answers
42 views

Reverse compression of QDSP6 modem files

I'm trying to reverse a qdsp6 modem file but I'm stuck with the (probably) compressed segments. There is also a third compressed segment which simply uses zlib but the other two are not recognized by ...
0
votes
0answers
29 views

Reversing DALY BMS BLE protocol

I am trying to communicate with the DALY BMS (Battery management system) via BLE. I was wondering if anyone has any bit of information regarding their protocol, something to start with?
0
votes
0answers
81 views

Access file path using raw address

I am reversing a MIPS .cgi with Ghidra which has an external function call. I opened that library file to view the function decompilation, and it was using the open() function with a hex value instead ...
0
votes
0answers
24 views

Write data to / patch uninitialized memory segment in Ghidra - possible?

Working on a loader for a fw in ghidra (10.0.4_PUBLIC). I've created an uninitialized memory segment for the stack, but at some point I need to write/copy some data into this segment (some hundred ...
12
votes
6answers
12k views

Decompilation techniques for DOS .COM files

I've found a binary copy of a DOS freeware game I was fond of back in the day (Firefighter, downloadable as FIRE.COM) but the source code is not available. I'd like to re-implement it in C or Python ...
1
vote
0answers
26 views

Video Packets via UDP - How to decode or identify video format?

I'm working with a cheap wireless video transmitter and receiver system that uses an Android App to receive the video over WiFi. We want to be able to identify where the stream is coming from to be ...
1
vote
0answers
25 views

Hopper Disassembler AArch64 assemble instruction syntax error

As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error". At this moment I can only change it by editing the instruction encoding in hex view as a ...
1
vote
0answers
23 views

Call stack in Windbg address with no modules associated

I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...
0
votes
3answers
340 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
1answer
81 views

Retrieve user data as if it were the game making the request

Don't think the title really summed it up but here goes. There's a game built in Unreal Engine 4 that displays your (and other users) in-game statistics e.g a leaderboards page. I can determine some ...
0
votes
2answers
778 views

How to 'hack' the chat box in an online game

First and foremost, this is really just a UI hack, nothing that would give you an unfair advantage over an opponent. I play an online game that is predominately played by Spanish speaking players. I'...
1
vote
0answers
48 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
0
votes
0answers
67 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
2
votes
2answers
124 views

How to load a pdb file from the hard drive with IDA Pro?

All the answers I see on Google are about how to load PDB files from online servers. But I have an exe I'm debugging. It's my own exe. Only reason I want to debug it, is so that I can step through ...
0
votes
0answers
41 views

How to decrypt/decode the strings found in desktop application with x64dbg?

I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
1
vote
1answer
45 views

Change iOS app binary file

I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
1
vote
0answers
26 views

What is the correct argument for the disassembled function / constructor?

I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
1
vote
0answers
40 views

Can't Find hex Value from X64dbg in hex editor

I want to make a simple patcher for exe , so here is the original hex value from the x64dbg before any modify : I took the hex value and searched for it in the hex editor ,but can't find any . So why ...
0
votes
1answer
68 views

Java says "ghidra" is unknown protocol when creating project on linux

Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
1
vote
0answers
66 views

Int64 parsing from args in Frida-trace for iOS binaries

I'm using frida-trace to log some methods and I've come across the following. onEnter(log, args, state) { log(`-[Somefunction somefield64:${args[2]}]`) } somefield64 returns what I believe to ...
0
votes
2answers
104 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...

15 30 50 per page