All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
42 views

ADDS(operations with S suffix) -Arm

This question was asked before here but in the answers I did get what i was looking for. Consider this: ADDS R0 RO R1 As far as I know to update the cpsr flags a subtraction has to be made. So after ...
1
vote
2answers
294 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
0
votes
0answers
9 views

Missing definition of `FuncDefn`

So I used latest (10.0.4) Ghidra to decompile a x86 binary to c file and h header/ then I preprocessed it with the msvc cl compiler but in the result, while parsing it - turns out the typedefs for ...
1
vote
2answers
195 views

Use enum for switch case values in ghidra

Is there a way in ghidra to change decompiled switch statement case values to their names? I'm looking at a WndProc function, with a prototype of LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM ...
0
votes
0answers
36 views

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it"). I found that user to have the most ...
0
votes
0answers
15 views

Role of a breakpoint opcode hardcoded in a binary

In a reverse challenge, I am trying to reverse a very short and simple binary (type elf32-i386). In this binary, there are several hardcoded 0xce / into and 0xcc / int3 opcode. I know that, when ...
0
votes
0answers
10 views

Search string : exact message not found

Hello to you for the service you make us. I opened the executable of a crackle in X64DBG but by launching the search for strings I did not find the exact message of the application relating to the ...
0
votes
1answer
167 views

Need starter-help on reverse-engineering a game algorithm

I've got a dataset of about 1700 attacks in this game. A subset of the data is provided here. It consists of 9 columns: modifier Astr Aspd Adex Adef Dstr Dspd Ddex Ddef The modifier is in a range of ...
0
votes
2answers
115 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
0
votes
0answers
11 views

how to bypass the instruction for antiDBI

This instruction stops the execution of the pin code jmp far 0x161061d, 0x33 ? how to get around this?
1
vote
1answer
259 views

OllyDbg "runs away" when stepping over wininet.HttpSendRequestW

I'm, using OllyDbg 1.1 to debug some malware and it's been quite a while since I've dealt with wininet calls. When I set a software or hardware breakpoint directly after the call to wininet....
3
votes
1answer
1k views

How to extract DVB firmware bin file?

I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction. I tried bin walk, but the file that it extracted ...
3
votes
1answer
134 views

What is an "mpi register base"?

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
7
votes
1answer
2k views

Identifying a toner chip and its communication protocol to re-program it

I need help identifying a chip and how to reset it from a new Brother's toner cartridge TN227 and TN223. This comes from the new Brother HL-L3230CDW laser printer. There is currently no information on ...
0
votes
0answers
58 views

QR-Codes of Temial-Teamachine

I have a tea-machine that reads QR-Codes and brews the tea accordingly. I want to generate my own codes. I have the following codes (and more): Copy/Paste of the C-Column L7UMQRQCQAZBD OYXPVAANAB4ZE ...
2
votes
2answers
217 views

Unable to unsquash from a FW dump

After trying to unsquash a firmware dump from a router without success, I am asking for help. I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...
0
votes
2answers
461 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
0
votes
0answers
15 views

Disassembling an embedded camera SPI flash

I would like to read the code from an SPI of embedded camera, in order to customize it. The CPU chip label EMF845 has no search results. According to binwalk/cpu_rec, the code most likely belongs to ...
0
votes
1answer
1k views

Decrypt config.bin file from Huawei B5328 router. I have source files

I need some help in decrypting the file config.bin generated by the page backup_setting.html from Huawei B5328 router. I have access to all files in the router, even the www files hosted on the www ...
21
votes
6answers
31k views

How do I analyze a .apk file and understand its working?

I am an Android app developer, and recently I encountered a problem with in-app purchase. I discovered that in some apps, in-app purchases can be done for free using this application. I know this app ...
2
votes
0answers
30 views

WinApi of UWΡ Shаdοws

I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ. What I know: This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
0
votes
0answers
17 views

Cutter Mac OS Debugging

I am just stuck at OSX code signing requirement to debug others' apps. (I'm new to debugging on OSX.) Can someone please explain the steps in order to use Cutter correctly (with Rizin)? Or any other ...
0
votes
2answers
572 views

Hex-Rays skips code

I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings. The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) ...
2
votes
1answer
171 views

How to make a reference to a different segment?

I am reverse engineering a very old LE MS-DOS binary and have convinced Ghidra that there are two segments in the file, one is the code segment and another one is the data segment. Now when I look ad ...
0
votes
0answers
25 views

identify the functions of stripped binaries

As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
1
vote
1answer
44 views

Dump PCode in Ghidra for a specific decompiled function

I'm working on an automatic exploit-generation system for low level code, and I want to try it out on real world code. I thought PCode might be a nice place to start, since it abstracts away over many ...
1
vote
1answer
60 views

How does Cheat Engine offset calculation work?

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number. IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C; /...
0
votes
1answer
53 views

Appcall on function that uses global variables

I'm reversing an executable, there is a function in the executable that uses global variables that are not used in any other function, they are initiated in the target function, My question is will ...
0
votes
0answers
14 views

Change function implementation

I have a Mach-O 64-bit dynamically linked shared library (ARM64), wrote in Swift/Objective-C language for iOS. Is theoretically possible to open this file in Ghidra or IDA reverse tool, change some ...
1
vote
2answers
8k views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
0
votes
1answer
34 views

The Logic Of Incremental Data on Serial Communication Encoding

These are the serial communication reverse values. I am trying to understand the logic behind this. I am pretty sure that 2 bytes represent 1 byte(high byte and low byte), values are correct. I tried ...
1
vote
3answers
359 views

IDA plugin with visual studio c++ 2019

Hello all and sorry for my bad English I am trying to test an example for developping plugin in C++ with IDA from the book : http://www.binarypool.com/idapluginwriting/idapw.pdf I am using Visual c++ ...
0
votes
1answer
39 views

idapython: type information with different prefixes

I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
0
votes
2answers
84 views

what does an integer modulus 32 cast to (byte *) points to?

As part of a CTF challenge I have to understand the inner workings of a cryptlock type malware, and use it to decrypt a file containing the flag. I used GHIDRA to decompile the binary. The encryption ...
0
votes
1answer
44 views

Is that message mean the program has an anti-debugger?

When trying to debug a program using the x64dbg and in a specific step, the following problem happens: Is that mean that the program has an anti-debugger? if not, why when debugging the program and ...
0
votes
0answers
29 views

Force IDA to redo SP analysis?

I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
1
vote
1answer
48 views

IntelPin, Ins_Insertcall?

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall: VOID CpuidCalled(const CONTEXT* ctxt) { std::cerr << "+++++&...
1
vote
0answers
25 views

I need to make a dominance tree using Ghidra headless

I need to make a dominator tree where I need to tell a function(a) dominates function(b). There is an API in GraphAlgorithms which needs GDirected graph and "vertex from" parameters, but I ...
4
votes
2answers
344 views

Z80 Absolute Jump to offset in middle of instruction

I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
0
votes
1answer
42 views

Paint path in Ida according to gdb log file

In Gdb I put script that print each instruction to gdb.txt file. I want to load this file to Ida to show and print/paint the path that the process has been running. The gdb script is # not strictly ...
0
votes
2answers
65 views

Understanding Loop Statements: For & While

Background Hello! New user. I am working on a personal computer science project that involves research on loop statements such as the for and while loops in C - these loops can apply to other ...
0
votes
0answers
14 views

failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64

I have implemented packer of x86_64 shared library. Briefly, a loader is injected to a shared library, and the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
1
vote
1answer
56 views

Demangling symbols from green hills rh850 compiled binary

I have a binary compiled in Rh850 using green hills compiler from the looks. Luckily, it still symbols attached ,but I am struggling to read the symbols and it is worth my time to demangle them. Is ...
0
votes
0answers
28 views

Reverse enginiring Samsung Quick share uwp app

I want to make the Samsung quick share to work on my PC which is not Samsung. So which DLL file to look to reverse engineered to bypass that restriction, and how to get full access to uwp folder? ...
0
votes
1answer
137 views

Decoding unknown ID format parts

I have a data set where events have a unique ID. Some examples: CkUKGkNNZmY1TkhObi1zQ0ZWT0h3Z0VkaExJQ0xnEidDSlB0bG9UTG4tc0NGWmhpaXdvZDFxOE5fdzE1OTc1NzY4NzU4Mzg%3D ...
1
vote
1answer
44 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
0
votes
1answer
17 views

Functions and methods for working with AST tree

I am implementing deep search with Python Hex Ray API. Can someone say classes and methonds for implentation this feature on IDA Python API?
4
votes
0answers
5k views

Deobfuscating Unknown C# obfuscator?

Hello, I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
2
votes
2answers
452 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
1
vote
1answer
42 views

IDA Pro - configure register clobbering

TL;DR: The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...

15 30 50 per page
1
2 3 4 5
168