All Questions

Filter by
Sorted by
Tagged with
0
votes
2answers
492 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
1
vote
4answers
4k views

Where should I put my breakpoint? (USB dongle protected software, probably marx)

I'm trying to bypass the license validation process of a very old program called COSIMIR. It uses a USB dongle (which we have) however I don't have access to it, because it belongs to my university. ...
2
votes
1answer
39 views

How to type data as a relative address in Ghidra?

A jump table I am reversing uses relative offsets to both data and functions. These relative offsets are 32-bit integers added to the address that the value is stored at. Does Ghidra support typing ...
0
votes
0answers
10 views

CFT challenge with Trojan malware?

I am trying to solve a CTF challenge with levels with escalating difficulty. At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It ...
0
votes
0answers
11 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for android and every time I try to call a function (lua_gettop from the lua 5.1 library) from the app's address space it hits me with ILL_ILLOPC, I made sure to ...
5
votes
4answers
6k views

How to SUCCESSFULLY add a code section to an executable file in Linux?

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work. I need to add a section to an already compiled binary. Lets say for a moment is an ...
1
vote
3answers
200 views

High-level language decompiler on WIndows

So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
1
vote
1answer
136 views

Dump PCode in Ghidra for a specific decompiled function

I'm working on an automatic exploit-generation system for low level code, and I want to try it out on real world code. I thought PCode might be a nice place to start, since it abstracts away over many ...
0
votes
1answer
11 views

Does opening a crash dump run a file in memory?

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
0
votes
4answers
2k views

Tool besides ida to get high level code

I looking another tool besides ida to get high level code from binary file.(like oda pesudocode) I know that the high level is not perfect on every tool, but I want try another tool. My code compile ...
0
votes
0answers
27 views

How to extract specific data from memory

I'm totally new to this reverse engineering stuff. I'm working on my own project and trying to parse poker games from PokerStars application. I have already done with injecting my DLL to the app, but ...
0
votes
1answer
1k views

Suspicious obfuscated JavaScript file

This question is related to another question made on StackOverflow. The users ask about an unknown JavaScript file which is being loaded on his website. I managed to unroll a bit of the JavaScript ...
2
votes
2answers
1k views

How to reverse engineer an exe built using nexe?

I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there ...
0
votes
0answers
11 views

Using angr as a pure concrete emulator

I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries. I would like to do the same thing under angr. I don't need any ...
0
votes
0answers
16 views

Decode strings from Go binaries

Is there an easy way to extract all of the strings from Go binaries ? O anyone ca help me to decode a golang file
0
votes
0answers
20 views

Debugging a security camera with gdbserver

I am just starting in reverse engineering and I have been stuck for a couple of weeks on this problem. It probably is a very basic question but I don't seem to be able to find an answer and I hope ...
0
votes
2answers
116 views

IDA PRO decompiler expression last question (pseudocode)

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); ..... shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory; ..... shellcode(&hkernel32, 0) If ...
0
votes
0answers
14 views

Extract certificate information of a process from memory dump

I have .dmp file for googleupdate.exe process. I wanted to check in windbg this process has a certificate or not in order to detect this process has modified or not because this process has try to ...
0
votes
1answer
401 views

How to fix an extracted dyld from dyld_shared_cache_x86_64?

As part of challenging my self I was trying to run a program that doesn't exist on Catlina taken from Big Sur. I had to extract the dylibs from the shared cache by using this tool. The library called ...
0
votes
0answers
27 views

extracting time latitude and longitude from hexadecimal file

I am working on a GPS dump file. It contains the time as well as position data of a flying object. I am not sure in what units they are and there are no manuals available about the data format. I am ...
2
votes
2answers
7k views

How to decrypt encrypted script files for a game?

I want to mod Tony hawks underground 2. I noticed that the files in a folder scripts (down the game's directory tree), are all encrypted. Where do I start if I want to decrypt them?
0
votes
1answer
17 views

Figure out method name with _dl_runtime_resolve_xsavec

I have a packed Linux shared library that decrypts function stub with INIT_ARRAY. When it's decrypted I'm unable to determine the method name. All method calls are redirected with relocation table. ...
0
votes
0answers
68 views

Game Hacking Prevention - General Question

So I'm in a middle of developing an online video game for Windows and was wondering, how does games' hacking is even possible? I mean, assuming I calculate the HP and the location of every player in ...
0
votes
2answers
61 views

Program doesn't load a custom .dll from main directory. How can i inject a .dll BEFORE the executable starts?

I want to use DXVK in GTA 5 on Windows 11. Using the needed .dlls (d3d11.dll and dxgi.dll) and launching the game comes with this error Using Process Explorer (while the error message is displayed) ...
0
votes
0answers
10 views

How to decomple unmanaged .net assembly loaded and invoked via System.Reflection.Assembly interface?

Is there any tool to decomple unmanaged .net assembly loaded and invoked via System.Reflection.Assembly interface? example code: [UnmanagedFunctionPointer(CallingConvention.StdCall)] delegate void ...
1
vote
0answers
14 views

Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?

I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on. Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit ...
2
votes
1answer
274 views

Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?

I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does ...
4
votes
1answer
181 views

Reverse engineer compressed iOS app file

I want to find out the compression method used by an iOS app used for music notation to store its files. The files of its OSX counterpart are zipped files. You cannot create files in the iOS app, but ...
0
votes
2answers
226 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
1
vote
1answer
74 views

How to get function signature using IDA Python in IDA Pro

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names. I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
0
votes
0answers
34 views

What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?

I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c. Note that I believe DAT_804818d0 is the seed, ...
4
votes
1answer
942 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
0
votes
0answers
17 views

How to gain access to obfuscated files stored within an app's OBB file?

So, for the last few days, I've been working on this problem. I've been trying to gain access to an Android app's code, and have managed to narrow it down (probably) to the app's .OBB file. I can open ...
0
votes
0answers
23 views

Red color in IDA

Why in IDA the numeric offset next to [ebp- marked with black letters in red background? .text:004015D0 ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)...
0
votes
0answers
13 views

Strategies for dealing with complex tree structures?

I've made quite some good progress in reverse-engineering the game Twisted Metal for PlayStation, if you don't know what it is, basically it's a Mad Max like game where cars have missiles and stuff to ...
-2
votes
1answer
187 views

Windows reverse engineered?

Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
0
votes
1answer
33 views

How do I gain access to files that an Android app stores in its persistent internal storage directory?

I was playing a game that had hidden achievements and wanted to find the conditions necessary to unlock these achievements. To do this, I've tried to get the source code of the game, to find the ...
3
votes
1answer
143 views

On reverse engineering an udp protocol to control a drone

My goal is to control my drone with my raspberry pi using python and not the app that is being delivered together with it. First I connected the app to the drone, flew and used aircrack-ng to get the ...
0
votes
1answer
76 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
1
vote
1answer
23 views

Trying to reverse web application connection, but the network tab shows nothing

I've been checking out metaverse-sensation Decentraland (play.decentraland.org) and I'm interested in how they've implemented the massive multiplayer netcode to work well for tens of players at the ...
0
votes
1answer
41 views

ASUS RP-AC51 UART doesn't work with any common baud rate

I have an ASUS RP-AC51. It doesn't broadcast any WiFi network when powered on, the management interface cannot be accessed over Ethernet, and the reset button seemingly does nothing. I decided to try ...
0
votes
0answers
28 views

stack explanation from https://revers.engineering/applied-re-the-stack/

I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at. [Note, all code and quotes ...
0
votes
0answers
23 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
1
vote
2answers
85 views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
0
votes
0answers
15 views

Put pwntools in DEBUG mode when using library

When using pwntools as a library (that is, not importing everything as an exploit kit, just individual libraries), how can I turn on debug mode, so that tubes print to the screen everything they read ...
0
votes
0answers
22 views

How to determine file system or open unknown .img file

I have a .img file which will not mount, open, extract or anything within Windows using either the tools built into Windows 10, WinRAR or 7-Zip, they all return errors. I'm trying to look at data ...
1
vote
1answer
46 views

How to move function names, comments, local variable names and structs to a database for a new version of the executable?

I have reversed a number of functions and added definitions for some structs in an Intel x64 PE executable. A program got an update. I moved old executable with the old database into another folder ...
1
vote
1answer
163 views

Analyzing a possibly malware sample

I am trying to analyze a possible malicious sample. It's a windows executable e3f04124e2e26f8f030f6845086875a9 Md5sum Intel 386 or later processors and compatible processors File 2464.exe 2464.exe: ...
0
votes
0answers
12 views

radare2 convenience variables

gdb allows setting arbitrary convenience variables: set $a = "test" set $b = 3 p $a # => "test" p $b # => 3 Is there a way to do something similar in radare2? I'd like to be ...
0
votes
0answers
10 views

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

In IDA Pro, when you create a custom struct, and apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable it only prints ...

15 30 50 per page
1
2 3 4 5
170