All Questions
814
questions
3
votes
1
answer
586
views
Reconstructing a PE from unpacked memory in IDA
I’m trying to byte patch a 12 year old program written in MS Visual C++ V9. However, some of its code has been packed with ‘Lock Express V2.0’. I’ve loaded the executable in IDA and run the Universal ...
3
votes
1
answer
1k
views
Command for Command line plugin does not work
I need to analyse a sample which creates a child process. I want to analyze the child process, too, but I have the following problem. Therefore, I take the command line plugin for my olldbg v1.10 and ...
- 1,541
3
votes
2
answers
3k
views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
- 41
3
votes
2
answers
795
views
Convert Mach-O VM Address To File Offset
this maybe total no brainer but i'm really new to this and i'd really appreciate some help!
Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully ...
- 183
3
votes
1
answer
6k
views
Set memory breakpoing on access on a section in IDA
Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ?
I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th ...
- 340
3
votes
2
answers
1k
views
Can I provide bytes to Radare to be disassembled?
Let's say I want to check this guys work. He says that he is getting
8d 15 c8 90 04 08 lea 0x80490c8,%edx
ba c8 90 04 08 mov $0x80490c8,%edx
Is there an easy way with Radare to ...
- 1,779
3
votes
2
answers
632
views
How to find location of environment variables in 64 bit binaries at runtime?
In the main function, program authors can choose to receive the char * array as a parameter to main that points to the environment variables
int main(int argc, char **argv, char **envp) {
...
}
The ...
- 163
3
votes
1
answer
3k
views
How does r2dec compare to pdc?
Radare has a command pdc
pdc pseudo disassembler output in C-like syntax
I'm curious to know how the plugin r2dec-js compares to pdc it seems like they do the same thing.
- 1,779
3
votes
2
answers
2k
views
Extracting HTTPS packets before encryption
Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course).
There is no way to get hands on server private ...
- 31
3
votes
2
answers
1k
views
Arm ldr diffrent between # and =
In ARM assembly, what is the difference between
ldr r4, =0x44454433
and
ldr r4, #0x44454433 ?
- 49
3
votes
1
answer
13k
views
What is the meaning of *(_DWORD *)
I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below.
for ( i = 0; i < 6; ++i )
{
v7 = (int)&val_253;
for ( k = 1; k < ...
- 187
3
votes
1
answer
855
views
How to add new language to ARM firmware
I have piece of firmware (download from here) and I need to get access to its filesystem.
Here is the output of a binwalk scan:
root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin
...
- 31
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
3
votes
0
answers
4k
views
How to bypass certificate pinning on OS X and Windows [closed]
When reverse engineering a thick application it can be very useful to be able to see the network traffic it generates.
Because of this, many applications use HTTPS to communicate with their servers. ...
- 437
3
votes
1
answer
2k
views
What is an SDB file?
In the abstract, I'm just wondering what an SDB file does and what role it plays. I see Radare2 is using them.. Here are some of the SDB files I have under ./libr/bin/d/dll/, what do these do?
./libr/...
- 1,779
3
votes
1
answer
2k
views
ELF binary injection
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
3
votes
1
answer
11k
views
IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection
I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures.
A lot of standard C++ functions are not being recognized ...
- 346
3
votes
1
answer
2k
views
CRC8 reverse engineering
I am creating a CAN Bus on-bench testing solution which replicates the entire vehicle to test a single module. I have a number of messages that require a CRC byte in order to be valid. The messages ...
- 33
3
votes
2
answers
7k
views
Why doesn't WinDbg resolve the function names?
This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
- 31
3
votes
1
answer
4k
views
Can I use python3 with IDA 7.0?
Got IDA Pro 7.0 (I can't update at the moment),
I'm currently unable to use idapython.
I have python3.8 installed on my machine and nothing else (I dont want any collisions).
How can I use make ...
3
votes
1
answer
538
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163
3
votes
1
answer
450
views
ELF x86 - Why is return address pushed twice?
I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there.
main:
lea ecx, [esp+0x4 {argc}]
and esp, 0xfffffff0
...
- 193
3
votes
2
answers
3k
views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
- 33
3
votes
3
answers
1k
views
Finding end of file
I have got a file which contains other files. I know where the subfiles start (header) but how do I know where the subfiles end ?
Edit: Files are like: sound files (.wav) and images (.bmp, png, jpeg)
...
- 33
3
votes
1
answer
1k
views
Dump a child process created by malware with an ALTERNATIVE process hollowing process
I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
- 31
3
votes
1
answer
3k
views
Understanding unknown in IDA
What is this instruction trying to do?
.text:4044A5EC LDR R5, =(unk_40885080 - 0x4044A5F8)
Looking at the value of unk_40885080 it holds a value of 20 in the .data segment.
- 179
3
votes
1
answer
1k
views
Loading a Driver in Immunity
It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on Gray Hat Python and it states:
To test this out, try loading the driver C:\WINDOWS\System32\...
- 131
3
votes
0
answers
335
views
Blank binwalk and binvis.io
I've been trying to extract a Bluetooth door lock's firmware. When I tried extracting it, I got an empty output.
I then found a post which I thought would help me but when I tried using binvis.io, ...
- 63
3
votes
1
answer
2k
views
What are the steps, to extract an unknown archive file in this case?
I've never did something like this before, but I have programming experiences. There are two files:
data00.big and data01.big, which I would like to extract.
I've tried Dragon Unpacker, which can ...
- 214
3
votes
1
answer
3k
views
GCC change the order of variable declaration
I have this very simple piece of code:
// test.c
int main(){
int a = 0;
char b[10];
int c = 0;
return 0;
}
Compiled with gcc (6.2.1):
$ gcc -g -o test test.c
And analysed with gdb:
$ gdb ...
- 199
3
votes
3
answers
4k
views
Does a JE must follow directly to an CMP?
I wanted to know if a jump instruction as JE must directly follow to a CMP instruction. Until now, I did always see that first a CMP comes and after that a JMP. But today I have discover the following:...
- 1,541
3
votes
3
answers
918
views
Cleaning HexRays Output
My HexRays decompiler output often looks like:
v0 = LoadLibraryW(L"wininet.dll");
v1 = v0;
if ( !v0 )
goto LABEL_1;
v2 = GetProcAddress(v0, "InternetOpenW");
v3 = GetProcAddress(v1, "...
- 758
3
votes
3
answers
7k
views
IDA Xrefs from - how to?
I want to generate all xrefs from function just to check what api it uses in its call-tree. I know I can generate call tree graph by right clicking on function name and "Xrefs from", but I would like ...
- 95
3
votes
1
answer
8k
views
A simple reverseme application won't run, always loads the code of ntdll and terminates the app [closed]
I opened a simple reverse me windows application in ollydbg, then it shows the code for the "ntdll". Since I want to view code and run "ReverseMe" I double clicked the "ReverseMe" on the "Executable ...
- 131
3
votes
2
answers
1k
views
How to extract debug information from a DOS executable compiled with Watcom C/C++?
I have a DOS executable which has been compiled with Watcom C/C++ 10.0.
That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
- 371
3
votes
1
answer
1k
views
IDA PRO and Dos Load Exec
I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace?
It has already ...
- 31
3
votes
1
answer
401
views
How to set-up a lab for reversing a mass transit ticketing system?
I recently stumbled on a talk from Ruxcon 2012 explaining the reverse of a mass transit ticketing system.
Basically, they focused on paper tickets reverse engineering with a skimmer and a lot of ...
- 19.1k
3
votes
0
answers
61
views
How do I make a text field editable when the app is designed to autofill OTP SMS?
Hello fellow rev engineers,
I'm running an app in an emulator and the problem is that for registration it must autofill the OTP sent by SMS, the text field isn't editable/clickable and I can't advance ...
- 31
3
votes
0
answers
960
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131
3
votes
2
answers
225
views
Attack on wireless interconnection [duplicate]
Scenario:
Two devices have wireless connect. ( like wi-fi )
Probably encrypted. ( like wi-fi's WPA2 )
Which instruments are best for discovering carrier frequency?
How encrypted-text should be ...
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
3
votes
1
answer
2k
views
How to dissassemble Motorola/Freescale/NXP PowerQUICC excutable
I have a probably executable file for Motorola/Freescale/NXP PowerQUICC MPC860 and cannot disassemble it with IDA Pro since I cannot find the correct processor type in IDA?!
IDA list MPC860 as ...
3
votes
2
answers
2k
views
How do I adjust the length of the parameters in IDA?
In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value.
However, how can I do this with the parameters size? ...
- 627
3
votes
3
answers
3k
views
How to edit an .exe file without overwriting previous information
A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this ...
- 162
3
votes
3
answers
2k
views
is ther a way an app can display a message without the use of messagebox API?
I have app that used to display a message "processing" after clicking OK button then another message "done", but now it doesn't. So I got reverse it and see whats happening, but it turns out that the ...
- 73
3
votes
2
answers
3k
views
Permanently load a DLL to an executable
With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.
I've learnt that ...
- 31
3
votes
1
answer
1k
views
Good foundation for reverse engineering malware
I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
- 187
3
votes
1
answer
2k
views
Reversing Qt application
I want to reverse-engineer a Qt crackme written for linux. I would like to follow where introduced text gets. I have found this gdb macro to print QStrings (Qt5). To test it I wrote a simple ...
- 887
3
votes
2
answers
2k
views
Legal risks of retro engineering a 19 years old game
I am quite new to retro-reverse-engineering, and I am concerned about my current hobby.
Months ago I started to reverse a 19 year old commercial game, no longer on sale (for ages), and not supported (...
- 135