All Questions

Filter by
Sorted by
Tagged with
4
votes
2answers
2k views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
4
votes
4answers
5k views

Use OllyDbg to identify what happens when a button is pressed

I am entirely new to reverse engineering, but nonetheless I have been given the challenge by a friend to crack a computer program he wrote. Having never done this before, my research online suggested ...
4
votes
2answers
5k views

IDA - How to transform VA to FO?

I'm using IDA Pro to disassemble/modify a PE file. How can I get the file offset in the '.exe' where a specific data/instruction resides. Or how can I get the file offset which is the source of a ...
3
votes
3answers
5k views

Determind length of instructions in bytes

Where is it possible to find a list of x86 instructions (and x64 instructions) with the (hex) opcode and the length/size in bytes of the instructions, such as: 0x90 = NOP = 1 byte 0xE9 = JMP = 5 ...
3
votes
1answer
13k views

how to setup IDA pro linux GDB server

I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
3
votes
2answers
12k views

Hikvision camera firmware reverse engineering

I have a camera with Hikvision firmware. The firmware file has clear text in it, for example, there's a shell script you can see in there that coincides with a shell script when I tellnet in. There's ...
3
votes
2answers
25k views

IDA cannot launch debugger for 64-bit exe files

I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same. Here is that I do. Launch IDA Pro (64-bit) Select Debugger -> Run -> ...
3
votes
2answers
4k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
1
vote
0answers
388 views

beginner hardware sniffing question

this is not going to be a specific question but here goes. Ive just started reading about reverse engineering for the 3ds. Is it possible to open the 3ds up and connect a probe somewhere on the chip ...
7
votes
1answer
4k views

How to recover the exception info from .gcc_except_table and .eh_handle sections?

For C++ program with try catch defined, when using g++ to compile it into assembly code (test is on x86 32bit Linux, g++ 4.6.3) g++ -S cppexcept.cc A specified section called .gcc_except_table is ...
6
votes
3answers
2k views

What is the Ubicom32 toolchain and where can I find it?

I am currently reversing firmware for some device. Without any issues I was able to reach deep into its core and extract the file-system. Now I was trying to reverse some of the special applications ...
5
votes
5answers
6k views

What is an entropy graph

I am new to reversing and I see a tool Detect It Easy and it has a feature called Entropy. I want to know what it is used for?
5
votes
2answers
4k views

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides www.hex-rays.com/products/ida/...
5
votes
4answers
2k views

Are there any modern assembly-level patching tools?

I've recently been undertaking a little RE project where I needed to patch the executable. For small modifications, I know enough x86 to patch in an jump, nop, infinite loop, etc, so a hex editor is ...
5
votes
1answer
1k views

Patching PE File - Adding data

After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and ...
4
votes
2answers
3k views

adding instructions in IDA

I noticed that you can't simply add an instruction in IDA. Yes, you can modify one, but not add(maybe there is such feature? Can't find it though). So I used HxD to forcibly increase the PE binary ...
4
votes
1answer
252 views

How can a video file cause an iOS device to crash or hang?

There have been reports of a malformed h264 video file causing iOS devices to hang or crash (I've added the link in plaintext to avoid accidental clickthroughs, play at your own risk: http://www....
3
votes
2answers
868 views

x86_64 Calling convention

I am slightly confused by some x86_64 linux code here (generated by llvm): # BB#0: # %entry push RBP .Ltmp21: .cfi_def_cfa_offset 16 .Ltmp22: ....
3
votes
3answers
14k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
3
votes
0answers
2k views

Reverse Engineering a 8 bit CRC checksum

I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am ...
3
votes
1answer
567 views

Identify a decryption scheme

I'm trying to identify a decryption scheme used by some licencing mechanism. It took me some time to realize that this was encryption and this is some kind of follow up to this other question of mine :...
2
votes
1answer
1k views

Any good deobfuscators for java?

So I've built an obfuscator for java source code, would anyone know if there is any good deobfuscators which i could test how well my obfuscator is? I know there are many deobfuscators out there, ...
2
votes
3answers
743 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
2
votes
0answers
526 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
2
votes
1answer
4k views

Using GDB to modify an executable

I'm working on an assignment for a systems programming class, and for extra credit we are asked to modify an executable to allow it to accept the reverse of our PIN (finding the PIN was the original ...
2
votes
2answers
575 views

How work this obfuscation, and how deobfuscate?

Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§=~[];Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§={___:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$$$$:(![]+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],__$:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$_:(![]+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§],_$_:++Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§,$_$$:({}+"")[Ø Ø¡Ø¢Ø£Ø¤Ø¥Ø¦Ø§...
1
vote
2answers
21k views

How can I decompile an ARM Cortex-M0 .hex file to C++?

The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS ...
8
votes
1answer
222 views

Why are those instructions generated?

After disassembling a program, I see the following asm code generated : .text:004D5911 mov [ebp+var_4], ecx .text:004D5914 mov ecx, [ebp+var_4] .text:004D5917 test ecx, ecx .text:004D5919 ...
6
votes
3answers
14k views

Find a string that I entered in ollydbg

Say, there's an input box and I enter a text. Can I somehow find the location that text is entered?
5
votes
1answer
787 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
5
votes
2answers
1k views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5
votes
2answers
546 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
5
votes
1answer
1k views

How do i fine-tune Hex-Rays decompiler for 16-bit?

It is mentioned on the IDA Pro Hex-Rays site under decompiler error messages 16-bit functions are not supported It goes on to say: The decompiler itself CAN be fine tuned to decompile 16-bit ...
5
votes
1answer
776 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
4
votes
2answers
429 views

Why does an executable give an error when opened in $tool?

I have an executable that runs in the operating system, but when when I open it in $tool I get an error. What is going on?
4
votes
2answers
3k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
3
votes
0answers
235 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...
3
votes
2answers
2k views

Weird binwalk output on GoPro Firmware

I'm trying to extract GoPro hero 3+ camera firmware but I'm getting a weird output from binwalk. This is the binwalk output (Uploaded to pastebin): http://pastebin.com/raw.php?i=yVZFGZT6 As you ...
3
votes
1answer
4k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
3
votes
2answers
4k views

Is there a way to adjust local variables when a function doesn't utilize ebp?

I have a problem just like in the question. Modern compilers don't use ebp to handle local variables and arguments, they just calculate and add hard=coded offsets to esp. Example: sub esp, 5Eh ...
3
votes
1answer
616 views

Computing subtracted stack space for a function manually

Lets assume this function frame : How to calculate and check if subtracted stack space by line 3 is 58h ?: sub esp, 58h And this is the code, the compiler is also Dev C++: #include <stdio.h> ...
3
votes
2answers
2k views

How are addresses calculated from the values in x86 segment registers?

How are the 16-bit values in segment registers used to represent large memory addresses? ES 0023 32bit 0(FFFFFFFF) CS 001B 32bit 0(FFFFFFFF) SS 0023 32bit 0(FFFFFFFF) DS 0023 32bit 0(FFFFFFFF) FS ...
2
votes
1answer
3k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
2
votes
1answer
1k views

Why does Olly 2.01 fail to break at the module EP?

I was playing around with tutorials/white papers concerning unpacking, specifically UPX. As Olly 2.01 is my debugger of choice, I attempted to unpack an UPX-packed exe with it and to my surprise, it ...
2
votes
1answer
855 views

OllyDbg 2.01 Run Trace "Skip selection option"

In OllyDbg 1.10 it was possible to skip some parts of code when starting run trace(just example): So when there is some heavy code it was possible to skip to trace only some useful information. I ...
2
votes
1answer
458 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
2
votes
1answer
533 views

How can I obtain the data of how many memory references are symbolized by IDA-Pro?

We all know that in typical programs, there exist some references. When compiling, linker will translate all the memory references into concrete memory addresses during the symbol relocation step. ...
2
votes
2answers
574 views

Putting an application in between client and server

I'm attempting to reverse engineer (without dissecting the source code, as my understanding is that reverse engineering by analyzing input and output and building something from scratch that fits is ...
2
votes
1answer
1k views

Custom UI buttons

I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
2
votes
1answer
188 views

How do I get the all the basic binary blocks containing a special instruction like 'CALL' or 'RET' using python in Ghidra?

I am using Ghidra to do reverse engineering of an ARM binary. I want to print the disassembly of all blocks across all functions containing a specific instruction like 'CALL' or 'RET'. How do I do ...

15 30 50 per page
1 2 3
4
5
15