All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

In X64dbg, how can I script a string write to memory?

I find that I can write to memory as [addr] = value As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html And while I could work around my problem as dividing ...
0
votes
0answers
5 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
1
vote
1answer
20 views

Showing exception handlers in IDA pro decompiled code?

Is there a way to show these exception handlers in IDA Pro 7 decompiled code? I can't tell that a block is in a __try block without looking into the disassembly. __int64 __fastcall ...
0
votes
2answers
51 views

How is subtraction performed on unsigned numbers within the CPU?

I am learning about various flag states for the cmp instruction. From reading, the cmp instruction is really just a sub instruction that sets the various flags (OF, CF, ZF) accordingly depending on ...
1
vote
0answers
32 views

How to trace in x64dbg?

Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?
0
votes
0answers
24 views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
-1
votes
1answer
100 views

What is the following assembly code doing?

str fp,[sp, -4]! add fp, sp, #0 sub sp, sp, #12 str r0, [fp, #-8] str r1 [fp, #-12] L5: ldr r3, [fp, #-8] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [fp, #-12] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [...
0
votes
1answer
48 views

Disassembling only given function

I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's ...
2
votes
0answers
46 views

When virtual table is not the first element of structure?

Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
1
vote
2answers
61 views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0
votes
0answers
34 views

injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`

I've encountered an image validation error while trying to inject dll from driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the ...
0
votes
1answer
34 views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
1
vote
1answer
57 views

Reverse getline(cin, text)

Sup, guys. I'm trying to solve a crackme that was made in C++, and I was able to "recreate" a function call, through the library calls the program made. Here's the piece of code that I'm trying to ...
1
vote
1answer
46 views

Understanding operand forms

9(%rax, %rdx): What happens here? Is 9 the offset? and do you add the two registers together? I'm reading Randal E. Bryant and David R. O'Hallaran's "Computer Systems - A programmer's Persepctive" ...
0
votes
1answer
43 views

Getting illegal access fault with error :The address 0xffdeb9f0 could not be accessed."

Getting illegal access fault with error The address 0xffdeb9f0 could not be accessed. I am trying to execute a shellcode in buffer overflow vulnerability. I am able to put the shell code at the ...
2
votes
2answers
77 views

Java reverse engineering tool

I'm getting started on Java reverse engineering but I can't find a great tool. I'm currently using JD-Gui to decompile it. I've tried PNF's JEB which is really perfect but it's only for Android stuff....
0
votes
1answer
36 views

x86 main preamble makes stack aligned on 32-bytes boundaries

For the record, I've read all stackexchange relevant answers on the topic (here and here) plus other articles to fully grasp the concepts of memory alignment and CPU natural boundaries. But for some ...
1
vote
0answers
57 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
1
vote
0answers
64 views

Is there a way to trace the differences of a software in x64dbg?

Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
2
votes
1answer
128 views

Recognize a decryption algorithm

I'm trying to reverse a malware that builds its IAT at runtime. Due to my inexperience, I'm having trouble to understand this function that accepts into EAX a dword (maybe some sort of hash) and into ...
1
vote
2answers
53 views

The hex codes in being replaced while finding bad characters for Buffer overflow

I am facing problem in finding bad characters because the hex codes are being replaced with \x3F & some other codes. Here I have all the 256 hex chars from \x01 to \xFF and as you can see many of ...
0
votes
0answers
29 views

Can anyone please help to identify an unknown chip on auo lcd

I am trying to identify an unknown chip with these markings: 2L736 OE1940 Can anyone please help me? I have become frustrated over this.
0
votes
0answers
38 views

How large are privileges of linux kernel module?

I know that kernel modules are practically part of the kernel since it gets loaded inside it. But I am not sure if it really gets all privileges the system has. Can it read/write code inside the ...
0
votes
1answer
27 views

How is `va_list` implemented in Assembler level on ARMv7 Android?

I need to extract all arguments from CallStaticObjectMethodV JNI call on ARMv7 Android at Assembler level. Can anyone advice how is va_list implemented on low level in ARMv7 Android?
2
votes
1answer
46 views

How to migrate IDA/HexRays database to the new version of the same application?

I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this? It seems that I need to compare ...
2
votes
4answers
132 views

Understanding RE output of a simple C++ program

I am trying to learn RE and I decided to explore this field by reverse engineering a simple C++ program, which I post here: SIMPLE C++ PROGRAM #include <iostream> int main() { int value; ...
0
votes
1answer
26 views

radare2 memory changing in debug mode

I have tiny program: 0x08048080 66a1a0900408 mov ax, word loc.name 0x08048086 66bbafbe mov bx, 0xbeaf 0x0804808a 66891da09004. mov word loc.name,...
1
vote
1answer
38 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
1
vote
2answers
48 views

How to find sequence of numbers from 0-9 in a binary file?

I'd like to find a sequence of values in a 32MB data stream, where the values are all between 0x00 and 0x09 and there are about 20-40 of them in a row. Maybe this can be done with Hex Workshop, but i ...
0
votes
1answer
63 views

Is there a way to reverse engineer this small tool “website2apk” and design my own? [closed]

I recently came across this tool and was amazed by its size and how it can build release-apk, without even bothering about Android development environment set up on the machine, neither Cordova nor ...
0
votes
1answer
60 views

Difference between 32 bit and 64 bit dissasemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit dissasembler is that the produced assembler-code of a 32 bit dissasembler is only using 32 bit assemby ...
2
votes
0answers
44 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
-1
votes
0answers
33 views

reverse engineering how C# application reads/parses binary data file and function algorithms [closed]

Without going into great detail on the exact application, I am working with a free, closed source C# (I think) application that has been relatively neglected by the Silicon Valley company that "...
1
vote
0answers
32 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
1
vote
2answers
67 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
1
vote
0answers
60 views

removing bios wireless white listing

I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps: booted with kernel parameter iomem=relaxed used pawn to dump BIOS ...
1
vote
1answer
71 views

Lack of arguments before a CALL instruction

I'm reversing an open-source windows application written in C++. I found in the disassembler the desired function that I'm trying to understand its behavior. In the code this function is defined as ...
0
votes
0answers
79 views

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file but maybe i am not ...
0
votes
1answer
56 views

Difficulty obtaining malware traffic

I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most ...
1
vote
1answer
43 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
0
votes
0answers
14 views

Issues with Symbols when running windbg on windows xp sp3

I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
1
vote
0answers
39 views

How to add symbols from open source lib to Ghidra?

I have a binary which I can tell is using rapidjson (open source C++ library) (header only/not dynamically linked). How can I load debug symbols from that? It would help to see the types, function ...
0
votes
0answers
21 views

Generate pseudo code not available for some binaries in IDA Pro

I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
0
votes
0answers
46 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
1answer
69 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
0
votes
0answers
48 views

Why x64dbg doesn’t list GetDlgItemTextA

When I was working on the same application, I realized that x64dbg didn't catch the GetDlgItemTextA Function while Ollydbg did when I placed a breakpoint on GetDlgItemTextA; Actually x64dbg doesn't ...
1
vote
1answer
49 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
0
votes
0answers
15 views

Ghidra function pointers to another file in project

Given a function pointer which is obtained dynamically using dlsym, how can I tell Ghidra that that pointer points to a function in another .so that I have open in same project for which I have ...
0
votes
1answer
48 views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. I am pretty new to this but I already did some reasearch work and I think I am not that far away anymore ...
0
votes
0answers
19 views

Find with IDA where an executable checks for devices plugged into computer

The executable is a firmware updater for a specific device. I want to find where exactly does the executable checks for the devices plugged into the computer, before updating the firmware of the ...

15 30 50 per page