All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Encoded/signed body of http request, how to decode?

Captured the following message in fiddler (acting as a proxy for android) when an app was sending/receiving data from a local device: POST http://192.168.1.68:53000/companion?cid=D96D130B-E82C-4AEE-...
0
votes
0answers
21 views

How can I find the AES encryption key in a Godot 2 game .exe?

I am trying to reverse engineer a game made with Godot2 to learn how to reverse engineer a game and also to learn how it was made from the scripts I extracted the files from the data.pck but the ...
-2
votes
1answer
57 views

can anyone translate this code to C for me?

li $t6, 0 L1: bge $t6, $t0, quit add $s1, $s1, $t0 addi $t6, $t6, 1 j L1 quit: li $t6, 0 L1A: bge $t6, $s1, quit1A add $s5, $s5, $s1 addi $t6,$t6, 1 j L1A quit1A: li $...
0
votes
0answers
17 views

How to break encrypted section of a binary in MacOs? Extracting useful information

How could I extract and decode mcrypted section of a binary file? I figured I could use binwalk to find out what the binary contains. My attention was caught especially by the encrypted section. How ...
3
votes
1answer
60 views

How do I permanently change the disassembly syntax in Radare2?

As the title says, I am trying to change the default disassembly syntax in Radare2 from Intel to AT&T. Looking up documentation, I found the following. [0x00405e1c]> e asm.syntax=att However, ...
2
votes
0answers
23 views

ghidra-python: create struct with big endian field

Using ghidra's python scripting engine, I'd like to create a struct which contains a big endian, unsigned integer. This field is always big endian, no matter what the endainess of the binary CPU is. ...
0
votes
0answers
66 views

Can you decrypt data that is encrypted by xoring different bytes of the buffer together and updating the bytes in the buffer afterwards?

I am reversing a binary and have encountered an encryption routine that uses xor. Basically it takes a byte in the buffer and xors it with the bytes next to it. It then updates that byte and ...
1
vote
0answers
18 views

How to modify JS with mitmproxy?

I am trying to reverse engineer a heavily obfuscated web application, and I would like to modify the JS to add logging. So far, I've set up mitmproxy, but I can't figure out what the best way to edit ...
1
vote
0answers
33 views

Decrypting some possibly XXTEA encrypted lua/game files

I am trying to extract assets from a Chinese game, I downloaded the apk file and unzipped it. I looked through the files and they are encrypted in some ways, the PNGs and LUAs are unviewable. The ...
0
votes
1answer
29 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
0
votes
0answers
23 views

Need suggestions on how to make my own pointer search tool?

Essentially it will be searching for 64 bit addresses and comparing dmps to output main+offsets, etc. Essentially I need it to allow only + offsets from main but allow - and + offsets after that. I've ...
0
votes
0answers
12 views

macoS malware samples (latest)?

I am looking for analyzing macos Malware samples . Anyone aware of public links were macoS malware samples (latest) can be downloaded?
0
votes
0answers
14 views

Exporting/Importing all function info from one ghidra program to another

I'm looking for a way to export all infos about a function (Call signature including custom storage, local symbols, etc) in a ghidra program and import them into another ghidra program, but at a ...
0
votes
1answer
37 views

Seeking for explanation about “ in_FS_OFFSET ” and “ __stack_chk_fail() ”

This is the part of the picoCTF 2019 problem "Investigative Reversing 0". I've encountered the following code when using Ghidra: if (lVar1 != *(long *)(in_FS_OFFSET + 0x28)) { /*...
2
votes
1answer
28 views

What code gets executed in an ELF binary when Java loadLibrary() is called

I’ve been working on reverse engineering this android x86 ELF binary. According to my research when loadLibrary() is called the function JNI_onLoad is supposed to be executed however this binary doesn’...
0
votes
1answer
82 views

How to decompile obfuscated Python code?

I have an executable file, which I am trying to decompile. I have already deduced that it was originally programmed in Python. I know that it was obfuscated with PyArmor and possibly compiled with ...
0
votes
1answer
42 views

Dumping the GOT with gdb at run time

I want to see how the plt stubs are being resolved at run time when lazy linking is used and how the GOT is changed along the way. How can I dump the GOT with gdb?
1
vote
0answers
33 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
0
votes
0answers
24 views

About x64dbg find command + Help to unpack a program

The find command in x64dbg(x86), (found here: https://help.x64dbg.com/en/latest/commands/searching/find.html) doesn't return anything. For example: findall 0x00524180, "E8 ????????" returns 50 ...
0
votes
2answers
49 views

GDB hangs when I try to run and debug a binary

When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line: jericho-laptop:exploit.education jericho$ gdb a.out GNU gdb (GDB) 9.1 ... Reading symbols from a.out... (No ...
1
vote
0answers
30 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
0
votes
1answer
43 views

Conditional to check bytes against user input [ELF 32-bit]

I'm trying to understand the following snippet code from a CTF binary. It is part of an ELF 32-bit and I decompiled it with Ghidra. undefined4 check_serial(char *code) { size_t sVar1; undefined4 ...
0
votes
2answers
47 views

IDA Freeware 7.0 disassemble ARM .so file

I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error: The processor type 'arm' is not included in the installed version of IDA. IDA Version: Freeware ...
-2
votes
1answer
52 views

Hash from pseudocode

What is the hash? Generated from ida pro int __fastcall hash(_BYTE *a1) { _BYTE *v1; // r4@1 int v2; // r5@1 int v3; // r6@1 v1 = a1; v2 = 0; v3 = 1; while ( *v1 ) { v3 = (*v1 + ...
0
votes
0answers
28 views

Extra Allocated Space in Stack and Wrong placement of Local Variable

I was recently reading reverse engineering for beginners by Yurichev where I happened to come across an example x64 MSVC and x64 GCC code. In this I'm unable to understand why there is a shadow space ...
0
votes
2answers
36 views

signed and unsigned integers as bits in memory

I am looking into making a memory scanner for values an while doing some research I came across this the piece of information that unsigned integers allocate all 8 bits for the number while signed ...
0
votes
1answer
33 views

Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?

I've been long fascinated with dnSpy and how easily it can reverse engineer .NET apps into a readable C#. So I was wondering if there's a similar tool to RE Windows 10 UWP apps? For instance, I tried ...
0
votes
0answers
23 views

Is there a way to identify compression algorithm used in exe file?

I'm trying to find a compression method used in executable file. I tried decompiling it with IDA Pro found a pseudocode of decompression but couldn't compile and use it in my program. Here's ...
2
votes
3answers
86 views

What is the difference between MOV and LEA in example?

Looking at an assembly code snippet I see: lea rax, [rbp-0x50] Which tells me that the rax register now points to whatever value is in rbp-hex(50). Question. Would I achieve the same result doing ...
0
votes
1answer
35 views

Debugging UEFI with real hardware?

New to this so here we go. I want to reverse engineer a x86-64 desktop UEFI to add hardware support. Since I have the actual hardware available, are there debug interfaces that run via actual ...
-2
votes
0answers
23 views

How to find the resouces in smali code corresponding to resource ID?

I know that the resource id of the application starts with 0x7f, but I found a field like 0x104000e in smali. How do I find the resource name corresponding to 0x104000e, I cannot find the resource ...
0
votes
2answers
56 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
1
vote
0answers
29 views

JEB Decompiler - Signature recognition engine

I've been playing around with the JEB decompiler and Android reverse engineering suite. One interesting feature they have is deobfuscation by library code matching in which 3rd party libraries out ...
0
votes
0answers
22 views

Reading data from external app intent data

I'm trying to acquire a token from an android app(apk), and I have root on the device. The token is stored in an intent, can I acquire it somehow? Btw, the intent's activity in AndroidManifest.xml has ...
-1
votes
0answers
37 views

Power & Revolution help [closed]

Hi guys I try to translate Power & Revolution to Turkish but when, I try to open the files with Notepad++ and Hex Editors they look like encrypted so I cannot read what writes inside.What should I ...
2
votes
1answer
34 views

Why base address of GDT(global descriptor table) differ in intel x64 processor?

I have created a simple linux kernel module to get the base address of GDT table: #include <linux/init.h> #include <linux/module.h> #include <linux/const.h> #include <linux/errno....
1
vote
0answers
26 views

Add indirect branch target reference manually (xref, crossreference) in Cutter (radare2)?

How can I create a reference for an indirect branch instruction blx r0 so that the call to the address stored in r0 shows up in the graph? I've tried flagging the target (function), but that does ...
0
votes
0answers
26 views

Immunity Debugger blank instruction window

I installed Immunity Debugger in my Windows XP virtual machine. When the process crashes, the view on the instructions becomes blank. When the registers view becomes blank, I use View - CPU and it ...
0
votes
0answers
51 views

Key Algorithm Reverse

I am trying to reverse a Seed/Key algorithm. i have some sample and knowledge about it, for example i know this algorithm work with only "xor" and "shift" operations. some sample shown in below: ...
0
votes
1answer
53 views

Can “missing section headers” ELF files still be executed/dangerous?

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info. Also, when using the Python elftools library to parse them, exceptions will be thrown....
0
votes
0answers
23 views

Connect and extract live raw data from bluetooth devices

I recently bought a bunch of bluetooth devices which includes fitness bands, thermometers, room temp. But I've seen that most of them don't appear in the mobile's discoverable list but connects ...
-2
votes
1answer
36 views

what type of cable need to connect?

what type of cable need to connect to CDMA 1X Model:WF800p+ ZTE https://imgur.com/a/WR7Eo7R to be able to connect to serial console of https://imgur.com/a/nZWXzmv
1
vote
1answer
122 views

GCC is not recognizing symbol table in my hand-made ELF file

For learning purposes I've created (using a hex editor and some macros) the following ELF file: hello.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped xxd hello.o: 00000000: ...
0
votes
1answer
80 views

Seed/Key Constant Value

I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm. i can give some sample from each ...
0
votes
0answers
36 views

How can I have a breakpoint once a value changes in DnSpy?

I am trying to track a certain value in a game to analyze the cause of a crash (basically, it goes to null at one point and I would like to know what exactly puts that to null as it causes issues ...
0
votes
0answers
15 views

LockDebugStartStop unused? [closed]

Being new to x64dbg, I used GREP and found only these references to LockDebugStartStop -- C:\Users\paul-lap\Documents\x64dbg\src\dbg\commands\cmd-debug-control.cpp In cbDebugInit 00059: ...
1
vote
1answer
46 views

Convert .cpu / .opc to sleigh

Is there a tool to automatically convert binutils cpu definitions (.cpu / .opc files) to sleigh for use in Ghidra? ... or do I need to hand craft a cpu definition for Synopsys DesignWare ARC 625D?
2
votes
1answer
57 views

Help understanding MOVSXD

I've tried reading the documentation but the functionality of this instruction is still cloudy to me. For an example, I would like to know what is stored in RDX after these instructions: mov edx, ...
1
vote
2answers
38 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
0
votes
1answer
33 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...

15 30 50 per page
1 2 3 4 5 134