All Questions

Filter by
Sorted by
Tagged with
2
votes
1answer
53 views

How to know when a subroutine starts when reversing an ARM64 file?

I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
0
votes
0answers
86 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
0
votes
0answers
28 views

Identify unknown MEMS sensor

Could someone give me any clue how to identify this chip? It should be a 9D accelerometer-gyroscope-magnetometer but I'm not sure. The case seems to be LGA-14.
0
votes
0answers
22 views

How to reverse engine JS code whose callstacks are hidden?

I am learning how to reverse engine JS code and got a hard exercise, beyond hidding strings this obfuscated JS tries to hide callstacks by spreading and storing partial computations in a bunch of ...
0
votes
0answers
51 views

I and the enemy shares a fixed address but with a changeable offset, How can I change my value but the enemy not?

I am trying to get a gold value in my game (an old game since the 90s, but it's still working). I finally found the gold value and its static address too, but sometimes that address can't get the ...
-1
votes
0answers
45 views

How to convert Pesudo Code IDA to C++ or C?

I'm very skeptical of this section of the code. I see the argument of function, first of argument is string but in code is _DWORD *this. I very don't understand this. However, two and three is int but ...
1
vote
1answer
66 views

Inserting two digits into binary per Hex - without making EXE corrupt

I dont have much knowledge with assemblers. I beg ur pardon in advance. I need to change an IP address in a win-binary (Net) where the IP its hard-coded. Just changing the IP with an Hex Editor would ...
1
vote
0answers
32 views

ZKM 15 Deobfuscation (Jar file) [closed]

Hello I am looking for someone who can deobfuscate a ZKM 15 obfuscated jar file for me. I am willing to pay money for this. I mostly just need Strings from the jar file. It doesn't need to be perfect. ...
2
votes
2answers
113 views

Ghidra: equivalent to IDA-Pro's “Reset desktop”

I have nearly ruined my Ghidra layout, and was wondering if there is an equivalent to IDA-Pro's Windows->Reset Desktop, which would reset the code browser's layout to its default form. I am aware ...
1
vote
0answers
30 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
0
votes
1answer
32 views

uncompyle6 gives success message but output is not readable

I am trying to use uncompyle6 to decompile a .pyc code. I even tried --verify option. It says # Successfully decompiled file, but the output only contains strings like \xe0\xb3\x0bh\x90. What should I ...
0
votes
0answers
23 views

How to modify a function without disassembling the entire class

If I want to modify a function which has calls to other classes and functions in the application, but I don't want to reverse all of those other classes and leave them as they are, how do I go about ...
0
votes
0answers
21 views

How to add include path in Cutter

Hi I have an program waiting for debug. But the executable is based on another so file, which need to be added into LD_LIBRARY_PATH variable. I have search over the internet but cannot find a way of ...
0
votes
1answer
50 views

string pointer to byte conversion condition

I am trying to understand the following snippet. I understand that the first check would check if it is even if it would be an int, but I don't understand it in this context. Could someone explain to ...
1
vote
1answer
83 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
0
votes
0answers
42 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
1
vote
0answers
21 views

Need help understanding the flow of a python script on github repository

OpenDroneMap is an open source command line toolkit to generate maps, point clouds, 3D models and DEMs from drone, balloon or kite images, here's their github link OpenDroneMap/ODM Was pointed out to ...
1
vote
1answer
28 views

Log input data and resulting hash for CC_MD5 calls in an iOS app with Frida

I am trying to understand the usage of calls to CC_MD5 in an iOS application. From Apple's man page I can see that when it is called it requires 3 arguments: extern unsigned char * CC_MD5(const void *...
1
vote
1answer
37 views

Display open handles in IDA pro, just like xdbg?

I want to know for example that if a ReadFile is happening and the handle number is 100, which file or whatever this handle belongs to? lets assume for whatever reason i cannot trace CreateFiles to ...
1
vote
0answers
56 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
5
votes
1answer
154 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
1
vote
1answer
66 views

Is there any way to watch a block of memory of the current process for change?

I'm looking for a way to get notified when some block of memory of the current process change. To be more specific, I want to track when some fields of a struct change. Let's say I have one instance ...
0
votes
0answers
30 views

Basic Block generated by IDAPython code are different compared to BN generated output file

I have a query regarding different BB count using two different tools. I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
1
vote
1answer
23 views

How to capture control flow pins on emulated serial port?

I am reverse engineering how a CPS software package communicates to a radio device. I have the basics down, and want to trick the software into thinking COM1 is the radio, when in reality I want to ...
1
vote
0answers
23 views

How to move function names, comments, local variable names and structs to a database for a new version of the executable?

I have reversed a number of functions and added definitions for some structs in an Intel x64 PE executable. A program got an update. I moved old executable with the old database into another folder ...
0
votes
1answer
124 views

What is unpack? how to become professional Unpacker?

I asked a lot of questions in this forum about RE and I am a beginner who is very interested in reverse engineering. (i am learning the RE with Lena151) What is unpack? Which tools need to unpack a ...
4
votes
1answer
133 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
0
votes
1answer
42 views

What is imagebase word means used in Lena151 RE tutorial?

In part 3 of lena RE tutorial, i see a word : imagebase Can anyone tell me more about this and better meaning of this word?
1
vote
1answer
46 views

Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll

I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf To do it,I have to get the DLL symbol file. But I can't locate the IWbemServices::...
1
vote
0answers
47 views

How does one go about reverse-engineering obfuscated/minified JavaScript in a browser like you would code in an IDE?

I am trying to figure out how some minified and possible highly-obfuscated JavaScript works. There are thousands of lines spanning multiple JS files. I have had a lot of success debugging it in my ...
0
votes
1answer
51 views

Imports shifting in the dump

dumped the PE using scylla, analysing without issues but when i trying to inspect codes i see what IDA analysed imports incorrect, means i see for example MapViewOfFile which according by pseudo not ...
0
votes
1answer
79 views

Strategies for Deciphering RS-232 Data

I'm working with an old irrigation controller that is connected to a PC via the DB9 serial port. I was able to capture that data (tapped into the appropriate TX wire) on a separate laptop, but now I'm ...
0
votes
0answers
35 views

Extracting files from NAND flash dump

I trying to extract files from nand flash dump (car radio player). Dump is done by desoldering and read with flash programmer.I see that there is a UBI file system, but cannot extract/mount any files. ...
0
votes
1answer
52 views

Adding signatures to Ghidra

I have a couple of questions about the Ghidra I am analyzing a binary file and in the binary it uses a functions from libstdc++. What is the best way to add the signatures of functions from "...
0
votes
1answer
29 views

Paint path in Ida according to gdb log file

In Gdb I put script that print each instruction to gdb.txt file. I want to load this file to Ida to show and print/paint the path that the process has been running. The gdb script is # not strictly ...
1
vote
0answers
27 views

Handle Ioctl call while running with qemu

I am using qemu to emulate a binary like this qemu -strace XXXXX . I saw that the first 2 system calls of this process were TCGETS to stdin and stdout. From man pages Get and set terminal attributes ...
0
votes
0answers
22 views

How to debug an unknown Tricore binary

I want to analyze a binary from a automotive ECU with an Infineon TC1797 Tricore processor. I can load it in Ghidra, and have analyzed and reverse-engineered a bit of code at the starting address. I ...
0
votes
0answers
20 views

Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?

I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary. The ...
1
vote
1answer
49 views

Debug bFLT in qemu-arm-static

I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static . I want to debug that binary dynamically with GDB. I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
0answers
23 views

Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point

Here's the problem: I set a breakpoint in IDA debugger the program stop at the breakpoint deactivated the breakpoint IDA keep receiving SIGTRAP or SIGSEGV ( program stop at breakpoint as expected ) :...
2
votes
0answers
78 views

Can I find usages of this string in my .so file? ARM

My apologies if this question is very basic. I have found this string in my Android application Binary that was built using the flutter framework. This is a 32 bit ARM library. I found the location of ...
1
vote
1answer
23 views

Demangling symbols from green hills rh850 compiled binary

I have a binary compiled in Rh850 using green hills compiler from the looks. Luckily, it still symbols attached ,but I am struggling to read the symbols and it is worth my time to demangle them. Is ...
1
vote
1answer
55 views

How to run a script in x64dbg

In the x64dbg manual is many scripting commands and other things, but nowhere in it is mentioned, how to launch a script. So, my question is: How to launch a script in x64dbg?
1
vote
0answers
25 views

Patches are not applying after saving in X64dbg

I'm new to this and I used X64 debugger for a short while The thing is , I was testing the security for some software (for educational purposes only!) and finally I found a way break into it , but ...
1
vote
1answer
50 views

Ghidra showing pointer being given as size argument of calloc

I'm attempting to figure out the structure of a "God object". I found where it's being initialized, but I've never seen calloc used like this before: god = (God *)calloc(1,(size_t)&...
1
vote
1answer
35 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
0
votes
0answers
87 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
1
vote
1answer
65 views

Why IDA debugger on android doesn't show all threads?

My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file. Here's what I've done: download a x86_64 system image android emulator from android studio install that .apk ...
0
votes
0answers
47 views

Improving Ghidra's Auto-Structure creator

I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
1
vote
2answers
67 views

How to get root access on Linux embedded system?

I've saved from the trash bin an embedded system using an OPOS6UL (http://www.armadeus.org/wiki/index.php?title=OPOS6UL) as Single Board Computer. It was easy to get an UART console, but I cannot log ...

15 30 50 per page