All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
22 views

Need help with patching .plt function

so i want to patch .plt function but my freind told me i should use xref to find the real caller ! after i find it and patch it ! will the .plt function execute ? the function start with PUSH ...
0
votes
0answers
50 views

Ghidra - search for library usage?

Using Ghidra: if library A imports library B, is there a way to search for all function calls from A into B? And more specifically: if B exports function foo, how can I find where that specific ...
1
vote
0answers
30 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
0
votes
0answers
36 views

dnSpy - Decompiler generated variables can't be evaluated

I write a code in dnSpy and after running , the dnSpy give me errors. My code : ProductInfo pi = new ProductInfo(); pi.name = "Jack"; pi.isactive = true; pi.license = "123"; ...
0
votes
0answers
37 views

Need help logging string in smali

I'm trying to log p1 string to logcat. This is my function. new-instance v4, Ljava/lang/StringBuilder; invoke-direct {v4}, Ljava/lang/StringBuilder;-><init>()V invoke-virtual {v4, v3}, ...
0
votes
1answer
87 views

Running ELF file built for ARM arhitecture

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
0
votes
1answer
70 views

Stuck in finding the algorithm of a save game file CRC/checksum

A sample message-CRC pair looks like this: 00000005 00000000 12121212 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 2F8376FE ...
0
votes
1answer
116 views

Extract text data from a encrypted .DAT file of a game

I want to read a text .DAT file, but it's "encrypted". The file is from the a smartphone game. There are several .dat files stored on the smartphone, I would like to decode them to know the ...
0
votes
1answer
64 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
0
votes
1answer
121 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
0
votes
1answer
46 views

IDA API: Writing a plugin - How can I ensure that analysis has completed?

I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish. get_auto_state auto_wait auto_is_ok Looking at the API if ...
0
votes
1answer
64 views

Problem with analyzing malware

We have a malware that blocks all analytics software in real time. This software has blacklisted a large list of software that performs analysis (x64dbg, ida, serialport monitor, etc.) This software ...
0
votes
0answers
69 views

dnSpy - change software value during run

Im working on old software written in C# .NET for increase skills in dnSpy. im new in dnSpy. When I step-in dnSpy, the program get license information from another dll file. and the dll class are only ...
0
votes
2answers
51 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
0answers
21 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
0
votes
1answer
38 views

Can you get the error-correction level of a QR code?

You can get the version number of a QR (1-40) by checking the dimensions of the QR, but is there a way to get the error-correction level that was used to generate the QR code? Trying to reverse ...
1
vote
0answers
54 views

I have a dos file/database that i need to extract into MS Excel or My Sql

I have a dos file/database(decades old) that I need to extract into MS Excel or My SQL. I am using a MacBook. The file appears to have no extension. The file type I can see when I do "get info&...
2
votes
1answer
63 views

What C++ construct could emit such Watcom C++ 10.5 assembler listing?

Based on the assembler listings, a C++ object is locally allocated on the stack without constructing the object in the caller routine and the callee takes the address to the allocated stack space and ...
0
votes
2answers
83 views

How to protect a PE file?

What is the best way to protect a PE file (coded in c++) to make it a little hard for reversing, i mean using something like a Packer, but in a legit way, because most of packers are detected by ...
0
votes
1answer
18 views

How to convert string to a variable in IDA

I have the following string "CreatePipe" and I want to convert it to a variable so I can use x to find all its references: How can I do it? I am not sure what to choose here:
0
votes
1answer
84 views

IDA PRO decompiler expression last question (pseudocode)

memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19); ..... shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory; ..... shellcode(&hkernel32, 0) If ...
0
votes
1answer
29 views

Undo step with IdaPython?

With Ida I can press Control+Z to undo the last action Can I do that with IdaPython?
0
votes
0answers
61 views

IDAPython: error executing init.py:

When I open Ida Pro 7.3 I see an error message IDAPython: error executing init.py: nothing to repeat Refer to the message window to see the full error log. How can I understand what is the problem? ...
0
votes
0answers
28 views

Get first and last address of binary with IdaPython

How can I get the first and last address of binary with IdaPython?
0
votes
0answers
15 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
0
votes
1answer
43 views

Identify unknown Atmel chip

wondering if folks can help identify this chip. It looks like ATMLH017 2FCM CN ©2017AB4 Googling all manner of permutations on these numbers has not been helpful. The chip appears next to an ...
0
votes
1answer
71 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
0
votes
0answers
38 views

How do I view registers at a specific point of a binary's execution?

I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through ...
0
votes
2answers
60 views

How to know which hashing algorithm is being used?

I’ve been reading about digital signatures getting ready for some certification, and there is one question regarding this topic, that I don’t really understand. Let’s say that I receive a plaintext ...
0
votes
0answers
29 views

Decoding an .iwa file

I am looking to view the contents of an .iwa file in my Apple Numbers project. It seems like the format is a protobuf wrapped in snappy. I was wondering if there was a relatively simple/crude way to ...
0
votes
0answers
20 views

View Apple Numbers file format

I have a very tiny Apply Numbers file: And I have saved it here: https://drive.google.com/file/d/1nyGJan-D9Jn0mddjAZQikFmUHi5ceIya/view?usp=sharing. Is there a way in which I can view the file in a ...
0
votes
0answers
16 views

Is there any way to find whether a software uses hasp api or hasp envelope?

Is there any method to know whether a software uses hasp envelope or api?
0
votes
1answer
44 views

How does this function take the argument if its not pushed into the stack?

I dont understand how does the function take the argument without pushing push ebp mov ebp, esp and esp, 0FFFFFFF0h sub esp, 20h mov [esp+20h+var_20], offset aEnterX ; "Enter X:" call _puts
0
votes
2answers
133 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
0
votes
0answers
36 views

How can I identify JTAG in this case and utilize it?

I'm developer and I somehow tried today to reverse engineer and take apart a hardware, just after learning that some devices have hardware debugging. First thing to try to know in my understanding of ...
0
votes
1answer
166 views

What does this function do?

I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
0
votes
0answers
35 views

How to extract SSL pre-master key from Mac app?

I would like to analyse the traffic generated by one of the apps that I use. This .app contains an OpenSSL 1.1.0 dylib in its Frameworks folder. I would like to extract the pre-master keys using the ...
0
votes
0answers
36 views

is it possible to get code out of chipset through reverse engineering?

for example, encryption/decryption mechanism was inbuilt in a chip, to get the code that performs this mechanisms, is there some ways you can get this code through reverse engineering? what tools and ...
1
vote
2answers
143 views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
1
vote
0answers
60 views

How to change how the calculated value is shown for registers in Ghidra

I'm currently working on reversing some Sparc code in Ghidra, and calculated register values are shown incorrectly. This is how the line looks in the listing: add o3, o0=>DAT_00007d88, o0 and I ...
0
votes
0answers
16 views

Does anyone have any information about the file format of a .jdb2 (Jeb Decompiler's Project file) or how to fix one that is corrupted?

I have a .jdb2 JebDecompiler project file which is corrupted and JebDecompiler can not open it. Any information about .jdb2 file format could be useful for me in order to read data from it and even ...
0
votes
0answers
40 views

Radare2 give same assembly code with two different file.apk

I want to use the reverse engineering of radare2 (run on Kali Linux 2020) in order to get the assembly code of file.apk. But I do not know why two different file.apk give the same code. I checked many ...
0
votes
0answers
66 views

Extract smartwatch firmware bin file

I'm trying to extract files from a bin file that's the firmware of a smartwatch. I tried using binwalk -Mre firmware.bin but got no files, this is the result: How should I extract/modify this bin ...
0
votes
0answers
22 views

how to analyze USB packet data on a device that is not a PC

So basically, in order to "jailbreak" a PlayStation Vita console, on firmware versions 3.61 and above, you have to run h-encore2 which is basically just a regular signed executable primarily ...
0
votes
0answers
62 views

Convert Arm64 Assembly Trace To C

I have an ARM64 instruction trace captured from a process I'm interested in. I'm wondering if there are any open source utilities for converting the textual assembly into a C-like format. I've already ...
0
votes
2answers
58 views

Ollydbg - bytes in memory different than on disk

I have been analyzing an application and I'm getting confused about something. When I open an executable with OllyDbg, it shows 0xAA byte. The same executable opened with CFF explorer at the same ...
4
votes
1answer
99 views

Install Ghidra plugin without GUI

I have a plugin that I want to install for Ghidra. The current way to install the plugin is to go to the file->Install Extension in the project window, and add my plugin there. However, in my ...
1
vote
1answer
146 views

IDA Pro shows an array where two varaibles should be

I'm working in a Delphi binary and found a little issue while generating pseudocode. This is the output (after some clean up) that IDA gives me: Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
0
votes
1answer
109 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
0
votes
2answers
55 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...

15 30 50 per page