All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
91 views

MIPS assembly to C code

I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
0
votes
0answers
22 views

I try to get the static address of a value, but there's no offset in the instruction?

I follow the traditional steps to get the static address of a value, but I encountered some difficulties in obtaining the static address. After finding a dynamic version of the target value, I have ...
0
votes
0answers
36 views

Read and write to register with Frida

I have an instruction that looks like this in Ghidra: 100168ff0 e9 13 00 32 orr w9,wzr,#0x1f Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
0
votes
2answers
70 views

What does the cs register do here?

I've come across this sequence of bytes: 2e 88 38. Hopper disassembles this as: mov byte [cs:rax], bh This online disassembler gives slightly different output: mov BYTE PTR cs:[rax],bh Either ...
1
vote
0answers
45 views

Unknown binary format (.scp) - No Header

I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
1
vote
0answers
50 views

WRT54GL firmware extraction via JTAG with OpenOCD and Raspberry Pi as interface. Can not dump because the device is not halted

Good day! Sorry to come up with something very old. Since I am currently teaching myself hardware hacking, I wanted to use my old router for this. I soldered pins to the JTAG interface and connected ...
0
votes
0answers
29 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...
3
votes
2answers
98 views

The compiler adds a function call to user-defined functions. What does the function do? (x64 Windows executable)

Introduction I compiled a simple executable with Visual Studio in x64 Windows. Source code: long test(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j) { printf("%d %d %d&...
1
vote
0answers
18 views

Tapping into Ford SCP BUS

I'm looking to tap into the Ford SCP BUS to display text onto my dashboard on my '01 Jaguar S-Type. This car has a two row screen that displays the odometer, average fuel consumption - amongst other ...
0
votes
0answers
37 views

Linux allocator and heap exploitation

I have some internal questions regarding linux allocator and heap exploitation: Is there a technique/techniques to discover the type of the memory allocator in linux(for example: dlmalloc/ptmalloc/...
0
votes
1answer
35 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
0
votes
1answer
17 views

Issue in opening a file type after unzipping

I downloaded a file from this link https://storage.cloud.google.com/gresearch/smallcnnzoo-dataset/cifar10.tar.xz, and I successfully downloaded the archive file.I unzipped it using 7-Zip. After ...
1
vote
0answers
27 views

How to find references for a string (where it is being called) in Go binary

I have a Go binary and I have this string: When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references: It might be ...
1
vote
1answer
99 views

I'm having trouble understanding this specific notation in Ghidra

I'm reversing a code construct I created to learn Ghidra, and it looks different to what it is in GDB. I was wondering if anyone could clarify what the highlighted LEA instruction means: [I don't know ...
1
vote
2answers
99 views

IDA Pro Reverse offset in struct

I'm reversing a Delphi program and have a part where it says: Result = *(Self - 44); But I want it to say something like: Result = *(Self - offsetof(VMT_ClassDefinition, vmtClassName)); Being ...
0
votes
2answers
47 views

Try to parse all functions with IdaPython

Sometime Ida didn't parse some function into binary , so I search the beginning of function (in Arm it's PUSH {R4-*,LR} and press P -create a function. How can I do it automatically for all undefined ...
2
votes
1answer
45 views

How can I replace bitmaps & pictures that are defined inside a Windows Form? (Win32 Delphi x86)

I understand that this may seem like a really obvious question, but bear with me. I have this compiled game executable written in Borland Delphi 2010, it is based on the Win32 platform and is compiled ...
1
vote
1answer
65 views

Configuring Ghidra to use the Keil 8051 ABI for analysis

I am trying to reverse engineer a raw binary image from an nrf24le1 SoC that (I think) has been compiled with the Keil toolchain. Specifically, I see that C functions in this image usually expect ...
0
votes
0answers
50 views

HTTPS post request not showing up in http debuggers

There is this program I'd like to debug of which I already have the source code. When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
0
votes
1answer
50 views

Set lldb breakpoint relative to ASLR slide

I want to set a breakpoint at an offset within a file. I can do this fine if I launch the app, check where it is loaded with image list testapp and then add the offset of where in the binary I want ...
1
vote
1answer
64 views

Ollydbg - Readfile API

I am learning reverse engineering. (Lenas Reversing for Newbies) Part 2 I'm confused about Readfile API. In part2 , i created blank Keyfile.dat near application. (Without key in it) pBytesRead : ...
2
votes
1answer
66 views

Why module address is different in Cheat Engine than in x32dbg?

Why the module address is different in Cheat Engine than in x32dbg? I'm trying to read this: My c++ attempt: #include "pch.h" #include "Functions.h" #include "offsets.h"...
1
vote
1answer
28 views

Restoring original stack variable in IDA Pro?

I would like to convert an instruction like: lea ecx, [esp+150h+var_13E+2] to: lea ecx, [esp+14h] I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
1
vote
0answers
25 views

How do I get adb to work on a Rockchip RK3288 based android device running Lollipop 5.1.1?

Lollipop 5.1.1 based device. OLD ES File Manager installed. (Yes, the exploitable one). I can copy to/from the device. I tried Kingo Root, Root Genius, Towel root, etc. None of those work. "...
0
votes
0answers
44 views

Inflate zlib Data Stream from Hex File

I am working on a firmware bin file that has been extracted from an EXE file. The Firmware was inserted as an encrypted PKZip resource in the EXE. I was able to fish the EXE password at runtime and ...
1
vote
0answers
33 views

How can I decode this Malicious php code?

I found this backdoor on a client's website. https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file) I have gotten rid of it and realise it's an obfuscated script but ...
2
votes
0answers
25 views

Attempting to understand non-XZ file signatures within PBZX chunks

After my previous question from nearly a year ago directing me to the YAA format to make sense of the chunks that could be decompressed, this time we're dealing with the chunks that made pbzx tell us ...
1
vote
0answers
114 views

Decompiling dll file to extract a function (subroutine)

I have a university project, and my professor gave me a DLL file which I need to extract a subroutine from, and it is not clearly defined as a subroutine. The purpose is to translate the code to C++ ...
0
votes
1answer
58 views

How can I get the correct offset from that instruction?

I have the following instructions: The registers' values in the First instruction are: RAX=0000000033307EE0 RCX=0000000000000000 The registers' values in the Second instruction are: RAX=...
1
vote
1answer
49 views

Changing a label's text on window

I'm using OllyDbg v2 for debugging. Target is a simple executable file with few labels. It has been written in C++ builder. Looks like labels are located dynamically, so I can't get its text using ...
2
votes
1answer
51 views

How should I go about reversing this USB crypto dongle?

I have some kind of authentication token device delivered by a bank (that I do not expect to use for its initially-intended purpose any more). I’d like to learn how it works and whether I can recycle ...
1
vote
0answers
60 views

Decrypting .PNG files from Chinese mobile game

Amateur here. I'm working on decrypting a couple of .PNG files extracted from an .apk of a Chinese One-Punch Man mobile game. They're identified as .PNGs by Windows, but can't be opened by any ...
1
vote
0answers
101 views

Firmware RE (Beginner)

I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website I ...
1
vote
1answer
36 views

Reversing bit rotations

so I have a question regarding the assembly instructions ror and rol: Is it possible to properly reverse them? So assuming I have something like ROR EDX, 0x4 and know the contents of EDX after ...
0
votes
0answers
43 views

Display hex values the Python way in Ghidra

When I have an int value that I want to be displayed as an hex in the disassembly, it's not formatted the same way according to it's an operand or a data : movea.l #0x1a4, A1 but : dw 9500h I'd like ...
1
vote
0answers
26 views

Function Arguments/Name on Radare and IDA

I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code: mov ecx, 11h lea edi, [esp+1208h+StartupInfo] rep stosd lea ...
0
votes
0answers
34 views

Checksum verification of an apk does not the same as my java program

I'm from the sysadmin side of the IT and have not much experience in programing. I have an app that lets me screen share Android apps on my car's display. Sadly there is a whitelist baked into the app,...
2
votes
1answer
151 views

32 bit vs 64 bit IDA Pro

I am confused on the differences between using 64 bit and 32 bit IDA versions on a 32 bit application. If I use 64 bit IDA on the 32 bit application, will it make use of 64 bit or 32 bit architecture?
1
vote
1answer
107 views

How to jump to a new empty memory that related to the program to write another code there?

I have a line of code like that ex:MOV EAX, 100, I want to write a little bigger code instead of that code but I can't, so I want to write a jump instruction ex:jmp 0x123456 that jumps to another ...
2
votes
0answers
68 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
3
votes
1answer
85 views

Sharing variable between scripts

I wrote some Python scripts to help me disassemble one given file (only one), and I'd like to share some variables between differents scripts (or between 2 different executions of the same script). Is ...
1
vote
0answers
28 views

Getting all instances of Local type in Ida

I create a local type in Ida and put in some places this local type. How can I got all the references to dhat Local type?
2
votes
1answer
102 views

Reverse engineering Roland TR-8S kit file format .t8k

I'm trying to figure out the file format that the Roland TR-8S drum machine uses for importing/exporting drum kits. My goal is to replace the sample (PCM) data within a kit. It's a proprietary binary ...
2
votes
2answers
171 views

Is decompilation significantly more limited when performed on handwritten assembly?

I understand C language decompilers are designed to decompile code produced by a C compiler, and that such decompilers have a lot of limitations and sometimes are actually wrong (in the sense that ...
1
vote
0answers
53 views

Understanding the leap of logic in “Secrets of Reverse Engineering”

In Chapter 5 of the book "Secrets of Reverse Engineering" (by Eldad Eilam), the author goes about reversing an undocumented "table" API functions in the NTDLL library. The logic ...
1
vote
2answers
110 views

Using a buffer overflow to call a function

I'm new to reverse engineering C binaries but have been working on an old ctf and thought to ask for explanation of specific assembly commands and how a buffer overflow might force a function to be ...
1
vote
1answer
40 views

what is the difference between pd $s and pdf @@f in Radare2

I've tried searching around on how to disassemble a whole binary. I found that pd $s and pdf @@f are the 2 commands suggested most widely. I could understand the working of the latter, but I don't see ...
2
votes
2answers
97 views

Adding a hook to the end of a function

I have a (so-called) function with multiple entry points but only one ret. I am trying to understand how to add a hook to the function. The main problem I'm facing is the code that is placed right ...
0
votes
0answers
48 views

Decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt?

Can I decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt? I am getting these packets from wireshark. I know that the IV might be at the front of ...
0
votes
0answers
96 views

How can I get a value from a memory address that changes almost every millisecond?

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond. ScreenShot: I did a hardware ...

15 30 50 per page