All Questions
9,424
questions
1
vote
1
answer
37
views
Derive logic for 2 "check bytes" for a USB fingerprint reader
I have been working on reverse engineering and building a Linux driver for a fingerprint reader and have most of it sorted out, but one thing which continues to elude me is that there seems to be 2 ...
0
votes
0
answers
95
views
Reverse engineering a game server
It was announced recently that the UGC servers for Mirror's Edge Catalyst servers are going to shut down on December 8th, 2023 for all platforms. I want to reverse engineer the game server and build a ...
- 11
1
vote
0
answers
31
views
Bresser Water Leakage sensor checksum algorithm
I am trying to decode the Bresser Water Leakage sensor, the current state of work can be found in https://github.com/matthias-bs/rtl_433/blob/master/src/devices/bresser_leakage.c
I have also created ...
- 11
0
votes
0
answers
42
views
decrypt pppoe password of huawei ONT HG8145V5 ROUTER [duplicate]
Hi my ISP is not providing me the PPPOE password but i need them urgently in the confrigation file the password is encrypted Password="$2A;L6(Lcj/Y"YG(-gG]@3Z!QHYZ-kQ[AyTQ}<zrK$" ...
- 1
2
votes
1
answer
97
views
Problems with the display of constants in IDA Pro pseudocode
There is an elf x64 file, the pseudocode of IDA Pro 7.6 shows that a constant is 0xFFFFFFFD, but in fact it is "3" in the source code, how can I change it to show "3" in the ...
- 411
0
votes
0
answers
53
views
How to make a Signature of a Global Variable in Ghidra?
currently im trying to rebuild a function.
I am using makesig.py to create function signatures which I am using for rebuilding. It works fine.
Now im trying to make a signature of a global variable:
...
- 1
1
vote
1
answer
74
views
How to make IDA stop showing a struct as an array
Sometimes when I am figuring out a struct in IDA, there will be a really big offset and IDA will decide the struct is an array.
Consider this from ALPC:
if ( (_Message[1].u1.Length & 0x200) != 0 ...
- 1,236
1
vote
0
answers
67
views
Inject a MessageBox to the PE file
I'd like to patch some Windows PE file to show just simple MessageBox. Taking into account that the PE in question doesn't import the MessageBoxA function if I'm right that all i need to do is to add ...
- 115
0
votes
0
answers
39
views
How to change playing music behavior in a game from playing music through cd-player to playing music through mp3 files?
I have an old game from the 2000s, and as we know the old games were playing the background music through the CD which means the music files were tracks in the game CD instead of MP3 files as usual ...
- 269
0
votes
0
answers
55
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 3
0
votes
0
answers
33
views
how can i rip zuma's revenge sprites from the nintendo ds rom?
opening the bin file as a tile in tinke gives me the following:
there are just random pixels that don't contain any useful sprites
and it's the same if i open the file in gimp
my directory for the ...
0
votes
0
answers
23
views
missing caller function in call stack
I'm trying to intercept and locate tcp packets in memory through debugging of windows 10. Suppose I set a break point at TcpReceive, the call stack looks like this
kd> kc
# Call Site
tcpip!...
- 301
0
votes
0
answers
35
views
NTFS files with 0 size, filestamp 01/01/1970 and "?" at the beginning of file name not deletable
I tried to backup millions of files from ext4 to an external NTFS drive. It took ages and at the end gave up, the external drive stalled. After a reboot and successful ntfsfix command I wanted to ...
- 21
0
votes
2
answers
113
views
I don't understand this hexeditor output
I'm trying extract .wav files from a datafile, and each file has some metadata at the end of it.
It contains a date, '1996-05-16' as shown here:
Most of these dates for the files are correct, but ...
- 123
0
votes
1
answer
85
views
Create exe that jumps directly into main()-function from C
I am using x64dbg to explore image files on Windows. After the computer finishes prowling ntdll.dll it jumps to OptionalHeader.AddressOfEntryPoint.
But this is not my main()-function.
What is this ...
- 3
9
votes
1
answer
607
views
McDonald's receipt codes
Receipts from McDonald's in the UK include a code that allows you to complete an online survey as shown in the attached image (in the green box):
After gathering and comparing several receipts I have ...
- 213
1
vote
0
answers
45
views
Can't find the error message in x32dbg
Am trying to reverse an activation program using the error message in reference string
but searching for the string is not successful "all modules - string reference"
tried to pause after ...
1
vote
1
answer
52
views
Unsure how LZSS compression is assigning dictionary references
I am having trouble understanding how this LZSS compression assigns dictionary match references. This particular LZSS compression algorithm has a dictionary space of 4096 bytes that are assigned 0 to ...
0
votes
0
answers
32
views
Can I limit Ghidra's analysis to a particular Program Trees subfolder (block)?
Is there a way to limit Ghidra's analysis to a particular identified subfolder in the Program Trees view?
I'm very new to Ghidra and trying to use it to investigate a large library. I've attempted to ...
0
votes
1
answer
50
views
How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?
Is there an API which lets me programmatically:
set the default string type (Setup) and
rebuild the string list (Rebuild)
???
- 10.9k
1
vote
1
answer
117
views
possible to modify apk to bypass api request/response?
I have an apk for an app that contacts a web API that no longer exists. I do not have the source code. The app will not work normally without getting a response from the API.
Something like this:
...
- 131
1
vote
0
answers
66
views
What file format could this password safe file be in?
I found a file named passwords.passsafe in an old backup of mine, with a timestamp from July 2000. I'm not 100% sure I remember the password. I have unsuccessfully tried to decrypt it using Password ...
jl6
1
vote
0
answers
107
views
Read value from frida hooked native method Jlong parameter
I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
- 299
0
votes
0
answers
50
views
embedded Linux, UART & JTAG disabled, how to access system?
So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
- 1
0
votes
1
answer
59
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
1
vote
0
answers
47
views
Log functions called in IDA Pro?
When I run an exe in IDA how could I log which functions were called into a text file?
log.txt:
call func1
call func2
call func1
call func1
Not worried about indirect calls.
This is for differential ...
- 11
1
vote
1
answer
92
views
Why I can't decompile this ARM function?
I have an ARM (thumb) function from Nokia's firmware:
ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p
ROM:10A5409C
ROM:10A5409C var_18 = -0x18
ROM:...
- 249
0
votes
0
answers
32
views
How can I make a quick tracer for a PE file?
INTRODUCTION:
I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
- 11
1
vote
2
answers
89
views
How can I jump to the start/end of a function in x64dbg?
I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this ...
- 103
0
votes
0
answers
89
views
What obfuscator do this?
So, first if i try to use DnSpy all the methods are empty and some of them returns decompiler exceptions like
System.ArgumentOutOfRangeException: Non-negative number required. (Parameter 'length')
...
0
votes
0
answers
81
views
i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain
I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
0
votes
0
answers
37
views
Firmware not attached to WinDBG while debugging Windows boot process
I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short ...
- 11
2
votes
1
answer
100
views
Decode a Windows CE nand dump
I am trying to decode and extract filesystem of NAND dump from broken device. Dump should't contain OOB. I tried to use eimgfs, but it didn't give any result.
Any suggestions please, what am I doing ...
- 21
0
votes
0
answers
72
views
How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. Compression is RLE
The game is from 1988 ...
0
votes
0
answers
74
views
read params of int variable in ida?
I have located a known int variable that belongs to a tls library, the variable has parameters I need to look at to find the name of another variable I need. Is it possible to read the parameters?
- 1
2
votes
1
answer
155
views
Help reverse engineering a CRC
Evening all
Been trying to reverse-engineer the CRC for this data, and no clue what CRC is being used. What we think is the first 6 bytes are the data, the 7th is a sequence number, and the 8th the ...
- 21
0
votes
0
answers
68
views
How does the Easy Victory cheat get data from another app in real time?
Easy Victory was developed in Java for Android
I was very curious about how Easy Victory takes data from the game's balls and billiard cue force/velocity to calculate trajectories
This is not a mod ...
0
votes
1
answer
55
views
Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm
Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
0
votes
1
answer
54
views
windbg command to search all functions that take in certain arguments
I want to use the x command to search for functions that take _NET_BUFFER_LIST as an argument(maybe they will take more than one argument). Its symbol is ndis!_NET_BUFFER_LIST.
The command I use
0:000&...
- 301
0
votes
0
answers
52
views
How to inject (a lot of) code into a running program?
I've seen a number of tutorials on changing several binary digits of an executable, like changing assembly je to jn. But what I want to add new functionalities.
#include <iostream>
#include <...
- 133
0
votes
0
answers
157
views
How to get global variables with objdump from ELF files
I have compiled this program with gcc
#include <stdio.h>
const char* message = "Outside defined";
int a = 1337;
int b = 10;
int c = 9;
int d = 8;
int e = 7;
int main () {return 0;}
...
- 115
0
votes
1
answer
67
views
idat.exe -S, path with spaces
I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so
But I get an error. Among the logs is present the error:
home\mypath: ...
- 1
0
votes
1
answer
93
views
Can I insert a variable right before the stack canary
Can i insert a variable in c source code
That will be right before the stack canary, and after all local variables.
Like I want to try to implement my own stack canary in source code, is it possible?
...
- 149
0
votes
1
answer
30
views
idat.exe -S -A close without error
I have developed a idapython script and I run it using the following command:
idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so
In myscript.py I appended the exit(0) in order to ...
- 1
0
votes
1
answer
76
views
split function argument from IDA's hints
Suppose I have a function, I know that the first 4 arguments come with fixed registers.
_BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5)
For the fifth one, if I ...
- 301
1
vote
1
answer
133
views
How to quickly mark functions library in IDA Pro?
I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
- 33
1
vote
1
answer
65
views
Removing Ghidra auto-generated labels and create function. Overlapping namespace error
I am attempting to write a script to parse a function table containing structs that look like this:
struct func_table_entry {
void (* func)(void *);
byte unknown1;
byte unknown2;
byte ...
- 11
0
votes
0
answers
22
views
Windows Library description number
Windows Libraries that engage in Library Hijacking, typically have a number in their library description field. What is this field? How does Windows Process it and is there a mapping of int32-like ...
- 1
1
vote
0
answers
54
views
Wargames RET2 Systems Shellcoding - Trouble using ```jmp``` instruction to connect parts of shellcode
I am doing the RET2 Systems Binary Exploitation course Wargames (https://wargames.ret2.systems/) and am working on the shellcoding chapter. I am learning about how to use jmp assembly instructions to ...
- 111
0
votes
1
answer
102
views
How learn which functions are called in .so library at Android?
I want to learn how listen certain .so files. I mean what is the way to know which fuctions are called which body of code executed in shared library at Android? I just wanted mofify stock camera on my ...
