All Questions
9,518
questions
2
votes
0
answers
49
views
Figuring out the algorithm for an NFC reader, which displays values increased by 1.52 times
I have two NFC readers, reader A reads card ID numbers according to the ISO standard and the algorithm is publicly available. Reader B is from a Canon printer. The card numbers read by reader B are 1....
- 21
0
votes
1
answer
60
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
- 49
0
votes
0
answers
199
views
Huawei Router EG8145V5 PPPoE Password Decryption
I want to know my PPPoE password but my IPS refuses to tell me. I went to the setup page and did inspect element and changed the type=password to text and found my password, but it is encrypted form. ...
0
votes
0
answers
65
views
Ghidra - Mach-O failed to load external libraries
I'm trying to follow the steps in the book "The Art of Mac Malware" and disassemble the malicious part (the patch binary) of the EvilQuest malware with Ghidra instead of Hopper or IDA. (...
- 180
1
vote
0
answers
123
views
Ghidra: undefined4 to bytearray
I am trying to reverse a c++ program and make the decompiler represent a byte-array in a single line.
The c++ code contains the following line:
BYTE fileArray[139] = {0x50, 0x51....}
Ghidra ...
0
votes
1
answer
97
views
Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing
Goal:
Trying to reverse encrypter to decrypter that successfully decrypts.
This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
0
votes
1
answer
68
views
IDA python API set function chunk end
I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
1
vote
1
answer
131
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 21
1
vote
0
answers
48
views
Cannot debug native library of Android apk
・I am debugging an apk file.
・The address I want to stop at BreakPoint is in the native library(.so) (no function name).
・The native library has a "JNI_OnLoad" function, so I set BreakPoint.
...
- 11
0
votes
0
answers
47
views
Reverse engineering Microsoft Teams web invisible incoming messages
I'm currently looking to inspect the network traffic in Chrome when I receieve incoming messages in microsoft teams, but i can't point out where or how is Teams getting the messages from.
When I load ...
- 101
0
votes
1
answer
122
views
NameError: name 'ScreenEA' is not defined
Part of Practical malware analysis Lab5, is to run a python script in IDA Pro
I have tried by going to Files-->Script command then I have pasted my python code:
sea = ScreenEA()
for i in range(...
- 1
0
votes
0
answers
86
views
from executable to assembly source code?
let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" .
my question is => can i maintain and organize that "disassembled code" ...
- 23
0
votes
0
answers
33
views
Help reading a rekordbox edb file
My questions is similar to this, albeit slightly different: Help reversing a EDB database file for Pioneers Rekordbox software
The rekordbox 5 library export produces a 'datafile.edb' file with useful ...
- 101
0
votes
2
answers
211
views
Ghidra scripting: get indirect operand address
I tried several hours to find a way to get the operand address which is displayed in the ghidra listing, but without success:
I know at least that the OperandType is "Address".
import ...
- 103
1
vote
1
answer
233
views
Identifying C/C++ Library Functions
I am attempting to reverse-engineer an old DOS executable, which seems to have been compiled around 1992 using Microsoft's C compiler at the time.
When opening the executable in Ghidra no imports are ...
- 165
0
votes
0
answers
25
views
How to locate the code used for encryption of qrcode message in apk file
When I scan a QR code in this app it gives an encrypted message. I want to figure out what method this app used to encrypt their QR codes. I used Dextojar to look at the source code but couldn't ...
0
votes
1
answer
76
views
Bookworm Deluxe wordlist not understood. Any insights?
I am looking at the "wordlist.txt" file for Bookworm Deluxe (an old game by PopCap), and I have not been able to make sense of it. Most of the lines seem to be pieces of words, often with a ...
- 103
0
votes
0
answers
31
views
EBX Relative references are not recognized by ghidra
String references are not recognized by ghidra on PIC .so file
The calls are calculated by a relative offset from the EBX register.
On entry to the function, EBX is set
relative offset is added (for ...
1
vote
0
answers
30
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
0
votes
0
answers
65
views
What to expect from a Reverse Engineering technical test with IDA for a junior position? Experiences?
I'm excited about the prospect of taking a technical Reverse Engineering test for a junior position that I've been trying to secure. The test is expected to last around 3 hours, and I've been informed ...
- 1
1
vote
0
answers
128
views
Trying To Understand DOS Game Assembly Instructions
I am trying to understand assembly language instructions, for a DOS Game.
I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
- 69
1
vote
0
answers
135
views
How to reverse engineer a USB sump pump controller that is not designed to connect to a computer
I have a sump pump monitor / controller that is USB-enabled. The USB port on the side is designed to hook to a WiFi module or a once-promised, now-canceled, never-produced Z-wave module (which is what ...
- 111
0
votes
1
answer
73
views
Assembly for malware analysis
I know we have some architectures for assembly language. But I wanna know this: I need learn x86 assembly ? , or arm assembly ? , or both ? , or others ?..
Please help me , what should I learn?
- 3
0
votes
1
answer
185
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
0
votes
2
answers
97
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
0
votes
3
answers
106
views
how to stop windbg when register value changes
I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value ...
- 313
0
votes
0
answers
53
views
unable to read otml file
I'm trying to open a game file (.otml) that seems to be encrypted. When opening one of the files with notepad++ I get the following text
ENC3ž4®£i{Ñ7 : £i{Ñš²É ‚NR“ÿUªˆ¿+ó6ug¾°¦.ë´7º™ïÐvä@6ÿ¾>ZEò
...
- 1
0
votes
0
answers
43
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
-1
votes
1
answer
143
views
Simple Question About Reversing a Python
So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of
...
0
votes
1
answer
56
views
unable to figure out how a windbg extension work
I'm trying to figure out how the below windbg extension works
!ndiskd.nbl addr -hexcap(or -data)
kd> !ndiskd.nbl ffffce8c96bde070 -hexcap
# NET_BUFFER_LIST ffffce8c96bde070
# NET_BUFFER ...
- 313
1
vote
0
answers
51
views
Process stuck on the entry point
I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11.
The current problem with it is that when running the exe file nothing seems to ...
- 21
0
votes
0
answers
137
views
Extract plain database from a large file based on binwalk results
I want to extract a plain SQL database from a file which is used by a software (CTF). The target is a file with .db extension. The file itself doesn't have a signature and file command doesn't provide ...
- 1
2
votes
2
answers
476
views
UPX Unpacking tool
Firstly, thank you for your answer.
What is the best unpacking tool to use to unpack - UPX 0.89.6 - 1.02 / 1.05 - 1.24 ->[Overlay] could you please provide a link so i can obtain as such.
Thank ...
- 21
0
votes
0
answers
68
views
Tips on how to extract Apple firmware for a Broadcom Wireless chip, using binwalk or a similar tool?
TLDR: I have a dump of my wireless chip's RAM, but am having trouble separating firmware from, possibly the driver itself, from the nvram configuration portion.
So, I'm trying to enhance the ...
-3
votes
1
answer
514
views
Is it possible to decompile ex5? What are some hints in how one would do so?
I am creating an expert advisor. I am wondering how people can decompile the ex5 to mq5 for meta trader. Does anyone have any insight on this?
- 95
0
votes
1
answer
69
views
Tool to analyze .obj files (not COFF) created with /LTCG
This Microsoft article states that:
When building with LTCG, the compiler front end doesn't invoke the
back end. Instead, it emits an OBJ file with IL in it. It bears
repeating: this IL is not the ...
- 1,550
0
votes
0
answers
54
views
Pe file import binding
I'm learning a bit about PE files. The thing I've struggling a bit now it the First Thunk and Original First Thunk fields. To understand the difference between them I've read this post and that ...
- 115
0
votes
1
answer
89
views
ELF - Why does objdump provide a wrong byte value in the .got?
I seriously can't tell if I'm misunderstanding something grossly or if this is a bug in objdump. Newbie alert.
$ objdump -s --start-address=0x3fc0 --stop-address=0x3fc1 test
test: file format ...
1
vote
2
answers
193
views
Adding debug symbols with GDB
In CTFs when I'm given some ELF file, it usually wasn't compiled with the -g flag. Is there a way to to somehow edit the file to make it be as if the ELF file was originally compiled with the -g flag?
...
- 141
0
votes
0
answers
38
views
Unable to identify chip
Unable to identify below chip (should be touch controller)
this is on a wifi 4 channel switch - overall PCB as below
Any help in identifying chip appreciated, need to unload custom firmware to the ...
0
votes
0
answers
76
views
windbg fail to load symbol with UNC store
I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu
kd> .sympath
Symbol search path is: srv*
Expanded Symbol search path is: cache*;...
- 313
1
vote
1
answer
112
views
How to decompress this file
I'm trying to figure out how this old game is (de)compressing files, but I don't have much knowledge about file compression.
I tried running the game from a debug tool to see if I could spot something ...
- 123
1
vote
0
answers
90
views
Where can I find the files from Ghidra symbol tree?
I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
- 83
2
votes
2
answers
209
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
1
vote
2
answers
91
views
how to access the initialized data in windbg through offset from IDA
In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
- 313
0
votes
0
answers
55
views
Disassembling an executable that is packaged with vercel's pkg
I'm trying to reverse engineer a file that is packaged with pkg. I extracted the bytecodes from the application using pkg-unpacker. From my understanding, application has raw js code in binary itself ...
- 11
1
vote
1
answer
177
views
Frida Android how to change value of array passed to method
Let's assume we have a such code snippet:
public class Test {
public void testArrayValue() {
Object[] objects = new Object[1];
fillObject(objects);
Log.d("test", (String)...
- 13
1
vote
1
answer
52
views
What is the specification for a dotnet resource, header and data?
What is the header and data structure of a .NET resource? I would like to find an equivalent type of documentation to the following, but for .NET resources:
https://learn.microsoft.com/en-us/windows/...
- 136
1
vote
1
answer
38
views
Derive logic for 2 "check bytes" for a USB fingerprint reader
I have been working on reverse engineering and building a Linux driver for a fingerprint reader and have most of it sorted out, but one thing which continues to elude me is that there seems to be 2 ...
0
votes
0
answers
147
views
Reverse engineering a game server
It was announced recently that the UGC servers for Mirror's Edge Catalyst servers are going to shut down on December 8th, 2023 for all platforms. I want to reverse engineer the game server and build a ...
- 11