All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
44 views

What does BindImageEx actually do?

Docs. If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My ...
0
votes
2answers
58 views

Figuring out correct user input key from final key + generated buffer

I've recently gotten into reversing crackmes, and I seem to always fail at the ones similar to this. The final key that the program uses for comparison is not the key that should be used as input, ...
1
vote
1answer
66 views

Getting started with RE, with eventually goal being able to make a keygen [closed]

I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
-1
votes
1answer
48 views

cracking SHA256 if you think you know its original value but don't know which is it

I have a hash and what I think is its original value DRMSoftwareRadio-MERLIN-00000218 20030130 Frank Garnier Frank.Garnier@rnw.nl Witte Kruislaan 55 Hilversum 1217AM Netherlands ...
0
votes
0answers
51 views

Reverse engineering complex GUI desktop application

I have an old program written in WinDev which connects to a HFSQL local database. Unfortunately, the developer of this app is unavailable, and I need access to the DB. the program folder contains ...
2
votes
1answer
35 views

Partially correctly decoded strings from pkware zip with known plaintext

I have a password-protected zip file, where the paths and filenames of each file are encrypted using PKWARE encryption. The password is known and correct, and so is the encryption algorithm. I also ...
1
vote
0answers
28 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
2
votes
1answer
78 views

Generating disassembly from raw Infineon Tricore 1971 binary

Is IDA the best disassembler for a raw Tricore TC1791 (or similar) binary? I see there are several others floating around. Which programs are going to give us the most complete ASM from a raw binary? ...
3
votes
1answer
97 views

Why EIP is being overwritten before local buffer ends?

I am doing a simple buffer overflow exercise, here is the source: //vuln.c #include <stdio.h> #include <string.h> int main(int argc, char* argv[]) { char buf[256]; strcpy(buf,...
3
votes
2answers
124 views

router: how to break into boot?

I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. ...
0
votes
1answer
26 views

IDA Xrefs window keep open?

When I use the context menu "List cross references to", a window opens with a list of all positions found which references the position, and I can double click to a function. But then the window ...
0
votes
1answer
44 views

How to set virtual `T` register programmatically in IDA Python?

It is trivial to do it with Alt+G command from GUI. However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as "thumb" mode ones and sets T value at breakpoint address ...
-1
votes
1answer
56 views

malware analysis [closed]

I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made. I believe that this program modifies some files and the registry, but ...
0
votes
0answers
45 views

How does ConfuserEx work and what to look out for?

I wanted to learn how to crack some .NET obfuscated programs and I'm wondering how does ConfuserEx (since that seems to be the state-of-the-art) work? What do I have to look out for and why? What ...
2
votes
1answer
77 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
2
votes
1answer
119 views

What compression type has been used here?

I am still working on the binary image from the last question, and have already found out that my "corrupted" data is actually just compressed. But now I have another issue because I don't know what ...
1
vote
2answers
74 views

Strings weirdly split in binary

Recently I have come across a few parts in a binary that looked odd to me, and I wanted to ask if this is something common compilers do, and if there is a way to undo it. (The binary is from a raw ...
1
vote
1answer
145 views

Ghidra: Prepend memory segment in assembly listing view

Ida prepends the memory segment before each instruction. How can it be added in Ghidra ? I've already tried to edit the listing fields without success as no option fits my need. What I would like ....
0
votes
1answer
60 views

What types are read from byte array?

I try to understand what data types are read from a byte array. These methods seem to follow a common pattern: public class Reader { static short readA(byte[] bytes, int i) { int s = ((((...
1
vote
1answer
51 views

Extract Web Contents From Cisco Firmware Data IMG File

I download firmware https://software.cisco.com/download/home/284973404/type/284971397/release/1.1.4.1 I extract with binwalk sudo apt-get install -y binwalk' binwalk -eM Sx220-R1.1.4.1.bin cd ...
2
votes
0answers
59 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
1
vote
2answers
85 views

When trying to change command line, received an error: “Could not set command line!”

I download CurrPort program and run it on xdbg64. I pressed File -> Changed Command line and changed the command line to: "C:\Users\myusername\Downloads\cport\cports.exe" "/close * * 127.0.0....
1
vote
0answers
63 views

Ida permission error

I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
44 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
1
vote
0answers
39 views

(Help) APK Decomplied unreadable .pngs

I decompiled an Android game APK to look at the source code / resources and the .pngs give me the error "It looks like we don't support this file format" when I try to view them in the Photos App. I'...
0
votes
1answer
140 views

Info on ProcMon from SysInternals

I need help. I am reversing Procmon64.exe file. It drops procmon.Sys filesystem minifilter driver which does monitoring. Question: I need to know if filtering of events is done in user-mode or ...
3
votes
2answers
299 views

What is the purpose of consecutive ADC instructions to a single register?

To clarify, I understand how ADC works. It's the same as a regular ADD but with an extra 1 if the Carry Flag was set. Its use in the snippet below makes perfect sense to me since an overflow is most ...
0
votes
1answer
77 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
2
votes
0answers
20 views

Move focus to Immunity Debugger command line

As the title says, I want to know if there is a keyboard shortcut that upon pressing will allow me to write in the Immunity command line?
1
vote
1answer
54 views

PowerPC TOC and SDA

I'm trying to understand the concepts of the TOC and SDA in PowerPC. From what I understand, they are basically pointers to tables of global values, when TOC is stored in r2, and SDA in r13. But ...
1
vote
1answer
72 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
1
vote
3answers
143 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
1
vote
0answers
38 views

UTF8, UTF16 encoding string search

I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
1answer
78 views

Identifying Compiler Used for Binary File

I am trying to recreate a binary file from an analysis of "strings" output. I don't recognize which compiler was used for this file. It does not seem to be shc. Does anyone recognize this output ...
-1
votes
1answer
83 views

Understanding (pseudo-)C function from a video game [closed]

I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data. __int64 __fastcall ITF::...
1
vote
1answer
35 views

How to change IDA's name representation programmatically?

I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form 9 dseg_1234 the same as 2, but without data type ...
0
votes
1answer
46 views

BOSCH EDC development

I'm trying to reverse engineer some BOSCH EDCs firmware (there are many of them on the internet, for example: Here). To understand it better, I was wondering if someone has any idea how those EDCs ...
2
votes
1answer
39 views

How to set breakpoint with gdb on arbitrary memory location?

I'm trying to debug some code on Linux. There's an arbitrary memory location I need the program to jump to. This location is result of calling mmap with appropriate protection flags for executing a ...
0
votes
0answers
42 views

How instrument read/write access to local variable in a function

I have a large executable and facing a SIGSEGV in a function. I have tried a lot of things, but none has worked. I am planning to set up a PIN, but reading from the documentation I cannot figure out ...
0
votes
1answer
75 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
0answers
34 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
0
votes
1answer
69 views

How to identify/extract relevant assembly from a binary?

Say I was interested in reverse engineering a specific process in a large binary, say how Google Chrome parses XML, what are some general approaches to identifying the instructions that the program ...
1
vote
1answer
71 views

IDA Pro - Load data in manually created segment

The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string. ...
2
votes
0answers
23 views

How to replay a signal on a different frequency with Gnu Radio Companion and Hack RF

I captured the traffic of a remote control for a LED light. I have multiple of those LED Lights. The payload seems to be the same for each device but the frequency(channel) differs. For one LED light ...
0
votes
2answers
37 views

How to wire up a rotary encoder with a “0v” connection?

I have a servo motor with rotary encoder salvaged from an old scanner. I'm trying to figure out how to re-use it in a DIY CNC machine. By reading through the engineering manual from the original ...
-1
votes
1answer
47 views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
0
votes
0answers
69 views

Obfuscate JSON file that is served client-side

Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm ...
1
vote
2answers
101 views

Elf x86_64 adding function

I'm trying to see if I can append function code in the .text section of an ELF while still maintaining the execution flow of the original ELF. Ideally, I want to call the new function but that's it's ...
0
votes
0answers
33 views

obfuscating mprotect, or run-time alternative

For an anti-debug method, I need to make a stack page executable at run-time, but only briefly. I don't want to use mprotect() as it's easily located and tracing forward reveals the location of the ...
0
votes
1answer
36 views

Radare2 substituting second operand of lea instruction with a random register

I was trying to debug a crackme with radare2. I found an interesting function which radare2 flagged as sym.xxx. The following listing is trimmed version of disassembled output of the function sym.xxx. ...

15 30 50 per page