All Questions

Filter by
Sorted by
Tagged with
1 vote
2 answers
46 views

How Does ARM64 EOR with Shift Work?

I'm reverse engineering an ARM64 binary and I came across the following instruction 48 05 48 4A eor w8, w10, w8, lsr #1 I looked up the definition of ARM64's eor instruction here: https://...
  • 211
1 vote
1 answer
66 views

How to debug an obfuscated self hashing program?

I need to understand what the following obfuscated application does: interpreter.py: string = "lambda x : obfuscated_code_to_interpret_variable_x" interpreter = eval(string) ...
1 vote
0 answers
103 views

Ida Pro can't decompile big function

I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error : The graph is too big (more than 1000 nodes) to be displayed on the screen. Switching to text mode. (you ...
  • 183
0 votes
1 answer
128 views

How to import Ghidra DB into IDA?

I see many questions about how to import IDA DB into Ghidra but I interesting in the backside. I want to export Ghidra DB and import it into Ida PRO. How I can do that?
0 votes
1 answer
57 views

What is the size of a security cookie in PE file?

I know that pointer to the security cookie in Load Configuration Directory is 4 bytes long for 32-bit exe and 8 bytes long for 64-bit one (source), but what is the size of the security cookie itself? ...
0 votes
0 answers
33 views

Problem to hook a parameter with _thiscall function

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function: .text:00488DA0 ; =============== S U B R O U T I N E ==========================...
0 votes
1 answer
30 views

What should the instruction string be for capstone

The following program doesn't correctly disassemble string "d280001d", it just outputs: 0x1000: I also tried "\xd2\x80\x00\x1d", which I got from shell-storm.org, still got the ...
  • 1
0 votes
1 answer
39 views

Displacement size (disp_size) of x86 instructions

Given the opcode 80 3d 1d b0 09 00 00. The corresponding capstone instruction is <CsInsn 0x66a4 [803d1db0090000]: cmp byte ptr [rip + 0x9b01d], 0> and has the following properties (c_i being ...
  • 1,456
0 votes
0 answers
23 views

How does windbg correctly resolve symbol addresses for optimised code?

When you debug optimised code, I know that address arithmetic doesn't work correctly: 0:004> u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69 u dwmcore!CPartitionVerticalBlankScheduler::...
0 votes
0 answers
67 views

UC_ERR_WRITE_UNMAPPED when emulation starts on binary

Whenever I try to emulate my obfuscated driver it fails at uc_emu_start with UC_ERR_WRITE_UNMAPPED. I get all success return codes on: uc_mem_map and uc_mem_write but when I call uc_emu_start ; I get ...
  • 21
0 votes
1 answer
92 views

How to speed up finding a function from pseudocode in IDA?

I have a function with the pseudocode of __int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3) { if ( qword_7FF709F91498 ) return (*(__int64 (__fastcall **)(ID2D1Geometry *...
1 vote
1 answer
45 views

VMware Dynamic Analysis on Chosen Executable within VM

I am trying to use vmware for debugging. What I am trying to achieve is once an executable has been opened inside a vm which runs on Windows, I would like to extract the runtime traces for that ...
  • 21
2 votes
0 answers
36 views

Brute Force USB Fuzzing

I am working to reverse engineer a USB based robot arm, but the operating system for the robot won't allow me to create simple enough moves that I can isolate the commands with a USB Sniffer like ...
0 votes
1 answer
45 views

Output from gcc containing all included source code?

Right now, I'm using a combination of gcc -g and the objdump -S modes to generate assembly code with debug source code interleaved. However, I'm having trouble correlating some of the functions that ...
0 votes
1 answer
102 views

Missing mnemonics '??' in Ghidra Assembly Code

I was just trying to google and search for "??" Ghidra with no luck. I am trying to understand what the following questions mean in this Binary (meant for SuperH2 SH-2 processor) which is ...
3 votes
2 answers
329 views

Where does IDA load binary in Ida64.exe process?

I quickly checked the address range shown in IDA within the ida64.exe process using a kernel debugger, and the memory is question marks, indeed there is no VAD allocation for the range. I don't want ...
0 votes
0 answers
33 views

Is there any reason to define a struct instead of a local type in IDA pro?

It seems to me that there is no reason whatsoever to define an asm-style struct rather than a C-style type. A C-style struct type can contain references to floats and doubles, user defined types, and ...
1 vote
1 answer
60 views

Static Code Analysis of a C166 function

I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
  • 51
1 vote
1 answer
59 views

Python or C for a Qt application and security against reverse engineering

I actually have two choices : C or Python to create my application. On my application users will need a key (on start) to access it, the key will be verified with an algorythm on the user's computer. ...
0 votes
2 answers
67 views

Renaming a local stack variable with IDAPython

I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so... In my ...
0 votes
0 answers
96 views

How to get instructions at her address?

With the help of gidra, I found the function of interest. void __fastcall FUN_gameWhile(int buf?) function address in gidra - 00aad920 I'm trying to get instructions at this address using frida var ...
  • 13
1 vote
1 answer
91 views

strange arm construct in objective-c application

I was reversing the objective-c application and stumbled upon an assembler construction that I don't understand: This is call of some function with SP register (+ 0x18 offset) as parameter. (Picture1)....
  • 11
0 votes
0 answers
43 views

Reverse Engineering SCARA Style Robot - USB Protocol

I am new to the topic of reverse engineering software (not new to hardware reverse engineering), so this question is more of a "lets ask people's opinion" type of thing. I have a robot arm ...
2 votes
0 answers
44 views

Spy on LCD screen with Raspberry Pi

I have this digital crane scale. It has a 5 digit 7 segment LCD display. My objective is to be able to read what is displayed on the LCD display with a Raspberry Pi. This is what the PCB looks like: ...
1 vote
0 answers
36 views

De-Obfuscating/unminifying a JS code [not duplicate]

I have come across a lot of similar questions on the same heading but unfortunately, none of them provided me with the intended results. I have a piece of code which, initially I am trying to ...
  • 11
2 votes
1 answer
124 views

How to reverse a game and inject a dll in client program?

I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
1 vote
1 answer
61 views

Help starting with UEFI/SMM exploits

I have a 845 g7 with a bios 1.06, which has a load of CVEs which allow SMM and DXE exploits: https://support.hp.com/ca-en/drivers/selfservice/hp-elitebook-845-g7-notebook-pc/37506818 (under the UEFI ...
  • 13
1 vote
1 answer
80 views

What is j__ftol2_sse_excpt in IDA?

I was inspecting the c-pseudocode for a PE executable in IDA. I found some function called j__ftol2_sse_excpt() When I open that function I see that the function is calling another function named ...
0 votes
0 answers
14 views

Does anyone recognize this jQuery website plugin?

I am working on a site that was made years ago (not be me) and I need to identify a jQuery file manager plugin. This plugin shows a file manager view in a browser and allows the user to visually ...
2 votes
0 answers
32 views

Image decompression: Reconstructed LZW dictionary somewhat, not exactly matches original dictionary

I am attempting to reverse an animation format that uses (I think) some form of LZW for each of the frames. I have determined that a 12-bit code is used throughout the image. Here is a short target ...
2 votes
0 answers
78 views

Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?

I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
2 votes
1 answer
84 views

How to debug cfg80211.ko

I have an Linux embedded device that I want to debug the cfg80211.ko I have full root SSH on that device. How can I debug cfg80211.ko?
0 votes
0 answers
27 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

In the first example I only set a breakpoint on user32!CreateWindowExW In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain In the 3rd example I ...
0 votes
2 answers
54 views

Radare2 - changing stdin during binary debugging

I'd like to know how to change stdin multiple times for the given binary for debugging purposes. I know I can launch the application with r2 -r profile.r2 -d binary Where, inside the profile.r2 file ...
1 vote
1 answer
77 views

Disassemble specific mach-o function

I have a mach-o binary and using llvm-objdump version 9 I can disassemble it. I would like to disassemble only a single function though. If I display the symbol table with --syms I can see the ...
  • 107
0 votes
0 answers
35 views

How to debug C++ module/function call used in .net application?

I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this <Module>.X.Y.Z.Initialize(ptr, ptr2, flag); The function belongs to a DLL and ...
1 vote
1 answer
41 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
  • 1,456
1 vote
0 answers
42 views

Help MMO Tcp Packet

I'm trying re-send the packets that an MMO sends to the server just to learn more about packets. The game uses TCP. I sent the same message in the game chat "oi" to analyze the packages sent ...
  • 11
2 votes
0 answers
39 views

Trying to understand a simple compiled PSI binary file

I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
0 votes
0 answers
47 views

Inject script into Dex-Protected app

I've seen scripts like : https://github.com/hluwa/frida-dexdump https://github.com/apkunpacker/DexDumper that can extract the Dex files but what I want is to inject into running app and identified ...
  • 257
1 vote
0 answers
16 views

Encoding scheme identification of the following communication message

I'm trying to RE an app for educational purposes. So here is the behavior of the app. When the app starts, it communicate with a server in plain tcp and based on those tcp messages, it either work as ...
1 vote
0 answers
41 views

analyze track program protected

What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?
  • 11
1 vote
0 answers
137 views

Differences between hex-editor and Ghidra and how to find strings

I just started playing around with reverse engineering and Ghidra, so please bear with me. I wanted to run an old game. One version available on archive.org does not work even when I have mounted the ...
1 vote
1 answer
111 views

How to locate a string in memory with x64dbg

I opened a 32-bit program with x32dbg, I wrote something on a text box like this : How can I find the piece of code that manipulates the string "Goku" ? I searched all string references but ...
  • 111
1 vote
1 answer
239 views

[Ghidra]How to set global variable type?

I have created a script in Java and I have a structure type as a string name which I want to set at given global variable which I have the Address of. However I can't seem to find a way to do this - ...
  • 425
2 votes
1 answer
115 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
  • 121
1 vote
1 answer
26 views

How to utilize `FillOutStructureCmd`?

Basically I'm extending the CreateStructure.java plugin so it iterates all functions and tries to automatically create structures on all variables. It looks something like this: public class ...
  • 425
3 votes
1 answer
60 views

Radare2 - Saving information/metadata from a debugging session

I'd like to know how I can save/restore comments or possibly other metadata during a debugging session. I know how to save this data when running radare without the -d flag but I often need to debug ...
1 vote
0 answers
80 views

Where can I find the encryption algorithm for this POST request in an Android APP?

I have an Android app for which I need to mock an API call outside of that environment. I successfully killed the certificate pinning on this app with Frida in order to access the URL and more, but ...
  • 19
0 votes
0 answers
37 views

Assign function type to a pointer in ghidra

In the project I'm currently working on, I have found the following obfuscated access to functions in various libraries. In the following example, libdl is referenced. if (libdl_string_literal[8] != ...
  • 101

15 30 50 per page