All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

modifying specific binary file

I have binary packed file likely containing a series of if/then action statements if decoded and unpacked to modify. I know what to seek for within the file, I need assistance in unpacking, ...
1
vote
2answers
142 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
1answer
49 views

Java says “ghidra” is unknown protocol when creating project on linux

Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
2
votes
1answer
217 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
0
votes
0answers
48 views

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
2
votes
1answer
60 views

Ghidra throws error when creating DWARFProgram

I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram. The constructor prints the following ...
0
votes
1answer
62 views

An incomprehensible line in the output from hex rays

v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1); Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
3
votes
1answer
54 views

alignment in Ghidra and IDA

I see in my IDA it does automatically "align 10" after the end of a fucntion. I wanted to know how to make the same in Ghidra manually like IDA does. Thanks
1
vote
1answer
67 views

IDA 7.5 Show the Progress from Auto Analysis?

Is it possible to create a box / bar in IDA wich indicates the progress?
1
vote
1answer
53 views

How to get thread start address in Windows?

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API. ...
1
vote
0answers
28 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
1
vote
0answers
39 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
0
votes
2answers
53 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
1
vote
0answers
33 views

process crash handler in Frida

I'm trying to debug a crash in some process in iOS frida-trace allows me to add handlers to specific functions, but I'd like to install a handler that prints the stack trace when the process crashes. ...
0
votes
0answers
42 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
0
votes
0answers
62 views

What are “covrage and ”codesz" in radare2?

[0x00009124]> a fcns 0 xrefs 0 calls 0 strings 126 symbols 74 imports 27 covrage 347 codesz 27543 percent 8% Sorry, this is a newbie question, but what are covrage and codesz? How can I ...
2
votes
0answers
34 views

How to find and read specific value in memory of running wine application?

How can I find and read specific values in memory of running WINE application? I am experimenting with text editors, writing some string and trying to find it in the heap memory and changing it using ...
1
vote
0answers
35 views

How to find how a hash in generated in an iOS app

I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to ...
1
vote
2answers
113 views

How to reverse engineering ARM architecture ELF file on AMD linux?

I am reversing an ELF file, it's ARM architecture file. But my OS is AMD linux. How can I do reversing work for the ARM ELF file on AMD linux?
0
votes
2answers
74 views

Is it possible to reverse CGI binary file?

I wanna reverse CGI binary file. Is it possible? What are the recommended tools and guides? Thank you for reading my question. $ file test.cgi status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
0
votes
0answers
17 views

CALC Branch to some address in ARM64

~STP X20, X19, [SP,#-0x10+var_10]! 0000000101BF9530 STP X29, X30, [SP,#0x10+var_s0] 0000000101BF9534 ADD X29, SP, #0x10 ...
0
votes
0answers
21 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
0
votes
0answers
99 views

Reversing PYARMOR (?)

I have already decompiled an .exe file and reached to a .py but it is obfuscated using PyArmor. I have already used ''https://github.com/nlscc/unpyarmor'' to try it, but could not figure it out how to ...
6
votes
1answer
328 views

HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)

TL;DR solution Setting 4MHz sample rate and 2Mhz bandwidth in the capture tab (according to the Nyquist theorem the sample rate has to be double the bandwidth) Using the length of a DIP switch ...
0
votes
0answers
28 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
2
votes
0answers
32 views

Help with working out a checksum

I'm trying to work out how to reverse engineer the checksum on infrared remote data stream for a heat pump. I've established that it's not a CRC, and I've tried methods found on this forum. It doesn'...
3
votes
1answer
71 views

Printing all strings in a Ghidra project with python

I got the string objects from a Ghidra project using this code: l = list() def callback(s): l.append(s) ss = StringSearcher(currentProgram, 5, 1, False, True) ss.search(None, callback, True, ...
1
vote
0answers
41 views

Reverse Engineering SNES adapter

A good "Hello world" for everybody here I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4... The thing is, this CLV-202 ...
-1
votes
3answers
107 views

How to reverse *.pkg file? This is a firmware file of a router

I am a newbi for reversing engineering. I am going to reversing a firmware file. (*.pkg) I could find many tutorials for reversing *.bin, but I can't find any tutorials for reversing *.pkg file. And I ...
-1
votes
1answer
79 views

How to understand the result of disassembling IDA Pro (dll x86_64)

I'm studying the dll that was built for x86_64. I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me ...
0
votes
1answer
71 views

Understanding the basics of Reverse Engineering a segment of code

Currently trying to understand the following code and what it is doing. mov eax, 1 test eax, eax jz loc_411503 mov esi, esp call ds:_kbhit cmp esi, esp call sub_411159 test ...
2
votes
1answer
46 views

Reversing uboot on an aarch64 Hi3559AV target problems

I am trying to reverse uboot for an ARM aarch64 Hi3559AV target. I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
1
vote
0answers
42 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
1
vote
1answer
63 views

Identifying/debugging code parts responsible for features in Windows

New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu. What are some generic ways of identifying the ...
0
votes
0answers
41 views

I want to write some mods for doom eternal

Regarding doom eternal (steam) I want weapon swapping to be faster, but there are no mods for that currently available. What do I need to do to get to see doom eternals files? I can probably minifi ...
1
vote
1answer
49 views

Why is process object is shown as desktop object in nt!_object_type

I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object. Any idea why is it so? 4: kd> !process 0 0 notepad.exe ...
0
votes
0answers
133 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
2
votes
1answer
36 views

Why some process has empty nt!_object_type

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type? Correction for my screenshot above for using the EPROCESS address to ...
2
votes
0answers
67 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
1
vote
1answer
69 views

Is there a way to attach x86dbg with ida pro?

IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?
0
votes
0answers
35 views

what do these assembly codes doing? [duplicate]

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
-1
votes
1answer
101 views

what do these assembly code doing?

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
3
votes
1answer
80 views

Trying to identify a Binary-Search-Tree structure

Let's say I make a std::map in C++, and ADDR is their address in memory. When I look at this place in memory I will find a pointer and in ADDR + 4 will be the amount of elements in the container. Now, ...
1
vote
0answers
104 views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
0
votes
2answers
123 views

Open unknown image format (probably a RAW image)

I copy image files here from a linux based system which ends with .bin. Unfortunately I don't know how to open it. The goal is to convert images to this format later. What I have already tried: Open ...
0
votes
0answers
82 views

Decompiling exe to python source code

I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part: --- This ...
1
vote
1answer
142 views

How to disable relro while compilation?

#include <stdio.h> #include <stdlib.h> int main(int argc, int *argv[]) { size_t *p = (size_t *) strtol(argv[1], NULL, 16); p[0] = 0xDEADBEEF; printf("RELRO: %p\n", p); return ...
1
vote
0answers
76 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
0
votes
1answer
69 views

What character codes could these be?

Good day. I have these character codes in a binary file (Adobe After Effects Project) that represent a string. If I change them the text inside the application changes. However, for the life of me, I ...
3
votes
0answers
31 views

Help required to figure out the JTAG or UART pins

I have an old CDMA dongle lying around, so I thought to try to reverse engineer them, but am unable to figure out the UART or JTAG pins, I have attached a photo of the probable pins, can anyone help ...

15 30 50 per page