All Questions

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...

I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...

I don't understand the meaning of cs: Memory. Please help me.

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...

Upon running strace of an android x86 program I am debugging I notice a large section of stat64 like this: stat64("/data/data/com.topjohnwu.magisk/", 0xbfbf2ef4) = -1 ENOENT (No such file or ...

I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example. The first part of it is fairly straightfoward- 7C921A39 MOV EDI,EDI 7C921A3B PUSH EBP ...

I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me. I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...

This RSE thread and this one discuss effectiveness of RDTSC-based anti-debug methods, and also a way to possibly work-around (albeit using a fake driver method, which is complex). What is a counter-...

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...

Let's say I want to list all calls that issue kill, axt @ sym.imp.kill How can I now NOP out the syscall at all of the addresses given? I want to strip the program of calls to kill.

I can make an array using MakeArray. Is there a function to get the size of the array I've created? I've tried GetArrayId + GetLastIndex but it doesn't seem to work.

I have 2 binaries, with the same CPU architecture. I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it. I put the ...

I am trying to reverse engineer a checksum algorithm of car CAN bus data I tried to find with (CRC RevEng), but I can not find it how to calculate it I have captured communication can bus data. I ...

I am trying to reverse engineer the IR protocol for my air conditioner (GREE - remote control YAP1FF) and with the data I found online and a lot of testing with a IR receiver there is only one field I ...

Hello i need somehelp in decrypting the file config.bin generated by the page backup_setting.html from huawei B5328 router , i have access to all files in the router even the www files hosted on the ...

When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions ...

It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe). Looking into the problem, it ...

I'm translating a radio and I'm having some little problems. I have here a .bin file that contains an update for a radio. I would like to exchange a .elf file located in the .bin file and replace it ...

To begin with, I'd like to point out that I'm very new to this. Here's the simple thing I'd like to do : The program I want to mess around with displays a msgbox with the string "Please run the ...

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...

I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki). Links to files of game: libhellolua.so (cocos2dx external library) example encrypted LUA-scripts (*.abc files) I was reading a ...

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...

i have decrypted the config file using a program i found online ( maybe made by python to exe ) so to decrypt using it you type is command into CMD decode_zte_config.exe config.bin config.bin.xml ...

I know I can set the operand data type of my disassembly using functions such as OpBinary, OpOctal,OpDecimal, etc. Now, I'm trying to get the current operand data type of my disassembly instead. For ...

Whats wrong: d:\radare2\bin\radare2 -A -d d:\test.exe Spawned new process with pid 7192, tid = 8572 ... [0x014eb83c]> pd 5 ┌ (fcn) entry0 2066 │ entry0 (); │ bp: 0 (vars 0, args 0) │ sp: 0 (...

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...

I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable. However, as soon as ...

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...

Hello I have a 4G LTE router which is blocked. I have access to its serial interface and I have already dumped the partitions before via telnet from another device of the same model. Here's the ...

I am debugging ESX server in kernel mode(windows). I use windbg debugging through COM PORT(eventually). Can I get VirtualKD to work in this scenario? Suspending IDA takes more than a few seconds(...

Can anyone manage to work out how the checksum is calculated in the following data? Have tried reverse engineering crc and xor and anything else I can think of. There is a definite pattern there, but ...

Currently I'm writing a parser for .NET files and stuck on manifest resources. My main resources: Huge documentation Short summary For resource format I have found this project made in 2005, all ...

This format is always trouble for reverse engeneering. When there are question about binary XML, the usual answer is "use apktool" (or something similar). However, no tool is perfect; actually all ...

I just finished skimming the book Art of Assembly by Randall Hyde. So now to get my feet wet in assembly/reverse engineering reading, I started the book Reverse Engineering for Beginners. The thing ...

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...

Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion here are the mbn files : NPRG9x07.mbn2 ENPRG9x07....

when I am looking for packet editor, I found open project on http://www.packeteditor.com/ when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE....

Hi all i got a western digital hard drive from a DVR which contains custom firmware so you will not be able to install any hard drive you want on the DVR device. (digital video recorder) something ...

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.

I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...

i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how can i do that?

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .

How can I change je to jne via GDB tooL?

Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...