All Questions

Filter by
Sorted by
Tagged with
0 votes
1 answer
111 views

(Ghidra) How to get the parameter name given a Function object and the storage location as a register string?

Given an instance of something that implements ghidra.program.model.listing.Function, and the register as a string (e.g. x0) how can I get the name of the argument (e.g. param1)?
user avatar
0 votes
1 answer
70 views

IDA: String referenced in Assembly, but not shown in string view

I was looking for a spcific string in IDA, but there were no hits in the "string view". Now after browsing the disassembly for a while I realize that not only does the string exist, IDA did ...
user avatar
0 votes
0 answers
33 views

Retrieve all parameters of specific function: How to automate

I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
user avatar
  • 83
0 votes
0 answers
16 views

why ida7.6, here() return not exact EA in structure address range?

scene: After I use one structure to define a global variable in .data segment, then I cant use here() to get the exact EA where the cursor is, only get the struture's head address. ask for help: How ...
user avatar
0 votes
0 answers
87 views

How to identify if an .exe packed by VMProtect has virtualization enabled?

I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory. Using PE EXE ...
user avatar
2 votes
2 answers
99 views

HEX code to call DLL function

I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
user avatar
  • 23
1 vote
1 answer
85 views

Automatically propagate types in IDA pro when variables are assigned?

Let's say I have this code in the decompiler of IDA pro: var1 = var2; And assume the type of var1 is X (for example X could be char array with size 5). Is there anyway that I can tell IDA that ...
user avatar
3 votes
2 answers
184 views

Is there a software that can reverse calculate checksums by brute force?

For reverse calculation of CRC checksums, there is a pretty nice tool – CRC reveng. I was looking for, and have not found, a similar tool that can do the same for non CRC checksums. For example, using ...
user avatar
0 votes
1 answer
114 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
user avatar
  • 1
0 votes
0 answers
25 views

Volatility 2.x command missing in Volatility 3.x?

I am doing some memory analysis exercises with Volatility. Here, they used the command cmdscan in the Volatility 2.x framework to analyze executed commands from a windows command prompt. Sadly, I was ...
user avatar
  • 49
0 votes
1 answer
99 views

SQLite access from Ghidra script

I would like to access an SQLite database from within a Java Ghidra script. However, if I include the line import java.sql.*; in the script, Ghidra gives the error > Unable to locate script class:. ...
user avatar
0 votes
1 answer
74 views

Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender

In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
user avatar
  • 156
0 votes
0 answers
49 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
user avatar
1 vote
0 answers
29 views

nrf52-based localization tag flash dump and modification

Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
user avatar
  • 11
0 votes
0 answers
31 views

Philosophical and procedural question - Process for using x64 inline assembly in recovering source code

I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
user avatar
  • 723
0 votes
1 answer
54 views

How can I differentiate the JTAG pins like TMS, TDI, TDO, & TCK using impedance

How can I differentiate between the JTAG pins like TMS, TDI, TDO, & TCK using impedance? Because when we connect JTAG (RS422) with unnamed pin, we got a problem. So I am asking how to identify ...
user avatar
0 votes
1 answer
65 views

recovering a process dump from a memory dump with WinDbg

I have a crush dump (memory.dmp), and I want to extract process (calc.exe) from it. I tried: !process 0 0 calc.exe PROCESS ffffb501f8c23580 <-- this is the address SessionId: 0 Cid: 035c ...
user avatar
  • 143
0 votes
0 answers
26 views

IDA debugger register string pointer in conditional breakpoints

When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
user avatar
1 vote
1 answer
53 views

IDA: close without saving changes

In my work, I often end up with lots of IDA windows open concurrently. Once done with analysis, I would like to close them all. It is relatively easy to issue a command to all of them simultaneously e....
user avatar
  • 135
1 vote
1 answer
266 views

Why does Ghidra show no references to any strings?

I'm attempting to compare this binary bootloader to a slightly different C version of some boot code. My initial approach is to look at the msg() calls and the strings they use. I can dump the strings,...
user avatar
  • 151
0 votes
0 answers
32 views

inspecting the .hex file generated by gpasm

To answer my own question here, I wrote a small sample program, example.asm: var_1 equ H'0001' constant var_2=H'0002' #define var_3 H'0003' cblock H'0004' var_4 endc END and compiled ...
user avatar
  • 159
0 votes
0 answers
167 views

Getting rid of a custom Shell on a LiteOS based outdoor camera

I started reversing this camera in order to get rid of the unwanted traffic it constantly does towards Chinese servers. I have a serial access to it thanks to an obvious UART port (bottom left in the ...
user avatar
  • 101
0 votes
0 answers
287 views

how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?

I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility ...
user avatar
  • 1
0 votes
0 answers
57 views

How to debug a DLL without rundll32

I'm currently looking at the sample mentioned in this article here, and it seems that it uses the SvcMain function prototype instead of the runnableExport function prototype used by rundll32. As a ...
user avatar
1 vote
1 answer
164 views

How to create and change variables at address in IDA Python?

I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it. For structs, there's ...
user avatar
  • 206
0 votes
1 answer
58 views

How do I make Ghidra propagate modified functon signatures to other programs in that project?

I have imported several programs to my Ghidra project and retyped a few function parameters in one of them. Now I am working on a different program, which imports these functions. However, the ...
user avatar
  • 3
0 votes
0 answers
51 views

Finding method for checksum calculation - CRC or XOR or other

I have RF connected devices for which I'm working on the protocol of data packets, as those are not supported by known software at the moment. Packets are pretty simple and consists only in 6 nibbles ...
user avatar
0 votes
0 answers
26 views

What compression or encryption could this be in this file?

This is a file with the extension of .acfrs from Delphi car diag app flight recorder. I wish to decrypt this file to load to excel to represent the graph, but I cnat find a way how to use the data ...
user avatar
  • 21
0 votes
0 answers
53 views

How do I convert an adress to little endian such that I can feed it to my exploit?

I'm doing a small exploit exercise. For this purpose, I have the following file: #include <stdio.h> void secretFunction() { printf("Congratulations!\n"); printf("...
user avatar
  • 101
1 vote
0 answers
83 views

Bypassing certificate transparency with Frida

As part of some school research I'm experimenting with Frida to see what can be done to bypass SSLpinning. As I was hooking some methods of an application that throw SSLPeerUnverifiedException I ...
user avatar
  • 31
1 vote
1 answer
39 views

IDA Pro S12X flash page references

Trying to analyse a dump from MC9S12X series MCU and can`t get how IDA making cross flash page references and if it could be done without scripts. The project contains 64 code segments with linear ...
user avatar
1 vote
1 answer
46 views

Help identifying a 433.92 MHz signal modulation?

I have this report for the remote for the blinds. https://fccid.io/YC5AC123-02/Test-Report/RF-Report-2498699 It says os OOK modulated. However I don't understand the signal I recorded when pushing ...
user avatar
  • 191
1 vote
1 answer
45 views

Create instance of iOS class that contains a . with frida

I am trying to create an instance of a class of an iOS app using Frida. In the past I have successfully done this using a command such as: var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0]; ...
user avatar
  • 95
0 votes
0 answers
15 views

Print CMarkupSTL object with GDB

CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process? I run on Arm Linux
user avatar
0 votes
1 answer
71 views

433MHz Protocol: Unknown Three-Symbol-Encoding within the OOK data

Reverse engineering the protocol of a remote-controlled wall socket (433MHz On-Off-Keying) revealed an embedded pattern which apparently uses three symbols (besides 0s). Symbol A = 000001 Symbol B = ...
user avatar
  • 103
1 vote
2 answers
106 views

What is the point to have 2 different places for structures: Local Types and Structures in IDA?

Why is there 2 places for structures in IDA: Local Types and Structures? What are Local Types local to? Why do I have to synchronize a type in the Local Types window to the idb in order to edit it? ...
user avatar
  • 206
0 votes
1 answer
46 views

Decoding API response of unknown encoding?

I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go ...
user avatar
0 votes
0 answers
37 views

ida shows instructions as hex data

I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem. at the start of the program, there is a label that points to an address of ...
user avatar
0 votes
0 answers
32 views

Is it possible to rebase direct calls and jmps when i rebase the IDB in IDA pro?

When i rebase the IDB file, it doesn't effect the direct calls, so something like call dword ptr ds:851F3020h Will not get rebased and all of the sudden all my direct calls are pointing to ...
user avatar
0 votes
1 answer
41 views

Unknown proprietary Micro-USB variant

While reversing a Sena Bluetooth Headset i noticed that the programming port of the internal chip is routed out to 6 additional undocumented Pins inside of the Micro-USB connector. Whats the best ...
user avatar
1 vote
0 answers
63 views

Prevention of reverse engineering of a microcontroller's firmware

What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller? Options I see so far: Flood it with epoxy with quartz or metal dust to make ...
user avatar
2 votes
0 answers
49 views

Is it possible to dump firmware of a device via USB port?

I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port. lsusb command says that this device has following ...
user avatar
1 vote
1 answer
40 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
user avatar
  • 73
1 vote
2 answers
133 views

Is it possible/feasible to decompile a program written in C++ to C?

I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know. If it is possible, ...
user avatar
0 votes
0 answers
68 views

Warframe Network Communication

Warframe is a MMO that has both servers and peer to peer networking, I am looking into the server side of things. What I am wanting to achieve is client communication to a emulated server. So far I am ...
user avatar
0 votes
2 answers
178 views

Reversing an obfuscation through a long linear switch statement

I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction: i = 0 switch(i): case 0: one small instruction ...
user avatar
1 vote
1 answer
240 views

How to define "code" variable type in Ghidra

Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
user avatar
1 vote
1 answer
49 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
user avatar
  • 983
2 votes
1 answer
64 views

Identifying the logic in remote control data packets

I have a set of 4 power sockets that can be turned on and off with an RF remote. That remote has 4 pairs of on/off buttons along with a master pair that can control all sockets at once. Initially, the ...
user avatar
  • 41
0 votes
0 answers
27 views

Decoding a stream of bytes in audio form (Teenage Engineering OP-1 & PO-33)

I have a device that stores and transmits data using audio (Teenage Engineering's OP-1 and PO-33). I'm trying to figure out how I can turn it into a byte stream to try to decode it. Below is an ...
user avatar

15 30 50 per page
1
3 4
5
6 7
173