All Questions
8,629
questions
0
votes
1
answer
111
views
(Ghidra) How to get the parameter name given a Function object and the storage location as a register string?
Given an instance of something that implements ghidra.program.model.listing.Function, and the register as a string (e.g. x0) how can I get the name of the argument (e.g. param1)?
- 1,176
0
votes
1
answer
70
views
IDA: String referenced in Assembly, but not shown in string view
I was looking for a spcific string in IDA, but there were no hits in the "string view". Now after browsing the disassembly for a while I realize that not only does the string exist, IDA did ...
- 373
0
votes
0
answers
33
views
Retrieve all parameters of specific function: How to automate
I'm trying to reverse engineer.NET binary with dnspy. I have a decryption routine that is used to display useful strings. It takes one integer value as a parameter and uses it in the decryption ...
- 83
0
votes
0
answers
16
views
why ida7.6, here() return not exact EA in structure address range?
scene:
After I use one structure to define a global variable in .data segment, then I cant use here() to get the exact EA where the cursor is, only get the struture's head address.
ask for help:
How ...
- 1
0
votes
0
answers
87
views
How to identify if an .exe packed by VMProtect has virtualization enabled?
I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory.
Using PE EXE ...
2
votes
2
answers
99
views
HEX code to call DLL function
I'm working with 2 third party DLLs (let's A.dll and B.dll), which I don't have the source code, only the compiled DLL. I know A.dll uses the main function from B.dll, and they both works perfectly. ...
- 23
1
vote
1
answer
85
views
Automatically propagate types in IDA pro when variables are assigned?
Let's say I have this code in the decompiler of IDA pro:
var1 = var2;
And assume the type of var1 is X (for example X could be char array with size 5). Is there anyway that I can tell IDA that ...
- 320
3
votes
2
answers
184
views
Is there a software that can reverse calculate checksums by brute force?
For reverse calculation of CRC checksums, there is a pretty nice tool – CRC reveng.
I was looking for, and have not found, a similar tool that can do the same for non CRC checksums. For example, using ...
0
votes
1
answer
114
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 1
0
votes
0
answers
25
views
Volatility 2.x command missing in Volatility 3.x?
I am doing some memory analysis exercises with Volatility.
Here, they used the command cmdscan in the Volatility 2.x framework to analyze executed commands from a windows command prompt. Sadly, I was ...
- 49
0
votes
1
answer
99
views
SQLite access from Ghidra script
I would like to access an SQLite database from within a Java Ghidra script. However, if I include the line import java.sql.*; in the script, Ghidra gives the error > Unable to locate script class:. ...
- 101
0
votes
1
answer
74
views
Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender
In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
- 156
0
votes
0
answers
49
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
1
vote
0
answers
29
views
nrf52-based localization tag flash dump and modification
Lately I've bought a localisation tag (Apple AirTag alike). When I click a button on my cell phone, the device plays a chiptune-like ringtone. The ringtone is configurable using the app and stored on ...
- 11
0
votes
0
answers
31
views
Philosophical and procedural question - Process for using x64 inline assembly in recovering source code
I am assuming this should place be appropriate for what I want to ask. I want to ask more of a philosophical and procedural question because I don't want to try things that have been tried and spend ...
- 723
0
votes
1
answer
54
views
How can I differentiate the JTAG pins like TMS, TDI, TDO, & TCK using impedance
How can I differentiate between the JTAG pins like TMS, TDI, TDO, & TCK using impedance?
Because when we connect JTAG (RS422) with unnamed pin, we got a problem. So I am asking how to identify ...
0
votes
1
answer
65
views
recovering a process dump from a memory dump with WinDbg
I have a crush dump (memory.dmp), and I want to extract process (calc.exe) from it.
I tried:
!process 0 0 calc.exe
PROCESS ffffb501f8c23580 <-- this is the address
SessionId: 0 Cid: 035c ...
- 143
0
votes
0
answers
26
views
IDA debugger register string pointer in conditional breakpoints
When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
1
vote
1
answer
53
views
IDA: close without saving changes
In my work, I often end up with lots of IDA windows open concurrently. Once done with analysis, I would like to close them all. It is relatively easy to issue a command to all of them simultaneously e....
- 135
1
vote
1
answer
266
views
Why does Ghidra show no references to any strings?
I'm attempting to compare this binary bootloader to a slightly different C version of some boot code. My initial approach is to look at the msg() calls and the strings they use. I can dump the strings,...
- 151
0
votes
0
answers
32
views
inspecting the .hex file generated by gpasm
To answer my own question here, I wrote a small sample program, example.asm:
var_1 equ H'0001'
constant var_2=H'0002'
#define var_3 H'0003'
cblock H'0004'
var_4
endc
END
and compiled ...
- 159
0
votes
0
answers
167
views
Getting rid of a custom Shell on a LiteOS based outdoor camera
I started reversing this camera in order to get rid of the unwanted traffic it constantly does towards Chinese servers.
I have a serial access to it thanks to an obvious UART port (bottom left in the ...
- 101
0
votes
0
answers
287
views
how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?
I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility
...
- 1
0
votes
0
answers
57
views
How to debug a DLL without rundll32
I'm currently looking at the sample mentioned in this article here, and it seems that it uses the SvcMain function prototype instead of the runnableExport function prototype used by rundll32. As a ...
- 1
1
vote
1
answer
164
views
How to create and change variables at address in IDA Python?
I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it.
For structs, there's ...
- 206
0
votes
1
answer
58
views
How do I make Ghidra propagate modified functon signatures to other programs in that project?
I have imported several programs to my Ghidra project and retyped a few function parameters in one of them.
Now I am working on a different program, which imports these functions.
However, the ...
- 3
0
votes
0
answers
51
views
Finding method for checksum calculation - CRC or XOR or other
I have RF connected devices for which I'm working on the protocol of data packets, as those are not supported by known software at the moment. Packets are pretty simple and consists only in 6 nibbles
...
0
votes
0
answers
26
views
What compression or encryption could this be in this file?
This is a file with the extension of .acfrs from Delphi car diag app flight recorder.
I wish to decrypt this file to load to excel to represent the graph, but I cnat find a way how to use the data ...
- 21
0
votes
0
answers
53
views
How do I convert an adress to little endian such that I can feed it to my exploit?
I'm doing a small exploit exercise.
For this purpose, I have the following file:
#include <stdio.h>
void secretFunction() {
printf("Congratulations!\n");
printf("...
- 101
1
vote
0
answers
83
views
Bypassing certificate transparency with Frida
As part of some school research I'm experimenting with Frida to see what can be done to bypass SSLpinning.
As I was hooking some methods of an application that throw SSLPeerUnverifiedException I ...
- 31
1
vote
1
answer
39
views
IDA Pro S12X flash page references
Trying to analyse a dump from MC9S12X series MCU and can`t get how IDA making cross flash page references and if it could be done without scripts.
The project contains 64 code segments with linear ...
- 11
1
vote
1
answer
46
views
Help identifying a 433.92 MHz signal modulation?
I have this report for the remote for the blinds. https://fccid.io/YC5AC123-02/Test-Report/RF-Report-2498699
It says os OOK modulated. However I don't understand the signal I recorded when pushing ...
- 191
1
vote
1
answer
45
views
Create instance of iOS class that contains a . with frida
I am trying to create an instance of a class of an iOS app using Frida.
In the past I have successfully done this using a command such as:
var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0];
...
- 95
0
votes
0
answers
15
views
Print CMarkupSTL object with GDB
CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process?
I run on Arm Linux
0
votes
1
answer
71
views
433MHz Protocol: Unknown Three-Symbol-Encoding within the OOK data
Reverse engineering the protocol of a remote-controlled wall socket (433MHz On-Off-Keying) revealed an embedded pattern which apparently uses three symbols (besides 0s).
Symbol A = 000001
Symbol B = ...
- 103
1
vote
2
answers
106
views
What is the point to have 2 different places for structures: Local Types and Structures in IDA?
Why is there 2 places for structures in IDA: Local Types and Structures?
What are Local Types local to?
Why do I have to synchronize a type in the Local Types window to the idb in order to edit it? ...
- 206
0
votes
1
answer
46
views
Decoding API response of unknown encoding?
I'm using Proxyman to inspect the api requests of an app I use. Most of the data is returned in plain JSON blobs but there is one response which is returning data encoded/encrypted. How can I go ...
- 1
0
votes
0
answers
37
views
ida shows instructions as hex data
I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem.
at the start of the program, there is a label that points to an address of ...
0
votes
0
answers
32
views
Is it possible to rebase direct calls and jmps when i rebase the IDB in IDA pro?
When i rebase the IDB file, it doesn't effect the direct calls, so something like
call dword ptr ds:851F3020h
Will not get rebased and all of the sudden all my direct calls are pointing to ...
- 320
0
votes
1
answer
41
views
Unknown proprietary Micro-USB variant
While reversing a Sena Bluetooth Headset i noticed that the programming port of the internal chip is routed out to 6 additional undocumented Pins inside of the Micro-USB connector. Whats the best ...
- 116
1
vote
0
answers
63
views
Prevention of reverse engineering of a microcontroller's firmware
What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller?
Options I see so far:
Flood it with epoxy with quartz or metal dust to make ...
2
votes
0
answers
49
views
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following ...
1
vote
1
answer
40
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 73
1
vote
2
answers
133
views
Is it possible/feasible to decompile a program written in C++ to C?
I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know.
If it is possible, ...
- 21
0
votes
0
answers
68
views
Warframe Network Communication
Warframe is a MMO that has both servers and peer to peer networking, I am looking into the server side of things. What I am wanting to achieve is client communication to a emulated server.
So far I am ...
- 1
0
votes
2
answers
178
views
Reversing an obfuscation through a long linear switch statement
I have a program (ELF, 32 bits) that is probably quite short and simple, but which have been obfuscated with the following construction:
i = 0
switch(i):
case 0:
one small instruction
...
- 11
1
vote
1
answer
240
views
How to define "code" variable type in Ghidra
Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define ...
- 21
1
vote
1
answer
49
views
Can a MSVC class have a deletion destructor without a vftable?
I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays:
struct Referencable
{
int m_refs;
};
struct Buffer : Referencable
{
void* m_pData;
};
...
- 983
2
votes
1
answer
64
views
Identifying the logic in remote control data packets
I have a set of 4 power sockets that can be turned on and off with an RF remote.
That remote has 4 pairs of on/off buttons along with a master pair that can control all sockets at once.
Initially, the ...
- 41
0
votes
0
answers
27
views
Decoding a stream of bytes in audio form (Teenage Engineering OP-1 & PO-33)
I have a device that stores and transmits data using audio (Teenage Engineering's OP-1 and PO-33). I'm trying to figure out how I can turn it into a byte stream to try to decode it.
Below is an ...
- 1