All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
49 views

Why is process object is shown as desktop object in nt!_object_type

I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object. Any idea why is it so? 4: kd> !process 0 0 notepad.exe ...
0
votes
0answers
133 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
2
votes
1answer
36 views

Why some process has empty nt!_object_type

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type? Correction for my screenshot above for using the EPROCESS address to ...
2
votes
0answers
67 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
1
vote
1answer
69 views

Is there a way to attach x86dbg with ida pro?

IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?
0
votes
0answers
35 views

what do these assembly codes doing? [duplicate]

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
-1
votes
1answer
101 views

what do these assembly code doing?

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...
3
votes
1answer
81 views

Trying to identify a Binary-Search-Tree structure

Let's say I make a std::map in C++, and ADDR is their address in memory. When I look at this place in memory I will find a pointer and in ADDR + 4 will be the amount of elements in the container. Now, ...
1
vote
0answers
106 views

Getting value of local variable in Ghidra

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...
0
votes
2answers
123 views

Open unknown image format (probably a RAW image)

I copy image files here from a linux based system which ends with .bin. Unfortunately I don't know how to open it. The goal is to convert images to this format later. What I have already tried: Open ...
0
votes
0answers
83 views

Decompiling exe to python source code

I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part: --- This ...
1
vote
1answer
151 views

How to disable relro while compilation?

#include <stdio.h> #include <stdlib.h> int main(int argc, int *argv[]) { size_t *p = (size_t *) strtol(argv[1], NULL, 16); p[0] = 0xDEADBEEF; printf("RELRO: %p\n", p); return ...
1
vote
0answers
78 views

radare2 unable to run a binary file

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...
0
votes
1answer
72 views

What character codes could these be?

Good day. I have these character codes in a binary file (Adobe After Effects Project) that represent a string. If I change them the text inside the application changes. However, for the life of me, I ...
3
votes
0answers
31 views

Help required to figure out the JTAG or UART pins

I have an old CDMA dongle lying around, so I thought to try to reverse engineer them, but am unable to figure out the UART or JTAG pins, I have attached a photo of the probable pins, can anyone help ...
0
votes
1answer
86 views

How to get the input necessary to get to the end

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...
1
vote
1answer
38 views

How to access “Registered Addons” page in IDA?

How to access "Registered Addons" page in IDA?
2
votes
1answer
202 views

How to make ghidra display the real offset from rbp

How to make ghidra display the actual offset from rbp in assembly? For the same program, ghidra shows mov dword [rbp + local_c], edi I want to see the actual offset from rbp instead of local_c In ...
0
votes
0answers
11 views

Changing the strings relating to text layers inside an AEP file, only the name of the layer changes

So here's my situation. I have an After Effects Project file. Inside this project, there's a text layer. Let's say the text layer says "Faster Pussycat! Kill! Kill!" and the name of the text ...
-1
votes
1answer
88 views

Why is is ghidra representing mips move instruction as _or?

Now of course I keep trying to change it but once I get to the end of patching it says its invalid and wont let me change it. So if you have a way to do that let me know.
1
vote
0answers
55 views

where can i find decryption key inside of the dll file?

I am testing a dll file , in a C# console app , and by the looks of it the dll file sends a web request with encrypted and then encoded values to a remote server. after intercepting and analyzing the ...
3
votes
2answers
96 views

Find the entry point in Interrupt Vector Table ARM9

I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings. I've disassembled the firmware using ida pro, but I couldn't find the entry ...
1
vote
1answer
142 views

jmp $+5, why the jump

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...
2
votes
0answers
46 views

Help with identifying 10pin chip

I've tried every possible combination of the markings of the chip but I can't seem to find anything on Google. I think the chip is 96TI 35R but apart from that I can't find anything. It's like the ...
2
votes
0answers
38 views

Cant hook into native lib with script?

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...
1
vote
1answer
83 views

Run ntoskrnl.exe with qemu

We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu. Also can .efi files ...
1
vote
1answer
95 views

Can the return value of this function be determined with static analysis?

I have an assignment and i tried solving it. However i can't seem to solve it, despite double checking everything and investing multiple hours. My task is to reverse engineer the following functions ...
1
vote
0answers
57 views

How to add Instructions (OpCodes) after a If Statement in C#?

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...
1
vote
1answer
34 views

Kernel debug two physical MacBook pro devices

I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?): I'm trying to kernel debug a physical Macbook pro device. When my setup ...
1
vote
0answers
71 views

What tools can be appropriate to reverse engineer a (open-source) java program?

I am very new reverse engineering, and have the below mentioned tasks to achieve on a open source program called Apache Ant. What (preferably free) tools can be appropriate to achieve these. I have ...
0
votes
2answers
112 views

Get Zip password used by application

I bought a game, "They are billions", and I'm trying to edit a savegame on my singleplayer campaign to change some vars (cheating because im very bad player). But the file is a password ...
1
vote
2answers
50 views

(Partial?) Automation of transferring symbol names between architectures

I have two versions of an app: one version compiled for ARM64 iOS, and the other for ARM32 Android. I'm working on the ARM64 version, but it has almost all of its symbols stripped. The ARM32 version ...
0
votes
1answer
77 views

How can I reverse this python code (obfuscated by b64, gzip and many more)

How can I Deobfuscate this python code Link to code I tried to replace eval places by print. but it won't work and output is also obfuscated Head of the code looks like this can anyone please help me
0
votes
0answers
91 views

Help me please decode the string (looks like gzip but it is not)

The software sends to the main server such string: \x1f\xe2\x80\xb9\x08\x00\x00\x00\x00\x00\x04\x00E...\x03\x00\x00" decode_gzip(body) Later I've tried to decode it through different online ...
1
vote
1answer
67 views

IDA Pro, How to forcefully disassemble “mips 32” instead of “mips 16”?

While disassembling a mips binary, IDA Pro attempts to disassemble into mips 16 mode, even though It's mips 32 ISA. Below is that code snippet. .text:XXXXXXXX .set nomips16 # <= ?? .text:...
0
votes
0answers
57 views

Assembly to C decompiler

I need an assembly to C decompiler, I tried this one https://onlinedisassembler.com/odaweb/ but my code looks like this: #include <p16F887.inc> cblock 0x20 Delay1 ; Assign an ...
2
votes
0answers
129 views

How to decompile python ELF file (Compiled with Nuitka)?

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...
0
votes
0answers
30 views

Function name from Ordinal number in Radare2

When disassembling dll or exe files in radare2, I sometimes encounter function calls via ordinals (call sub. mfc140u.dll_Ordinal_2246). As I understand it, the problem is that there is no pdb file for ...
0
votes
1answer
25 views

Can't add tracing in IDA, showing it in gray

I added read/write trace to a program. I was able to record the trace with IDA for the first time. When I run it again, it didn't work. I tried to do what I did on the first time, adding the read/...
1
vote
1answer
59 views

How to load modules symbols to IDA while debugging a process

I am debugging a program that I compiled. This program calls SetWindowTextW. When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there: If I will load ...
1
vote
2answers
44 views

How to search for process by name with WinDBG

I know how to list all the processes in the system by running: 0: kd>dx -r1 Debugger.Sessions[0].Processes OR 0: kd>.tlist But how can I search for a process by name? I tried to use the ...
1
vote
1answer
30 views

Create Fake Entry in sysfs

I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)
0
votes
0answers
25 views

Decoding serialization of raw data

I'm trying to decode some IR data. I have some basic information about this data, but I don't know how to decode it. Though this is technically an IR/Android related problem, I think I can generify it ...
0
votes
1answer
29 views

Can't resolve a function from a process module (user32.dll): “Couldn't resolve error at '<module>!<function>'”

I have a WinForm project in C++. I attached a kernel debugger to my VMware machine. I set a breakpoint on the kernel and switched context to my application: 0: kd> !process 0 0 WindowsProject1.exe ...
1
vote
1answer
509 views

Reversing encoding of a RSA public key

I'm trying to figure out the format/encoding for this: ...
0
votes
2answers
124 views

convert code to python

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...
4
votes
0answers
207 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
2
votes
2answers
341 views

How to convert to float

.rdata:00414704 __real@c0800000 dd 0C0800000h How to convert this value 0C0800000h to float point number?
0
votes
0answers
14 views

Trotec Speedy 300 - Laser Run Length Encoding

I am trying to reverse engineering the Run Length Encoding that the Trotec Laser uses to engrave bitmap images. Does the following encoding correspond to a known schem? Each line is form a different ...
2
votes
0answers
110 views

There is an implant in me, is there a way to identify the frequency it is receiving signals on?

There is an implant in me, is there a way to identify the frequency it is receiving signals on? I don't want to share the evidence and my reasoning for believing there is an implant in me, you can ...

15 30 50 per page
1
3 4
5
6 7
164