All Questions

I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object. Any idea why is it so? 4: kd> !process 0 0 notepad.exe ...

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type? Correction for my screenshot above for using the EPROCESS address to ...

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...

IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this public static String v = sUQWWyTBEs().toString().substring(32,...

Let's say I make a std::map in C++, and ADDR is their address in memory. When I look at this place in memory I will find a pointer and in ADDR + 4 will be the amount of elements in the container. Now, ...

I've been trying to solve a crackme challenge by examining it's decompiled version by Ghidra. So I figured the code where the strcmp is done as shown in the figure below. Now I need to to patch the ...

I copy image files here from a linux based system which ends with .bin. Unfortunately I don't know how to open it. The goal is to convert images to this format later. What I have already tried: Open ...

I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part: --- This ...

#include <stdio.h> #include <stdlib.h> int main(int argc, int *argv[]) { size_t *p = (size_t *) strtol(argv[1], NULL, 16); p[0] = 0xDEADBEEF; printf("RELRO: %p\n", p); return ...

I've been trying to debug a binary file in radare2 but it throws me this error. $ r2 -d bin Killing child process 1688 due to an error Killing child process 1689 due to an error [...

Good day. I have these character codes in a binary file (Adobe After Effects Project) that represent a string. If I change them the text inside the application changes. However, for the life of me, I ...

I have an old CDMA dongle lying around, so I thought to try to reverse engineer them, but am unable to figure out the UART or JTAG pins, I have attached a photo of the probable pins, can anyone help ...

In short, I have a code that gets an input via stdin. Once it has the input string in memory, it verifies its integrity by calling a function for every condition, and exiting the program if those ...

How to access "Registered Addons" page in IDA?

How to make ghidra display the actual offset from rbp in assembly? For the same program, ghidra shows mov dword [rbp + local_c], edi I want to see the actual offset from rbp instead of local_c In ...

So here's my situation. I have an After Effects Project file. Inside this project, there's a text layer. Let's say the text layer says "Faster Pussycat! Kill! Kill!" and the name of the text ...

Now of course I keep trying to change it but once I get to the end of patching it says its invalid and wont let me change it. So if you have a way to do that let me know.

I am testing a dll file , in a C# console app , and by the looks of it the dll file sends a web request with encrypted and then encoded values to a remote server. after intercepting and analyzing the ...

I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings. I've disassembled the firmware using ida pro, but I couldn't find the entry ...

I am looking at some code that has jmp $+5 instruction at the beginning of the entry code in a library, right after pushing registers to the stack. I understand that jmp $+5 puts IP at the next ...

I've tried every possible combination of the markings of the chip but I can't seem to find anything on Google. I think the chip is 96TI 35R but apart from that I can't find anything. It's like the ...

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...

We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu. Also can .efi files ...

I have an assignment and i tried solving it. However i can't seem to solve it, despite double checking everything and investing multiple hours. My task is to reverse engineer the following functions ...

I hope someone can help me out with my problem. Currently I'm working with C# and use the library Mono.Cecil to add Instruction Code before a method exits. There is this one case, when a if statement ...

I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?): I'm trying to kernel debug a physical Macbook pro device. When my setup ...

I am very new reverse engineering, and have the below mentioned tasks to achieve on a open source program called Apache Ant. What (preferably free) tools can be appropriate to achieve these. I have ...

I bought a game, "They are billions", and I'm trying to edit a savegame on my singleplayer campaign to change some vars (cheating because im very bad player). But the file is a password ...

I have two versions of an app: one version compiled for ARM64 iOS, and the other for ARM32 Android. I'm working on the ARM64 version, but it has almost all of its symbols stripped. The ARM32 version ...

How can I Deobfuscate this python code Link to code I tried to replace eval places by print. but it won't work and output is also obfuscated Head of the code looks like this can anyone please help me

The software sends to the main server such string: \x1f\xe2\x80\xb9\x08\x00\x00\x00\x00\x00\x04\x00E...\x03\x00\x00" decode_gzip(body) Later I've tried to decode it through different online ...

While disassembling a mips binary, IDA Pro attempts to disassemble into mips 16 mode, even though It's mips 32 ISA. Below is that code snippet. .text:XXXXXXXX .set nomips16 # <= ?? .text:...

I need an assembly to C decompiler, I tried this one https://onlinedisassembler.com/odaweb/ but my code looks like this: #include <p16F887.inc> cblock 0x20 Delay1 ; Assign an ...

I have some files that compiled with nuitka. formats are .bin. I could get shell access to running process with pyrasite same as this guide. but I cannot decompile function codes or anything else, and ...

When disassembling dll or exe files in radare2, I sometimes encounter function calls via ordinals (call sub. mfc140u.dll_Ordinal_2246). As I understand it, the problem is that there is no pdb file for ...

I added read/write trace to a program. I was able to record the trace with IDA for the first time. When I run it again, it didn't work. I tried to do what I did on the first time, adding the read/...

I am debugging a program that I compiled. This program calls SetWindowTextW. When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there: If I will load ...

I know how to list all the processes in the system by running: 0: kd>dx -r1 Debugger.Sessions[0].Processes OR 0: kd>.tlist But how can I search for a process by name? I tried to use the ...

I'm targeting a program that tries to open a file in /sys that doesn't exist. Is there a way to create that file so the program continues? (Normally you can't create flies in sysfs.)

I'm trying to decode some IR data. I have some basic information about this data, but I don't know how to decode it. Though this is technically an IR/Android related problem, I think I can generify it ...

I have a WinForm project in C++. I attached a kernel debugger to my VMware machine. I set a breakpoint on the kernel and switched context to my application: 0: kd> !process 0 0 WindowsProject1.exe ...

I'm trying to figure out the format/encoding for this: ...

i have snippet code that i want to convert to python to understand the types that ghidra use such *(byte *) and *(code *) and *(uchar *) etc.. the first code: void one(int param_1,int param_2) { int ...

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...

.rdata:00414704 __real@c0800000 dd 0C0800000h How to convert this value 0C0800000h to float point number?

I am trying to reverse engineering the Run Length Encoding that the Trotec Laser uses to engrave bitmap images. Does the following encoding correspond to a known schem? Each line is form a different ...

There is an implant in me, is there a way to identify the frequency it is receiving signals on? I don't want to share the evidence and my reasoning for believing there is an implant in me, you can ...