All Questions

Filter by
Sorted by
Tagged with
2 votes
1 answer
103 views

How to send HID commands over USB? Laird BT820 in HID-Proxy mode

I'm trying to get Bluetooth devices to work in HID-Proxy mode with a Laird BT820 dongle. According to their docs at http://cdn.lairdtech.com/home/brandworld/files/Application%20Note%20-%20BT800%...
Xiao's user avatar
  • 31
1 vote
1 answer
55 views

Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)

"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
user3654535's user avatar
1 vote
0 answers
135 views

Cyber Talent Basic Malware Reverse Engineering

I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find: I have tried with Ghidra but i keep getting wrong submissions for the challenge. Here is the exe ...
Sheddymax's user avatar
1 vote
0 answers
72 views

angr - project.loader.find_symbol("main") does not works

I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
ultimate cause's user avatar
1 vote
1 answer
45 views

Help wanted identifying 4x mimo cellular data antennas in HR-01 5G router

I would like to attach an external 4x mimo patch or yagi antenna to a sharp HR-01 5g home router. https://www.docomo.ne.jp/home_5g/router/ I am relatively confident it is 4x mimo based on the ...
Peter's user avatar
  • 121
0 votes
1 answer
75 views

How to reverse a USB firmware patching tool for another device?

I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool. It's my belief that this firmware patching tool should work ...
Geruta's user avatar
  • 101
0 votes
0 answers
45 views

In the IDA xrefs window, can I filter by unique addresses? Or is there an alternative view providing that?

Consider the following screenshot: Here, the r and p Type entries appear in pairs. We have ten entries, but five pairs. Is there a way to filter this list down to unique Address values, rather than ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
33 views

Teaching IDA to keep column width in xrefs window, or shortcut to quickly adjust them?

When invoking the function xrefs in IDA (8.2.230124), I can adjust the column widths and sorting or even the dialog size (here I adjusted only the width of the Address column): IDA appears to ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
31 views

Anyway to hook to change file content and return for application keep read it?

is there anyway to modify v2 before statement if(v2) happen?
user3082026's user avatar
2 votes
1 answer
152 views

How to map a decompiled c program back into original source code

I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update). So is ...
user3368585's user avatar
1 vote
1 answer
188 views

Dumpbin show function names

Is there any way I can use dumpbin like objdump, where I can just look at the functions machine instructions that I implemented in my Source.c file, which I compiled to source.exe? If I use dumpbin \...
killertoge's user avatar
1 vote
0 answers
42 views

Radare2: How to Create a Custom Scripted Panel?

TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script? e.g. afvd | python var_displayer.py This is my current view. Multiple panels, ...
Khalid's user avatar
  • 11
0 votes
0 answers
33 views

Dynamically linked busibox won't work

I am hacking an ARM-based device that is coming with a lightweight busybox: [/mnt/sdcard/busybox]## busybox BusyBox v1.24.1 (2017-09-29 00:55:28 PDT) multi-call binary. BusyBox is copyrighted by many ...
dotvav's user avatar
  • 131
1 vote
0 answers
52 views

Fuzzing closed application

I want to get from you some advice about fuzzing. I am checking a huge C application (not open source) which is also an HTTP server. My purpose is to fuzz the HTTP server via the requests being sent ...
flapz18716's user avatar
0 votes
1 answer
50 views

Should shell32.dll be in executable search path for winword.exe with WinDBG?

I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
Invulnerable Immortal's user avatar
1 vote
0 answers
17 views

what is Max operating temperature of TASSIMO Bosch My Way [closed]

Having read the articles regarding changes to barcodes on Tassimo Coffee Machines, I was wanting to know if the water temperature could be changed to a hotter setting if possible via the barcodes. ...
Ivor Mac's user avatar
1 vote
0 answers
52 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
2 votes
0 answers
128 views

ZTE F670 V1.1.10P3T21 encrypted config.bin

I want to decrypt config.bin For this I found in cspd following code undefined4 CspDBInitPdtInterface(undefined4 *param_1) { dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml"); ...
Elec Art's user avatar
2 votes
0 answers
113 views

binwalk gives an endless list of files

I am running binwalk -B image.bin on an 8MB firmware that I dumped from an MStar MSC313e based ip camera. The binwalk output is longer than I would expect. Could they be mostly false positives? I have ...
dotvav's user avatar
  • 131
2 votes
1 answer
65 views

What is patched by LX 16:32 fixup record

In LX format description in section 3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option: 06h = 16:32 Pointer fixup (48-bits). 1. How many bytes does this fixup ...
Uprooted's user avatar
  • 185
2 votes
1 answer
82 views

other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?

atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
felipebubu's user avatar
3 votes
1 answer
259 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
2 votes
1 answer
101 views

What is the meaning of 32 bit offset in x86 16 bit jump

Consider x86 16 bit mode instruction: $ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 - 00000000 66EA665544332211 jmp dword 0x1122:0x33445566 I thought 16 bit code jumps work by combining ...
Uprooted's user avatar
  • 185
1 vote
0 answers
158 views

How would one go about finding the key to this crackme (polynomial - childhood crackme)?

I'm trying to solve a crackme that contains a key check like so: lVar4 = vulnerability1(passwd); if (lVar4 == 0x260a4c7d7af23fc0) { solve_check(1,0xffffffff); free(passwd); ...
efel's user avatar
  • 111
3 votes
0 answers
48 views

How can I create an `__m128i` datatype with Frida?

I'm working on reversing a c++ binary and it has a function that I want to call with Frida. Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1); It doesn't seem ...
Myles Hollowed's user avatar
3 votes
0 answers
96 views

IDA Pro debugging an ARM binary on windows with QEMU

I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
Slava's user avatar
  • 31
3 votes
0 answers
106 views

What is the best emulator/environment for android debugging?

I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want. There are fast emulators but they don't provide ...
shetal's user avatar
  • 51
3 votes
0 answers
55 views

How to unpack emotet with x64dbg and do dynamic analysis?

I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
KOT's user avatar
  • 31
3 votes
0 answers
104 views

IDA ATL C++ class reconstruction

I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
short dragon's user avatar
2 votes
0 answers
52 views

i want to know how to tracing a exe's http responses and log them

I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
od8m's user avatar
  • 21
3 votes
1 answer
126 views

Are win32api calls differentiable from real actions?

I've been tinkering with the win32api library on Python and interacting with Notepad. I now want to try it on an online game to automate some boring tasks but I'm scared I get banned for this. Is for ...
Mostunique's user avatar
3 votes
1 answer
90 views

Is there a way to find all constant pointers in IDA Pro?

I would like to know all the constants used for memory access except for non-pointer constants (e.g. argument) in IDA Pro. Is there such a way?
user212942's user avatar
2 votes
0 answers
127 views

What could be the reason-s for a exe not to load after a Dnspy modification to a DLL

After modifying a method of a DLL with Dnspy, the related EXE won't start. What could be the reason for it not starting? Here's what I did: I modified a method from a DLL with Dnspy using edit Method ...
Lod's user avatar
  • 121
4 votes
1 answer
342 views

What is 'standard' CRC-16?

The Linux source code has a routine for calculating CRC-16s. It's described as 'standard CRC-16', but doesn't have a formal name. It seems to be using a polynomial of 8005 but is otherwise undescribed....
David Given's user avatar
2 votes
0 answers
49 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
2 votes
1 answer
132 views

Use 3rd-party DLL in my own application

Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section. Background I'm ...
Chris's user avatar
  • 31
2 votes
1 answer
126 views

Identify mod operation in ARM firmware with IDA

I have the firmware in which mod operation must be done. I want to find this part of instructions. Assume the following logic exist in the firmware: res = var % 17 I have tried to make search by % ...
ALEX's user avatar
  • 21
2 votes
0 answers
94 views

Booting a Linux kernel ARM64 boot executable Image

I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
Mario9987's user avatar
2 votes
0 answers
113 views

Help with reversing an application with x64dbg

I am a newbie to reverse engineering. I am trying to reverse engineer an app that uses some form of internet explorer frame kind of thing because I could see use of mshtml.dll and jscript9.dll and ...
Madhur's user avatar
  • 31
2 votes
0 answers
47 views

Difference between __openat and openat (Android)

While reverse engineering an Android process, I wanted to explore the openat function. I noticed that there is a symbol "openat" and another symbol "__openat". What is the ...
localacct's user avatar
  • 193
2 votes
1 answer
176 views

Ghidra function pointer calling conventions

I'm reverse engineering some ColdFire MCF5206 (68K-like) code that makes heavy use of function pointers, e.g.: 000006e0 46 fc 27 00 move #0x2700,SR 000006e4 4f ef ff f0 ...
Alnitak's user avatar
  • 121
4 votes
1 answer
84 views

PE ImageBase presence in PDB

Is ImageBase of a PE binary present in its PDB or can it only be retrieved from the binary? I have studied both Microsoft's PDB sources and LLVM docs without much luck finding it. In the DBI stream ...
mimak's user avatar
  • 552
2 votes
1 answer
60 views

In Pintool, How to find the name of an routine's caller?

I want to trace the mutex variables in my rust program(e.g. which mutex called lock() and unlock() methods). And I think there're static methods.
roo jack's user avatar
3 votes
1 answer
124 views

How can you tell where an assembly function ends?

Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function. But what about finding the end of a function? I realize tools ...
Alex Shroyer's user avatar
2 votes
0 answers
643 views

Please help identify which type of CPU architecture is used on obscure portable media players

I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information. As far as I don't know exactly what CPU architecture is used on these ...
Andy's user avatar
  • 21
2 votes
0 answers
103 views

Ghidra Strings and Global Renaming Issue

I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather). I have identified a function that seems to print text to the console. The text to be ...
jttri777's user avatar
  • 165
2 votes
0 answers
72 views

IDA Pro Exports Table Corrupted!

I've been analyzing a dll file and naming the functions, structs, variables, and so on. A lot of information has been changed and saved, but after the following message appears, the address column of ...
short dragon's user avatar
3 votes
1 answer
147 views

Load PDB for MemoryModule-loaded DLL in x64dbg

I need to debug a DLL, which I have a PDB file for. The debug target is a program, that loads the DLL using MemoryModule library from Github. The loaded module isn't listed as a module in x64dbg, ...
Ri0ee's user avatar
  • 43
3 votes
1 answer
210 views

Reverse Engineer 16 Bit error checking byte calculation

Hello =) I am attempting to reverse engineer a communications protocol to some obsolete equipment. Communication happens on an RS485 line. I have captured several exchanges and seem to have figured ...
Pau Coma Ramirez's user avatar
2 votes
0 answers
47 views

Javascript: Compare Control Flow (to evade anti-debug and anti-tamper traps)

When reverse engineering obfuscated javascript, it may be protected by anti-tamper mechanisms. I have a script which will work when run untouched, but cause a fatal javascript error when run in node ...
Semnodime's user avatar
  • 143

15 30 50 per page
1
3 4
5
6 7
189