All Questions

Filter by
Sorted by
Tagged with
2
votes
0answers
86 views

How to load symbols from Windows DBG file

I'm having trouble getting GHIDRA to load symbols for a Microsoft EXE from an accompanying DBG file. Perhaps I'm just overlooking some obvious documentation in which case a focussed link would be ...
0
votes
0answers
91 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
0
votes
0answers
41 views

Which API function is responsible for input strings?

I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
0
votes
0answers
59 views

What does mean cs:Memory on IDA pro? [duplicate]

I don't understand the meaning of cs: Memory. Please help me.
2
votes
2answers
138 views

In reverse engineering, what does it mean to “patch a file”?

I've been solving some crackmes, and every file that I download, in the "instructions" says: "Patching is obviously not allowed". What does that mean? And how does one patch a file?
3
votes
1answer
119 views

How does IPA decryption works?

All IPAs being downloaded from AppStore gets encrypted on servers as part of FairPlay DRM. But decryption is accomplished on local device. As far as I know there is some hardware module which contains ...
0
votes
0answers
15 views

IDA Pro break on system call to stat64

Upon running strace of an android x86 program I am debugging I notice a large section of stat64 like this: stat64("/data/data/com.topjohnwu.magisk/", 0xbfbf2ef4) = -1 ENOENT (No such file or ...
1
vote
1answer
66 views

Confusion about LEA and why it means what it does in this context

I am reading Eldad Eilam's reverse engineering book and trying to follow his RtlInitializeGenericTable example. The first part of it is fairly straightfoward- 7C921A39 MOV EDI,EDI 7C921A3B PUSH EBP ...
1
vote
0answers
42 views

How to find function called by instantaneous event (like mouse press for exemple)

I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me. I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
0
votes
0answers
69 views

How to defeat fake rdtsc driver?

This RSE thread and this one discuss effectiveness of RDTSC-based anti-debug methods, and also a way to possibly work-around (albeit using a fake driver method, which is complex). What is a counter-...
4
votes
0answers
67 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
1
vote
1answer
34 views

How to set search scope in radare2

Iam wondering how to change search scope in radare2. I`ve made some research and set variables search.from and search.to, according to Radare2 Book, but it doesn't work at all! Could you help me ...
0
votes
1answer
25 views

How can I iterate over syscalls (as returned with `axt`) and rewrite them?

Let's say I want to list all calls that issue kill, axt @ sym.imp.kill How can I now NOP out the syscall at all of the addresses given? I want to strip the program of calls to kill.
1
vote
1answer
61 views

How to get array size of a global variable using IDApython?

I can make an array using MakeArray. Is there a function to get the size of the array I've created? I've tried GetArrayId + GetLastIndex but it doesn't seem to work.
0
votes
1answer
63 views

IDA and flirt signatures

I have 2 binaries, with the same CPU architecture. I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it. I put the ...
0
votes
0answers
149 views

Reverse engineer CRC or checksum algorithm

I am trying to reverse engineer a checksum algorithm of car CAN bus data I tried to find with (CRC RevEng), but I can not find it how to calculate it I have captured communication can bus data. I ...
1
vote
1answer
54 views

Checksum field within IR protocol

I am trying to reverse engineer the IR protocol for my air conditioner (GREE - remote control YAP1FF) and with the data I found online and a lot of testing with a IR receiver there is only one field I ...
0
votes
1answer
212 views

decrypt config.bin file from Huawei B5328 router i have source files

Hello i need somehelp in decrypting the file config.bin generated by the page backup_setting.html from huawei B5328 router , i have access to all files in the router even the www files hosted on the ...
5
votes
4answers
160 views

What information may supply the uninitialized data to security team?

When I was reversing some well known Android chat applications (I can not disclose which specific ones, but all of them where owned by companies with 1 billion+ capital and have hundreds of millions ...
5
votes
1answer
180 views

Microsoft Edge and it's related processes may have turned protected in windows 10 1903

It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe). Looking into the problem, it ...
0
votes
0answers
36 views

edit binary (.bin) file

I'm translating a radio and I'm having some little problems. I have here a .bin file that contains an update for a radio. I would like to exchange a .elf file located in the .bin file and replace it ...
0
votes
0answers
59 views

IDA free : How to find a string reference in .text

To begin with, I'd like to point out that I'm very new to this. Here's the simple thing I'd like to do : The program I want to mess around with displays a msgbox with the string "Please run the ...
0
votes
1answer
152 views

How can I retrieve image files embedded/compressed in a MPL file?

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them. This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from ...
3
votes
1answer
103 views

Radare2 ptrace can not attach

First my setup: Linux Mint 64bit 4.15.0-20-generic radare2 the newest version from github /etc/sysctl.d/10-ptrace.conf = 0 Executable: ELF 64-bit LSB executable, x86-64 read write and ...
0
votes
0answers
134 views

Decrypting Lua Files from game

I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki). Links to files of game: libhellolua.so (cocos2dx external library) example encrypted LUA-scripts (*.abc files) I was reading a ...
0
votes
0answers
59 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
0answers
44 views

how can i Encrypt a decrypted zte zxhn h108n V2.5 config file?

i have decrypted the config file using a program i found online ( maybe made by python to exe ) so to decrypt using it you type is command into CMD decode_zte_config.exe config.bin config.bin.xml ...
0
votes
1answer
31 views

How do you get the operand data type using idapython?

I know I can set the operand data type of my disassembly using functions such as OpBinary, OpOctal,OpDecimal, etc. Now, I'm trying to get the current operand data type of my disassembly instead. For ...
0
votes
0answers
37 views

radare2 (v3.6.0) on windows(x64) not change registers values in debug mode

Whats wrong: d:\radare2\bin\radare2 -A -d d:\test.exe Spawned new process with pid 7192, tid = 8572 ... [0x014eb83c]> pd 5 ┌ (fcn) entry0 2066 │ entry0 (); │ bp: 0 (vars 0, args 0) │ sp: 0 (...
2
votes
1answer
162 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
1
vote
0answers
20 views

IDA losses renaming and functions border data when debugger starts: is there any workaround?

I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable. However, as soon as ...
1
vote
0answers
138 views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
4
votes
1answer
92 views

how to flash image.bin with uboot using serial or tftp

Hello I have a 4G LTE router which is blocked. I have access to its serial interface and I have already dumped the partitions before via telnet from another device of the same model. Here's the ...
0
votes
0answers
29 views

faster kernel debugging in IDA (not VMWARE)

I am debugging ESX server in kernel mode(windows). I use windbg debugging through COM PORT(eventually). Can I get VirtualKD to work in this scenario? Suspending IDA takes more than a few seconds(...
1
vote
0answers
104 views

Checksum Calculation

Can anyone manage to work out how the checksum is calculated in the following data? Have tried reverse engineering crc and xor and anything else I can think of. There is a definite pattern there, but ...
1
vote
0answers
19 views

.NET manifest resource format

Currently I'm writing a parser for .NET files and stuck on manifest resources. My main resources: Huge documentation Short summary For resource format I have found this project made in 2005, all ...
2
votes
1answer
75 views

Where is Android binary XML format documented?

This format is always trouble for reverse engeneering. When there are question about binary XML, the usual answer is "use apktool" (or something similar). However, no tool is perfect; actually all ...
3
votes
2answers
204 views

How to use the book “Reverse Engineering for Beginners” by Yurichev?

I just finished skimming the book Art of Assembly by Randall Hyde. So now to get my feet wet in assembly/reverse engineering reading, I started the book Reverse Engineering for Beginners. The thing ...
1
vote
1answer
66 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
0
votes
0answers
49 views

convert NPRG9x07.mbn to NPRG9x07.bin

Hello i have qualcomm based bootloader for mdm9x07 platform i want to convert to bin format but i did not find any script that does the conversion here are the mbn files : NPRG9x07.mbn2 ENPRG9x07....
1
vote
0answers
71 views

DLL obfuscator - what kind of obfuscator is this?

when I am looking for packet editor, I found open project on http://www.packeteditor.com/ when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE....
1
vote
1answer
118 views

How to extract firmware from a western digital hard drive with custom firmware

Hi all i got a western digital hard drive from a DVR which contains custom firmware so you will not be able to install any hard drive you want on the DVR device. (digital video recorder) something ...
0
votes
1answer
61 views

how can I know if PE file has appended data or not?

while doing this, I dont know the whole file size (pe size + appended data size) my PE file is embeded in othe pe file, so I dont know if it has appended data or not and also dont know its total size.
1
vote
2answers
113 views

ECU tune and reverse engineering

I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...
0
votes
1answer
103 views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
0
votes
0answers
40 views

How to execute an import exe/dll from memory

i dumped a exe/dll file from the memory with OllyDumpEx, now i understand i need to fix the address or something like this to use the dll or to run the exe, so how can i do that?
1
vote
0answers
41 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
0answers
39 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
0
votes
0answers
37 views

How to change operator by GDB?

How can I change je to jne via GDB tooL?
1
vote
1answer
184 views

unpacking Download.img firmware for alcatel mw40

Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...

15 30 50 per page