All Questions
9,424
questions
2
votes
1
answer
103
views
How to send HID commands over USB? Laird BT820 in HID-Proxy mode
I'm trying to get Bluetooth devices to work in HID-Proxy mode with a Laird BT820 dongle. According to their docs at http://cdn.lairdtech.com/home/brandworld/files/Application%20Note%20-%20BT800%...
- 31
1
vote
1
answer
55
views
Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)
"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
- 13
1
vote
0
answers
135
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
1
vote
0
answers
72
views
angr - project.loader.find_symbol("main") does not works
I have very simple C code - compiled on MSVC using clang++ compiler. When I am running it under angr environment - it simply does not finds main() function, while it can do so for other things like ...
- 121
1
vote
1
answer
45
views
Help wanted identifying 4x mimo cellular data antennas in HR-01 5G router
I would like to attach an external 4x mimo patch or yagi antenna to a sharp HR-01 5g home router.
https://www.docomo.ne.jp/home_5g/router/
I am relatively confident it is 4x mimo based on the ...
- 121
0
votes
1
answer
75
views
How to reverse a USB firmware patching tool for another device?
I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool.
It's my belief that this firmware patching tool should work ...
- 101
0
votes
0
answers
45
views
In the IDA xrefs window, can I filter by unique addresses? Or is there an alternative view providing that?
Consider the following screenshot:
Here, the r and p Type entries appear in pairs. We have ten entries, but five pairs.
Is there a way to filter this list down to unique Address values, rather than ...
- 10.9k
0
votes
0
answers
33
views
Teaching IDA to keep column width in xrefs window, or shortcut to quickly adjust them?
When invoking the function xrefs in IDA (8.2.230124), I can adjust the column widths and sorting or even the dialog size (here I adjusted only the width of the Address column):
IDA appears to ...
- 10.9k
1
vote
0
answers
31
views
Anyway to hook to change file content and return for application keep read it?
is there anyway to modify v2 before statement if(v2) happen?
- 11
2
votes
1
answer
152
views
How to map a decompiled c program back into original source code
I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update).
So is ...
- 39
1
vote
1
answer
188
views
Dumpbin show function names
Is there any way I can use dumpbin like objdump, where I can just look at the functions machine instructions that I implemented in my Source.c file, which I compiled to source.exe?
If I use dumpbin \...
- 115
1
vote
0
answers
42
views
Radare2: How to Create a Custom Scripted Panel?
TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script?
e.g. afvd | python var_displayer.py
This is my current view. Multiple panels, ...
- 11
0
votes
0
answers
33
views
Dynamically linked busibox won't work
I am hacking an ARM-based device that is coming with a lightweight busybox:
[/mnt/sdcard/busybox]## busybox
BusyBox v1.24.1 (2017-09-29 00:55:28 PDT) multi-call binary.
BusyBox is copyrighted by many ...
- 131
1
vote
0
answers
52
views
Fuzzing closed application
I want to get from you some advice about fuzzing.
I am checking a huge C application (not open source) which is also an HTTP server.
My purpose is to fuzz the HTTP server via the requests being sent ...
- 11
0
votes
1
answer
50
views
Should shell32.dll be in executable search path for winword.exe with WinDBG?
I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
1
vote
0
answers
17
views
what is Max operating temperature of TASSIMO Bosch My Way [closed]
Having read the articles regarding changes to barcodes on Tassimo Coffee Machines, I was wanting to know if the water temperature could be changed to a hotter setting if possible via the barcodes.
...
- 11
1
vote
0
answers
52
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
2
votes
0
answers
128
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 21
2
votes
0
answers
113
views
binwalk gives an endless list of files
I am running binwalk -B image.bin on an 8MB firmware that I dumped from an MStar MSC313e based ip camera. The binwalk output is longer than I would expect. Could they be mostly false positives?
I have ...
- 131
2
votes
1
answer
65
views
What is patched by LX 16:32 fixup record
In LX format description in section
3.13 Fixup Record Table, when describing SRC = DB Source type field there is such an option:
06h = 16:32 Pointer fixup (48-bits).
1. How many bytes does this fixup ...
- 185
2
votes
1
answer
82
views
other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?
atm I'm using ida and x32dbg, when I find a function that interests me, I set a breakpoint on x32dbg, however, I'm not good enough at assembly to know everything from a function just from looking at ...
- 23
3
votes
1
answer
259
views
How to reverse Engineer a Struct in IDA Pro?
How to identify and define a struct in IDA pro Decompiling during reverse engineering?
Please explain the easiest way to figure out the struct in IDA Pro decompilation!
To make life easier are there ...
2
votes
1
answer
101
views
What is the meaning of 32 bit offset in x86 16 bit jump
Consider x86 16 bit mode instruction:
$ echo 66 EA 66 55 44 33 22 11 | xxd -p -r | ndisasm -b16 -
00000000 66EA665544332211 jmp dword 0x1122:0x33445566
I thought 16 bit code jumps work by combining ...
- 185
1
vote
0
answers
158
views
How would one go about finding the key to this crackme (polynomial - childhood crackme)?
I'm trying to solve a crackme that contains a key check like so:
lVar4 = vulnerability1(passwd);
if (lVar4 == 0x260a4c7d7af23fc0) {
solve_check(1,0xffffffff);
free(passwd);
...
- 111
3
votes
0
answers
48
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
96
views
IDA Pro debugging an ARM binary on windows with QEMU
I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
- 31
3
votes
0
answers
106
views
What is the best emulator/environment for android debugging?
I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want.
There are fast emulators but they don't provide ...
- 51
3
votes
0
answers
55
views
How to unpack emotet with x64dbg and do dynamic analysis?
I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
- 31
3
votes
0
answers
104
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
2
votes
0
answers
52
views
i want to know how to tracing a exe's http responses and log them
I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
- 21
3
votes
1
answer
126
views
Are win32api calls differentiable from real actions?
I've been tinkering with the win32api library on Python and interacting with Notepad. I now want to try it on an online game to automate some boring tasks but I'm scared I get banned for this.
Is for ...
- 31
3
votes
1
answer
90
views
Is there a way to find all constant pointers in IDA Pro?
I would like to know all the constants used for memory access except for non-pointer constants (e.g. argument) in IDA Pro.
Is there such a way?
- 31
2
votes
0
answers
127
views
What could be the reason-s for a exe not to load after a Dnspy modification to a DLL
After modifying a method of a DLL with Dnspy, the related EXE won't start.
What could be the reason for it not starting?
Here's what I did:
I modified a method from a DLL with Dnspy using edit Method ...
- 121
4
votes
1
answer
342
views
What is 'standard' CRC-16?
The Linux source code has a routine for calculating CRC-16s. It's described as 'standard CRC-16', but doesn't have a formal name. It seems to be using a polynomial of 8005 but is otherwise undescribed....
- 255
2
votes
0
answers
49
views
Need help extracting AP_Pack .obb files
I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb.
Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
- 21
2
votes
1
answer
132
views
Use 3rd-party DLL in my own application
Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section.
Background
I'm ...
- 31
2
votes
1
answer
126
views
Identify mod operation in ARM firmware with IDA
I have the firmware in which mod operation must be done. I want to find this part of instructions.
Assume the following logic exist in the firmware:
res = var % 17
I have tried to make search by % ...
- 21
2
votes
0
answers
94
views
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
- 21
2
votes
0
answers
113
views
Help with reversing an application with x64dbg
I am a newbie to reverse engineering. I am trying to reverse engineer an app that uses some form of internet explorer frame kind of thing because I could see use of mshtml.dll and jscript9.dll and ...
- 31
2
votes
0
answers
47
views
Difference between __openat and openat (Android)
While reverse engineering an Android process, I wanted to explore the openat function. I noticed that there is a symbol "openat" and another symbol "__openat". What is the ...
- 193
2
votes
1
answer
176
views
Ghidra function pointer calling conventions
I'm reverse engineering some ColdFire MCF5206 (68K-like) code that makes heavy use of function pointers, e.g.:
000006e0 46 fc 27 00 move #0x2700,SR
000006e4 4f ef ff f0 ...
- 121
4
votes
1
answer
84
views
PE ImageBase presence in PDB
Is ImageBase of a PE binary present in its PDB or can it only be retrieved from the binary?
I have studied both Microsoft's PDB sources and LLVM docs without much luck finding it.
In the DBI stream ...
- 552
2
votes
1
answer
60
views
In Pintool, How to find the name of an routine's caller?
I want to trace the mutex variables in my rust program(e.g. which mutex called lock() and unlock() methods). And I think there're static methods.
- 21
3
votes
1
answer
124
views
How can you tell where an assembly function ends?
Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function.
But what about finding the end of a function? I realize tools ...
- 133
2
votes
0
answers
643
views
Please help identify which type of CPU architecture is used on obscure portable media players
I am trying to reverse engineer a media player with obscure SigmaTel SoCs just for fun but I didn't find very useful information.
As far as I don't know exactly what CPU architecture is used on these ...
- 21
2
votes
0
answers
103
views
Ghidra Strings and Global Renaming Issue
I am currently reverse engineering a piece of 16-bit software (originally written in C/C++ from what I can gather).
I have identified a function that seems to print text to the console. The text to be ...
- 165
2
votes
0
answers
72
views
IDA Pro Exports Table Corrupted!
I've been analyzing a dll file and naming the functions, structs, variables, and so on.
A lot of information has been changed and saved, but after the following message appears, the address column of ...
- 71
3
votes
1
answer
147
views
Load PDB for MemoryModule-loaded DLL in x64dbg
I need to debug a DLL, which I have a PDB file for.
The debug target is a program, that loads the DLL using MemoryModule library from Github.
The loaded module isn't listed as a module in x64dbg, ...
- 43
3
votes
1
answer
210
views
Reverse Engineer 16 Bit error checking byte calculation
Hello =) I am attempting to reverse engineer a communications protocol to some obsolete equipment. Communication happens on an RS485 line.
I have captured several exchanges and seem to have figured ...
- 151
2
votes
0
answers
47
views
Javascript: Compare Control Flow (to evade anti-debug and anti-tamper traps)
When reverse engineering obfuscated javascript, it may be protected by anti-tamper mechanisms.
I have a script which will work when run untouched, but cause a fatal javascript error when run in node ...
- 143