All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
92 views

Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile

I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows DECIMAL HEXADECIMAL ...
0
votes
1answer
145 views

IDA analysing a PE file now for 7 days+

So i am pretty new to IDA (64bit) / reverse engineering and i got a few questions. Currently i have IDA pro 7.5 on Windows 10. First question: I am currently analysing a dumped (bypassed the anti ...
1
vote
0answers
149 views

Repacking vmlinux into zImage/bzimage

While RE an embedded device I ran into a problem - I need to patch a check in the kernel which has no sources available. Unpacking the kernel and binary-patching went smoothly. However I cannot get ...
2
votes
2answers
124 views

How can I decrypte the data in this SQLite Database file

I have this SQLite Database file https://we.tl/t-RwKqYyS3D7 When I open it in notepad++, I got some decoded strings. I was trying to clean it and show only the strings without the symboles but then I ...
0
votes
0answers
34 views

extract file from a compiled java exe

I've an exe compiled with nexe and I want to extract file . I can see all the source code with a Hexviewer but it is a shame to extract each file. I've extract 95% of the source code but I miss some ...
1
vote
0answers
89 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
-1
votes
1answer
98 views

How to see the function definition of a function pointer in Ghidra

i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way: iVar = (*DAT)(param_2, PTR_s) When i press on *DAT i see ...
1
vote
1answer
66 views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
0
votes
1answer
63 views

Retrieve user data as if it were the game making the request

Don't think the title really summed it up but here goes. There's a game built in Unreal Engine 4 that displays your (and other users) in-game statistics e.g a leaderboards page. I can determine some ...
0
votes
0answers
81 views

Is this native code possible for further static analysis?

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function ...
0
votes
0answers
31 views

modifying specific binary file

I have binary packed file likely containing a series of if/then action statements if decoded and unpacked to modify. I know what to seek for within the file, I need assistance in unpacking, ...
1
vote
2answers
267 views

How to decompile external functions of *.so library in ELF with Ghidra?

There are some *.so libraries in my ELF file. I can see the *.so names in "Imports" directory of "Symbol Tree" Window in Ghidra tool. I think there are some external functions in ...
0
votes
1answer
51 views

Java says "ghidra" is unknown protocol when creating project on linux

Update: I installed Eclipse and PyDev in Linux and my code works now. This confirms it was an issue setting up the Python/Jython paths. I would still like to know how to import ghidra.jar into jython ...
2
votes
1answer
265 views

How can I find an external function code correctly in Ghidra and Radare2?

This is a code to call an external function(get_random_name) in the main function push {fp, lr} add fp, sp, 4 sub sp, sp, 0x1d8 str r0, [fp, -0x1d8] str r1, [fp, -0x1dc] sub r3, fp, 0x44 ...
0
votes
0answers
71 views

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
2
votes
1answer
63 views

Ghidra throws error when creating DWARFProgram

I am trying to create a DWARFProgram for a Ghidra program. I would like to extract the function debug symbols. I get an error when constructing the DWARFProgram. The constructor prints the following ...
0
votes
1answer
62 views

An incomprehensible line in the output from hex rays

v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1); Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
3
votes
1answer
58 views

alignment in Ghidra and IDA

I see in my IDA it does automatically "align 10" after the end of a fucntion. I wanted to know how to make the same in Ghidra manually like IDA does. Thanks
1
vote
1answer
72 views

IDA 7.5 Show the Progress from Auto Analysis?

Is it possible to create a box / bar in IDA wich indicates the progress?
1
vote
1answer
73 views

How to get thread start address in Windows?

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API. ...
1
vote
0answers
31 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
1
vote
0answers
42 views

RE on firmware images that seem to use weak encryption/obfuscation. Robot vacuum

I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are ...
0
votes
2answers
67 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
1
vote
0answers
36 views

process crash handler in Frida

I'm trying to debug a crash in some process in iOS frida-trace allows me to add handlers to specific functions, but I'd like to install a handler that prints the stack trace when the process crashes. ...
0
votes
0answers
44 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
0
votes
0answers
63 views

What are "covrage and "codesz" in radare2?

[0x00009124]> a fcns 0 xrefs 0 calls 0 strings 126 symbols 74 imports 27 covrage 347 codesz 27543 percent 8% Sorry, this is a newbie question, but what are covrage and codesz? How can I ...
2
votes
0answers
36 views

How to find and read specific value in memory of running wine application?

How can I find and read specific values in memory of running WINE application? I am experimenting with text editors, writing some string and trying to find it in the heap memory and changing it using ...
1
vote
0answers
37 views

How to find how a hash in generated in an iOS app

I'm currently working on an iOS app to replicate a signature which looks to be generated with a MD5 hash. I'm currently using Frida, but haven't had any luck replicating it. I've used the script to ...
1
vote
2answers
151 views

How to reverse engineering ARM architecture ELF file on AMD linux?

I am reversing an ELF file, it's ARM architecture file. But my OS is AMD linux. How can I do reversing work for the ARM ELF file on AMD linux?
0
votes
2answers
91 views

Is it possible to reverse CGI binary file?

I wanna reverse CGI binary file. Is it possible? What are the recommended tools and guides? Thank you for reading my question. $ file test.cgi status.cgi: ELF 32-bit LSB executable, ARM, EABI5 ...
0
votes
0answers
18 views

CALC Branch to some address in ARM64

~STP X20, X19, [SP,#-0x10+var_10]! 0000000101BF9530 STP X29, X30, [SP,#0x10+var_s0] 0000000101BF9534 ADD X29, SP, #0x10 ...
0
votes
0answers
23 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
0
votes
0answers
163 views

Reversing PYARMOR (?)

I have already decompiled an .exe file and reached to a .py but it is obfuscated using PyArmor. I have already used ''https://github.com/nlscc/unpyarmor'' to try it, but could not figure it out how to ...
6
votes
1answer
376 views

HackRF One - Replay Attack on Garage Door does not work (12 DIP switches)

TL;DR solution Setting 4MHz sample rate and 2Mhz bandwidth in the capture tab (according to the Nyquist theorem the sample rate has to be double the bandwidth) Using the length of a DIP switch ...
0
votes
0answers
36 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
2
votes
0answers
35 views

Help with working out a checksum

I'm trying to work out how to reverse engineer the checksum on infrared remote data stream for a heat pump. I've established that it's not a CRC, and I've tried methods found on this forum. It doesn'...
3
votes
1answer
78 views

Printing all strings in a Ghidra project with python

I got the string objects from a Ghidra project using this code: l = list() def callback(s): l.append(s) ss = StringSearcher(currentProgram, 5, 1, False, True) ss.search(None, callback, True, ...
1
vote
0answers
47 views

Reverse Engineering SNES adapter

A good "Hello world" for everybody here I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4... The thing is, this CLV-202 ...
-1
votes
3answers
128 views

How to reverse *.pkg file? This is a firmware file of a router

I am a newbi for reversing engineering. I am going to reversing a firmware file. (*.pkg) I could find many tutorials for reversing *.bin, but I can't find any tutorials for reversing *.pkg file. And I ...
-1
votes
1answer
97 views

How to understand the result of disassembling IDA Pro (dll x86_64)

I'm studying the dll that was built for x86_64. I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me ...
0
votes
1answer
72 views

Understanding the basics of Reverse Engineering a segment of code

Currently trying to understand the following code and what it is doing. mov eax, 1 test eax, eax jz loc_411503 mov esi, esp call ds:_kbhit cmp esi, esp call sub_411159 test ...
2
votes
1answer
49 views

Reversing uboot on an aarch64 Hi3559AV target problems

I am trying to reverse uboot for an ARM aarch64 Hi3559AV target. I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
1
vote
0answers
43 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
1
vote
1answer
67 views

Identifying/debugging code parts responsible for features in Windows

New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu. What are some generic ways of identifying the ...
0
votes
0answers
44 views

I want to write some mods for doom eternal

Regarding doom eternal (steam) I want weapon swapping to be faster, but there are no mods for that currently available. What do I need to do to get to see doom eternals files? I can probably minifi ...
1
vote
1answer
52 views

Why is process object is shown as desktop object in nt!_object_type

I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object. Any idea why is it so? 4: kd> !process 0 0 notepad.exe ...
0
votes
0answers
134 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
2
votes
1answer
36 views

Why some process has empty nt!_object_type

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type? Correction for my screenshot above for using the EPROCESS address to ...
2
votes
0answers
69 views

How can I extract working files (in the form of graphics) from these MZP executables?

There's a 1999 PC/Mac game that I'm hoping to extract assets from. All game data appears to be stored in various files with the extension .rsc. I've been able to extract all the game's audio from the ...
1
vote
1answer
72 views

Is there a way to attach x86dbg with ida pro?

IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?

15 30 50 per page
1
4 5
6
7 8
165