All Questions
9,139
questions
0
votes
0
answers
5
views
How we capture serial data on wirshark
I have capture this data but I am not understanding this data
- 1
1
vote
0
answers
16
views
How can I make the C compiler emit a jump inside of a loop for a continue?
I am trying to recreate the C code from the following 16bit 8086 assembly that came from the MS C 5.1 compiler under DOS:
0100 mov timerCounter, 0
0105 waitForKey:
0105 ...
- 111
1
vote
0
answers
21
views
How to encode file lua and resource files
I am trying to decrypt luas files it use cocos2dx but its encrypted maybe aes encryption.
With frida i can extract most lua files but not all.
And with ida64 i cant find the key.
- 11
1
vote
0
answers
46
views
Calculate a 3 byte checksum in configuration file
I have 3 different encrypted configuration files.
The first line of the files are always the same (M1.28...).
Following lines are as follow for exmaple:
1N].1f01f ("1N]" is the checksum for ...
1
vote
0
answers
60
views
What is the ELF .got section used for?
I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.
When the program tries to call an imported function which is lazy binded, it ...
- 11
1
vote
1
answer
43
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
1
vote
0
answers
30
views
2
votes
0
answers
28
views
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
- 21
1
vote
0
answers
20
views
Santander US - app
I am trying to see the requests of santander us app, but the app in the emulator crashes on open, crashes when using frida, and crashes when I recompile it using apk tool. I also used uber apk signer. ...
0
votes
0
answers
25
views
How do I install an .xpi file on Firefox Android?
I want to use Google's "Translate Page" function on Firefox.
- 109
2
votes
0
answers
38
views
Decoding the Apple vendor tag in the 802.11 beacon
Background
Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
- 21
1
vote
0
answers
34
views
UART Interface Router (HUAWEI) V724 Typ A
I am trying to identify the UART pins on the board in order to debrick the router. Any help would be appreciate it.
- 11
2
votes
0
answers
43
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
- 471
0
votes
0
answers
59
views
I have been targeted with a VPN server hosted over cloudfare. I need to reverse engineer to discover server address, user credentials etc [closed]
I have been targeting through hacking to my personal email and work computer. I have changed phones 4 times and phone numbers twice, and now I have discovered that the methods used where a VPN setup ...
- 17
-1
votes
0
answers
15
views
Yara Rules 4.3 Warnings
$hex = {CC CC CC CC CC CC CC CC}
Warning : "$hex" may slow down scanning
Do anyone know how to remove this warning
1
vote
0
answers
24
views
Decompiling an APK of Unity framework with IL2CPP
Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed?
I tried stuff like https://github.com/Perfare/...
- 19
2
votes
0
answers
26
views
Reverse engineering a predictive model with lots of example inputs/outputs
I'm working on a project to approximate an existing model that generates prices for an asset given a large number of input variables. The model comes with ~1,000 unique example lines in batches of ...
- 21
3
votes
0
answers
45
views
x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION
Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So ...
- 31
2
votes
0
answers
77
views
How to determine the encryption type/structure used on a .dat file
I have a .dat file that is saved by a Delphi 5 application. It is basically the applications backup file for it's internal database.
I can't seem to find what type of DB it is. The file starts with ...
- 121
0
votes
0
answers
61
views
What Are These Four Bytes In My File Doing
I have a file that I'm trying to reverse engineer that is generated by an application. The file itself is fairly simple, but there are 4 bytes whose purpose I can't determine. The file consists of a ...
- 109
2
votes
0
answers
90
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 219
2
votes
1
answer
64
views
Double constructor when reversing Unity game
When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set.
Here is an example:
...
- 196
1
vote
1
answer
30
views
CAPE-sandbox signatures
When I submit a PDF file to analyse, it triggers a signature called stealth_file. I just added the alerted path into the whitelist as shown, but it didn't solve the problem.
How to resolve it?
- 113
2
votes
1
answer
46
views
IDA Pro 7, idc script to copy 8KB ROM to F000 Segment?
I updated an old .idc script so it will now copy 64kb of a 512kb BIOS file to the F000: Segment under IDA Pro (Free) 7 :
#include <idc.idc>
// The script relocates a copy of the highest 64 ...
- 31
0
votes
0
answers
26
views
problem with LD_PRELOAD
Hell0!!!
I try ld_preload by pwntools and take it...
How can I fix this problem???
- 19
2
votes
1
answer
79
views
Ida+Windbg alternative of Olly's "Back to user code" feature
I'm learning lena151's materials and in 4 lesson she uses Olly's Back-to-user feature to find where the MassegeBox is creating.
It works fine under x32 windows server 2003.
But what about nowadays?!
...
- 31
1
vote
0
answers
17
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 111
1
vote
0
answers
30
views
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I ...
- 19
2
votes
0
answers
45
views
How can I disable watchdog in U-boot using mw command
So I have DVR with 2*Hi3511RBC CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) and when I enter U-boot (how do I know that I'm in U-boot ? ) well over UART I get following message
U-Boot 1.1.4 (...
- 495
3
votes
0
answers
46
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
1
vote
0
answers
48
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
- 99
1
vote
1
answer
101
views
reading data from a binary file
000000 00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 03
000010 17 10 15 27 00 00 01 00 FB 00 0A 00 00 00 38 FF
000020 01 00 FB 00 09 00 00 00 34 FF 01 00 FB 00 09 00
000030 00 00 31 FF 01 00 FB 00 08 ...
- 19
2
votes
0
answers
90
views
Is there an MFC Decompiler available?
I want to know if there is already an MFC Decompiler?
So far, you have to decompile by hand - which is very tedious.
I would like a tool like DeDe Decompiler. The C++ code itself is not important. It ...
- 471
3
votes
1
answer
93
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 41
1
vote
1
answer
45
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 13
1
vote
0
answers
60
views
RE internship possibilities
I am currently studying computer science and I have to do a mandatory internship (6 months) soon. I am really enjoying re and I would love to get an internship in that area. My problem is that the ...
- 11
1
vote
1
answer
52
views
How do you identify a software framework?
I downloaded a free app but I want to stop it from showing ads.
https://www.statista.com/statistics/869224/worldwide-software-developer-working-hours/
Apparently it's almost certainly in one of the ...
- 109
0
votes
0
answers
28
views
J1939 message payload checksum
I am attempting to reverse engineer some proprietary J1939 CAN traffic so that I can remotely control some actions on a vehicle. I have collected a number of traces covering the events I want to ...
1
vote
0
answers
31
views
Problem while debug with x64dbg
I am debugging with x32dbg a program (x) which at some point opens another program (y). Is it possible to continue debugging also on program (y) when opened by the first one (x)?
Unfortunately, ...
- 11
1
vote
0
answers
96
views
Decrypt PPPoE password of Huawei ONT HG8145V5
I am trying to get the PPPoE password of my Huawei ONT, model HG8145V5. When I access the ONT user interface and go to WAN settings, I can clearly see the PPPoE username. However, the password is ...
- 11
4
votes
1
answer
135
views
Mickey Mouse toy bin file analysis
I am trying to reverse engineer a Mickey Mouse toy just for fun but I am stuck.
The toy has several buttons that play various phrases and songs.
My aim was to see if I can read those songs from the ...
-1
votes
0
answers
51
views
How do you edit an APK file so the app won't show ads?
I was referred here by the Android exchange.
Can I just say, people really would be modding androids in the 21st century. Who'da thunk it.
- 109
1
vote
0
answers
85
views
PPPoE password Huawei HG8245W5-6T
can someone help me to decrypt the PPPoE password from a Huawei HG8245W5-6T fiber optic ont.
The password has this format "$2lT_)L2t{NViWZSYEt@"/qwP82OAN)<s+mv~AVu["$".
I tried ...
- 11
1
vote
1
answer
52
views
windbg: the name of a function displayed by the command "x" is unusable with the command "u"
I start with Windbg.
In a "kernel debugger" session, I place myself in the context of a service (I chose audiosrv for my learning).
I would like to disassemble a function that I easily ...
- 51
0
votes
0
answers
46
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 111
1
vote
1
answer
42
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 99
2
votes
0
answers
32
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 91
2
votes
0
answers
26
views
Reverse Engineer Using Class-dump
I have tried to look into the class-dump of a decompiled ipa file, can I assume that only : TtCC29XYZ18JailbreakDetection12RuntimeClass is of remarkable because it has - (long long)...
- 111
1
vote
0
answers
52
views
can sha1 hash of file converted to sha2 hash?
I have a phone database /data/user/0/com.miui.gallery/databases/gallery.db containing information such as exif data and file name. there is a column sha1 containing value
...
- 113
3
votes
0
answers
81
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 131