All Questions

Filter by
Sorted by
Tagged with
1 vote
0 answers
8 views

Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?

I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M). Looking at the idapython documentation, it looks like maybe I can do this via the ...
  • 186
1 vote
0 answers
16 views

How to exploit BOF vulnerability if canary is present but no way to find out its value

Here is a simple CTF challenge with BOF exploiting. #include <stdio.h> #include <string.h> #include <stdlib.h> void func(int key){ char overflowme[32]; printf("overflow ...
  • 11
2 votes
1 answer
72 views

IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text

Recently I got a program that has two colors of .text segment, one is black and the other is brown: While the flow chart and the decompiler work well on black part, they are both disabled on the ...
2 votes
1 answer
32 views

exe file not opening after patching

I hope everyone is well. I'm new here and I'm hope someone can help me with the problem I'm facing. I've been trying to reverse engineer a program but everytime I change an instruction, not matter how ...
1 vote
0 answers
17 views

How to decrypt a PIE file for a game's assets?

I want to see the assets for Garbage Pail Kids: Mad Mike and the Quest for Stale Gum I noticed the file was in PIE format. I tried opening them with every program I have, but nothing works; And add ...
1 vote
0 answers
13 views

Overclock CPU in BIOS - ARM/C/C++/Py

new guy here. Working on Bi0S script, adding as many features as possible. It is possible to change fan speeds, advanced security, manipulate voltages, etc. How do you overclock the microprocessor ...
1 vote
0 answers
12 views

How to Decompile HP LaserJet Pro M12w firmware in Ghidra

I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra, after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
2 votes
0 answers
26 views

Steghide Linux Steganography how to get "Passphrase"

I am currently on Parrot Linux and have an image has a hidden steganographic inside. I know I need to decode it with Steghide in the Parrot Terminal. I also know that I will find out what the hidden ...
1 vote
0 answers
12 views

How to decode this rbf file?

I am trying to decode this file but so far I have no luck. I tried with binwalk and other decoders but still did not see a way of decoding. Any help, more than welcome. The file supposed to have GPS ...
1 vote
0 answers
50 views

List of unsolved problems of reverse engineering

Decided to write out a list of still unsolved fundamental problems in the field of reverse engineering. This means that today - there is no easy solution to these problems, or problems that can only ...
  • 142
1 vote
0 answers
31 views

Themida devirtualization?

I'm trying to analyze virtualized? code in IDA which looks like this. which protection method is applyed on this code and how can i analyze this code?
  • 11
1 vote
0 answers
22 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
  • 11
1 vote
0 answers
14 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
  • 11
1 vote
0 answers
30 views

Password from .bin file

I am trying to find a password for a bin file for an plc. a real pain. anyone here that have a idea ? https://filebin.net/r673zgmbl5ecxtdw/LOGO_U_P.bin
  • 11
1 vote
0 answers
6 views

Cant view some classes while inspecting APK's code

I'm trying to understand how the application works. I used dex2jar utility to receive .jar file (d2j-dex2jar --force file.apk). And jd-gui to view it's classes. I'm able to view the most of them. But ...
1 vote
0 answers
18 views

statically placing hooks on PE file's IAT

recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
  • 11
3 votes
0 answers
37 views

How to debug windows EFI modules during boot using IDA Pro's windbg?

I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
1 vote
0 answers
29 views

What is the following code will do after modifying it? [closed]

The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal. But ...
2 votes
0 answers
30 views

Mouse click breakpoint

Im just start to learn and stuck with problem: trying to set breakpoint on mouse click, but ollydbg log shows me only new thread created or terminated. I did as it is written in these threads: Thread ...
1 vote
1 answer
13 views

Does anyone know the purpose of the malware,ios,social_engineering file on iOS

I have a jailbroken iPhone, and I noticed that it contains a file called social_engineering,ios,url_expression at the path: /private/var/mobile/Library/Caches/com.apple.Safari.SafeBrowsing/Google/...
1 vote
0 answers
18 views

Finding a check in Chrome

Chrome doesn't allow switching on extensions which are not from the Chrome store. There is no this limitation in Chromium. So it is only in Chrome. It checks verified_contents.json (in which content ...
  • 133
2 votes
1 answer
49 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
-2 votes
0 answers
55 views

Does anyone know what algorithm generated these hashes?

Does anyone know what algorithm or method was used to generate the following hashes? Z5zDvEuuHnjIKxWozea0Sg== KX4Xvtt9kYF6Vtqz3kPQ/A== Kt4PfavKPQ+58KCnkBa3NQ== XqhC5IdwwGYOPoKII97HBA== ...
2 votes
1 answer
50 views
+50

GDB breakpoint crashes at a correct memory location

I'm trying to debug binaries of a a firmware running Linux with no ASLR, binaries are not compiled with PIE either so I have no issue getting the memory locations. So after including gdbserver in the ...
1 vote
0 answers
21 views

Assembling BIOS Routine Startup System Checks Op Code

I am really excited.. This is my first post. Anyways, The pressing question is such: "How would one get said bios program to run a routine system check before accessing the magic number?"
1 vote
0 answers
25 views

Trouble understanding disassembled code

I cant seem to figure out what is located in the EAX register after running this disassembly, specifically unclear after the sar and shr occur
0 votes
0 answers
40 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
2 votes
1 answer
45 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
2 votes
2 answers
62 views

x64dbg: Conditional breakpoint: how to log only if register value has changed?

What i'm trying to achieve is to use a conditional breakpoint, that never actually breaks but logs in x64dbg's console the value of r9 only when it changes, to prevent console cluttering. But i do not ...
0 votes
1 answer
25 views

How can I get access to peripheral? [closed]

I'm here because I'd like to learn how to build programs that can change for example an iphone location, or just get access to data by branch my iphone to my computer. I have no idea how this works, I ...
1 vote
0 answers
30 views

debug stripped file

I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
  • 19
1 vote
0 answers
33 views

How to debug a file that can't treat with it directly?

I have a game that has ("ex: GameGate.exe") file to open. I found out later that file is not responsible for opening the game directly but it's just a gate to open another file ("ex: ...
  • 197
1 vote
2 answers
79 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
0 votes
0 answers
25 views

Find out used encryption in an SQLite database

Is it possible to see from a string which encryption an SQLite database uses? Let's say, I can open the database and see this: O45dTrA6NKG6SYeCENMwV7nxp66HR9lbhK12NGHgVnzEhebMjMJUhTmConk= - how do I ...
  • 1
2 votes
0 answers
45 views

Decrypt Keybindings for EVE Online

I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless. I'...
  • 29
3 votes
1 answer
72 views

Figuring out a (possibly 16-bit) CRC algorithm

So, I wanted repurpose some old boarding gate scanners and I'm trying to make use of their commands. Now, I have a dump from an actual boarding gate PC and I've noticed that the commands only work if ...
  • 43
0 votes
0 answers
9 views

Why rarun2 is not behave like it is described?

colleagues. Simplest question. As many articles in the Net (example https://r2wiki.readthedocs.io/en/latest/tools/rarun2/) and here on forum are describing, i have a rarun2 profile named "...
  • 11
1 vote
0 answers
36 views

How to search for a graphical string?

I am trying to search for a string but in my case, that string is not like a normal string but it's a graphical string. As you have seen, that is not a normal string that can search for but it's a ...
  • 197
2 votes
1 answer
122 views

Unusual datetime format

I am looking at the registry keys created for three programs from a now defunct company, one of which is trial software. One entry of interest is the REG_BINARY key InstallTime. I have an idea of what ...
  • 123
1 vote
0 answers
31 views

Find out what is this binary database entry and what format it is

the following varbinary "BUFFER" of a database entry is for an article. FIELD_0 is in plain text and the item name is "1", which I created with the item management software. [...
1 vote
1 answer
54 views

Compression format used for various data (images, text, etc.) in a 1997 video game

I've been trying to reverse engineer the format of data files from the 1997 video game Helicops. I have experience reverse engineering binary files from games of this period but limited exposure to ...
0 votes
1 answer
66 views

Which encryption method has been used?

Anyone please can you tell me which method used to encrypt this kind of codes? im really confused, that would really helps me. This encrypted data created by a PHP. Ibª„bÏ}◊Kì-yNî˜>Efi¶ØÁÇ_^§ ...
1 vote
1 answer
49 views

Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there ...
1 vote
0 answers
19 views

Greenpacket OH-735 onboard header

I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ...
  • 11
1 vote
0 answers
42 views

Huawei HG8245W5 Router PPPoE Password Decryption

My ISP is not providing pppoe accounts but I need to bridge to my server. I only have encrypted password. Password is " $2'4e0YX=y6Q]$\9$c#-+F-h2&Tva4"GYn+qY)x>W$ " Can anyone ...
  • 11
0 votes
0 answers
28 views

Working with IA64 in IDA Pro

When disassembling IA64 code in IDA Pro when I try to open the Local Types window i get an error: Sorry, the current processor doesn't support the type system
  • 142
1 vote
1 answer
34 views

How to interpret this __ctype_b based predicate?

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b ...
1 vote
0 answers
30 views

Access a XREFs with frida

I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
  • 41
1 vote
1 answer
29 views

How can I verify section -> segment mapping for ELFs on linux?

I'm looking at at ELF on linux and I have readelf --segments ./myELF which shows: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align PHDR ...
  • 1,708
1 vote
0 answers
53 views

How would I decode this XOR Cipher

I have been given a XOR Cipher which is a bunch of hexidecimal looking charcters. This cipher is: fa ce fd d3 fa df ed d3 fa ce d3 d3 fa de df d3 fa de df d3 fa de f9 d3 fa ce f9 d3 fa de f1 d3 ...

15 30 50 per page
1
2 3 4 5
180