All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
0
votes
1answer
9 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
0
votes
0answers
18 views

ret2libc: problem getting exploit work without pwntools

I am trying to exploit this program test with ret2libc. Only NX is enabled. #include <stdio.h> void vuln() { char buffer[256]; gets(buffer); } int main() { vuln(); return 0; } ...
0
votes
1answer
23 views

Ollydbg - automatically add hardware breakpoint when step over

I put INT3 breakpoint and starting the program. The OllyDbg break at the breakpoint, but when I step over, the OllyDbg put a hardware breakpoint. (Yesterday not happened in OllyDbg, but today during ...
0
votes
0answers
16 views

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E wifi controller and as always nowadays this devices comunicate with Cloud servers first then with you which practically means you need ...
0
votes
0answers
28 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
1
vote
0answers
7 views

'… Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript

I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error Unable to get property 'Debugger' of undefined or null reference. Line was simply var ctl = host....
3
votes
0answers
27 views

Cannot load pdb in IDA Free 7.6

I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach. I have just installed the last version of free IDA (7.6) ...
0
votes
0answers
27 views

How does Borland C++ 5 exception handling work?

So, I'm still working on reverse-engineering an 1996 game. I have cleared a lot of roadblocks, but one thing that continues to annoy me is exception handling and RTTI metadata. There is a function ...
0
votes
1answer
21 views

Modify framework.dex which is in boot.oat?

I pulled down boot.oat from an API22 Android phone. It's Android 5.1 Lollipop which brought the change from Dalvik to ART and is a bit mistified. As far as I understand, modifying boot.oat is not easy,...
0
votes
0answers
13 views

Baksmali services.odex from Android L (5.1, API22)

I'm trying to deodex a system file (/system/framework/arm/services.odex) as I need to modify it. I've tried every possible commands found online, but baksmali complains for "unsupported oat ...
0
votes
0answers
11 views

Does Golang's cgo now support output with .gopclntab?

I read this page in which the author, Chris Siebenmann, states that binaries created using cgo will not have the gopclntab or the gosymtab sections. However, I see that on go version go1.13.15 linux/...
0
votes
0answers
24 views

Can't figure out a crash in IDA “The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)”

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
33 views

What's the meaning of @ tag on proxy dll?

In proxy dll in .def file I can see the following notation: _CreateFrameInfo=PROXY__CreateFrameInfo @1 Others use in the following format: _AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16 ...
2
votes
0answers
71 views

Proprietary 3D Format Reverse Engineering: What Could These Numbers And Matrices Represent?

I'm trying to reverse engineer a model format from an older Russian game (Pathologic) with limited success. It is a proprietary model format not recognized by any converters/editing tools (believe me, ...
1
vote
0answers
16 views

Unable to find the pci device mentioned in the processor datasheet

I have following intel processor 4th Generation Core Processor (Haswell U/Y). I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
0
votes
0answers
30 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
23 views

Ollydbg - Nag screen location

I am watching part5 of lena151 RE tut. the creator said : do understand that the nag is generated in the above call at 004898FE, but is effectively created in MFC42.dll in this call at 489912 So, How ...
0
votes
0answers
21 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
0answers
27 views

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal and I decided that I want more RPMs from my fan. However I wasn't able to find a ...
0
votes
0answers
42 views

How to bypass anti-debugging C++

so i have a crackme my friend sended to try and crack it but the problem that i cannot bypass the anti-debugging or even patching it i even tried using ScyllaHide at max settings but still it detects ...
0
votes
0answers
37 views

radare2: Print strings in function for 32-bit binaries

I want to see the strings that are printed by the puts() function in the output of radare2's pdf, but it doesn't work. I have a similar problem as mentioned here, but I think it's somehow related to ...
0
votes
1answer
49 views

Where stack canary is located?

Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr so I can't change any registers (while the ...
1
vote
1answer
46 views

What is the structure of the Stack in a minidump?

I'm currently trying to understand a minidump file and while [1], [2] and [3] have helped, there are still some holes that aren't covered. The purpose of this is to create a script that can disect ...
1
vote
1answer
30 views

IDA Pro 7.5 Breakpoint Python Script: 'invalid non-printable character U+FEFF'

I'm trying to set a python condition breakpoint, but it throws me a weird error and I don't understand what happens: Even if I just return True, it throws the same error when I compile or when press &...
0
votes
0answers
43 views

Need help reverse engineering an 1995 Arcade game with jackie chan in it for modding purposes, (Motorola 68k)

I am looking for a way to decrypt these files and attempt to balance the game because the top tiers are top and the low tiers are low, also there might be two hidden characters that I would like to ...
2
votes
0answers
28 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
1
vote
0answers
28 views

Launching Linux kernel on UART serial interface, but can't login because key-mappings change randomly

I am trying to root an old Linux device I have, it uses the CFE bootloader by Broadcom. I know the username and the password, but something really strange happens when I try to login. I get a prompt ...
0
votes
0answers
9 views

Immunity Debugger Trace of Vulnerable Application

I'm trying to trace a vulnerable application while it is being exploited. I'm testing it on the application and exploit pair found at (https://www.exploit-db.com/exploits/36826). the exploit works ...
0
votes
1answer
52 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
2
votes
1answer
72 views

What is Hardware Breakpoint and when we need to use it?

In part 5 of the lena151 RE tutorial I saw the Hardware BP. The explanation he gave was very difficult for me to understand. Can anyone explain what is a hardware breakpoint and when we need to use it?...
2
votes
2answers
99 views

Access data at memory address that is part of a struct

Problem I have a struct of some type, say the DOS header at the beginning of a typical PE file: /DOS/IMAGE_DOS_HEADER pack(disabled) Structure IMAGE_DOS_HEADER { 0 char[2] 2 e_magic "...
0
votes
0answers
33 views

IDA Pro dont understand address extension register in HC16

Source: ROM:13A2 006 ldab #0Fh ; Load B ROM:13A4 006 ldx #0FA27h ; Load IX ROM:13A8 006 tbxk ; Transfer B ...
1
vote
0answers
17 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
3
votes
1answer
58 views

Fujifilm Firmware Checksum

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR. I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera ...
-1
votes
1answer
43 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
2
votes
1answer
76 views

How to analyze dumped process?

I'm trying to reverse engineer a malware which uses a Process Hollow technique. This malware uses an API hashing technique and contains some RC4 encryption algorithm references. I already knew the ...
0
votes
1answer
35 views

IDA Pro Debbuger is debugging the original code and not the patched code

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections?...
0
votes
0answers
19 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
1
vote
0answers
46 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
3
votes
1answer
67 views

Determine if the function has try/catch statement via the static analysis

I need to determine if the function has exception handler via static analysis. Initially I thought that if there's SEH handler prolog in the function, then the function should have try /catch. I.e. I ...
0
votes
0answers
36 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
0
votes
0answers
30 views

Unpacking firmware of TP-LINK IPC firmware

I have some TP-LINK IPC firmware that must be reversed (as a task). But I can not unpack the .bin firmware and extract the file system. Binwalk output: 576 0x240 xz compressed data ...
0
votes
0answers
39 views

Reconstructing “relative” import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
18 views

Decoding a ZTE H188A config. file

I got this router from my ISP it's fairly good but most of the config options are grayed out. I wanted to decrypt the config file and change those options form there. after some research I found this ...
0
votes
0answers
23 views

Indirect calls using registers (IDA)

I need some help. Using IDA for disasembling an executable PE file. It has several indirect calls using registers like call eax. Trying to add breakpoints and get the content of the registers, but ...
0
votes
0answers
51 views

IDA: Function arguments detection

I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. ...
1
vote
0answers
44 views

Cocos2d xxtea game lua decrypt

How can I use the 16 byte xxtea byte as python I found the password directly but I want to change the bytecode of the password with 16 bytes as in the picture _BYTE *__fastcall sub_D4CA64(__int64 a1, ...
2
votes
1answer
53 views

How to know when a subroutine starts when reversing an ARM64 file?

I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
0
votes
0answers
86 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...

15 30 50 per page
1
2 3 4 5
164