All Questions
9,149
questions
1
vote
0
answers
8
views
Get all names of functions from an iOS-App binary (headless)
Setup:
I want to get a list of all (apple built-in) function and variable names that are used in an arbitrary iOS App by headless analysis. So given the .ipa file of any iOS-App, I unpack it and can ...
2
votes
0
answers
13
views
Decoding a time format
I'm reverse engineering a hardware device which stores time a strange format:
32-bit word
H:MM:SS (rounded)
0x03200000
0:00:00
0x09700000
0:00:00
0x0A1B0000
0:00:01
0x0A160000
0:00:01
0x0B098000
...
- 121
1
vote
0
answers
16
views
is there any way to find that a firewall is protecting a server and showing all ports closed in nmap?
I am using nmap to scan open ports on a device which uses FTP protocol to transfer firmware for update. But it is showing all 1000 ports are closed.
It comes with a software to update its firmware. ...
- 11
1
vote
0
answers
19
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 123
1
vote
0
answers
9
views
Bypass SSL pinning for android application
I am trying to analyze the network traffic from an android application for research. I tried few approaches but unable to achieve the results. I am using rooted android emulator.
I tried to setup ...
- 11
2
votes
1
answer
46
views
Frida not hook functions
I want to hook a xxtea_decrypt
but it not trigger and on other games it trigger but some games not trigger it.
On ida pro its trigger the xxtea_decrypt but frida nope
here is the code that i using it
...
- 33
1
vote
0
answers
24
views
How to patch instruction with a call to a thunk function?
I started to use ghidra to begin doing some crackmes, and I need to change an instruction to a call to a thunk function. However, when I export the program back, I get a segfault.
Inspecting it with ...
- 111
1
vote
0
answers
25
views
Editing the name table in the PE file import directory
There are a lot of dll-files compiled using wchar types.
On the other hand - there is an exe file compiled using unsigned char types.
My idea is to rename the mangled names in the exe file's import ...
- 501
3
votes
1
answer
57
views
Reverse engineer a blackbox function operating on single or double precision floats for emulation
I own and run a NEC VectorEngine 10C which is a PCIe accelerator running a proprietary ISA which has many fun instructions among them is VRSQRT which computes an approximation of the inverse ...
- 131
0
votes
1
answer
46
views
determine if 2 byte checksum is CRC-16 based
I have pairs of data / messages with what I believe to be CRC-16
I know for a fact the bit order of each individual byte is reversed (at least in C# on x86 platform, I have to flip the binary around)
...
- 9
1
vote
0
answers
52
views
Decoding set of byte arrays representing light spectrum
I have a small spectrometer that measures in the spectral range of 740-1070nm. The device is commercial, and used to send the raw data to the manufacturer's server for decoding, but that does not seem ...
- 11
1
vote
0
answers
20
views
How we capture serial data on wirshark
I have capture this data but I am not understanding this data
- 11
1
vote
0
answers
40
views
How can I make the C compiler emit a jump inside of a loop for a continue?
I am trying to recreate the C code from the following 16bit 8086 assembly that came from the MS C 5.1 compiler under DOS:
0100 mov timerCounter, 0
0105 waitForKey:
0105 ...
- 111
1
vote
0
answers
64
views
How to encode file lua and resource files
I am trying to decrypt luas files it use cocos2dx but its encrypted maybe aes encryption.
With frida i can extract most lua files but not all.
And with ida64 i cant find the key.
- 33
1
vote
0
answers
87
views
Calculate a 3 byte checksum in configuration file
I have 3 different encrypted configuration files.
The first line of the files are always the same (M1.28...).
Following lines are as follow for exmaple:
1N].1f01f ("1N]" is the checksum for ...
1
vote
0
answers
71
views
What is the ELF .got section used for?
I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.
When the program tries to call an imported function which is lazy binded, it ...
- 11
1
vote
1
answer
48
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
1
vote
0
answers
32
views
2
votes
0
answers
30
views
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
- 21
1
vote
0
answers
24
views
Santander US - app
I am trying to see the requests of santander us app, but the app in the emulator crashes on open, crashes when using frida, and crashes when I recompile it using apk tool. I also used uber apk signer. ...
0
votes
0
answers
37
views
How do I install an .xpi file on Firefox Android?
I want to use Google's "Translate Page" function on Firefox.
- 109
2
votes
0
answers
42
views
Decoding the Apple vendor tag in the 802.11 beacon
Background
Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
- 21
1
vote
0
answers
36
views
UART Interface Router (HUAWEI) V724 Typ A
I am trying to identify the UART pins on the board in order to debrick the router. Any help would be appreciate it.
- 11
3
votes
1
answer
121
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
- 501
0
votes
0
answers
59
views
I have been targeted with a VPN server hosted over cloudfare. I need to reverse engineer to discover server address, user credentials etc [closed]
I have been targeting through hacking to my personal email and work computer. I have changed phones 4 times and phone numbers twice, and now I have discovered that the methods used where a VPN setup ...
- 17
-1
votes
0
answers
16
views
Yara Rules 4.3 Warnings
$hex = {CC CC CC CC CC CC CC CC}
Warning : "$hex" may slow down scanning
Do anyone know how to remove this warning
1
vote
0
answers
25
views
Decompiling an APK of Unity framework with IL2CPP
Is it actually possible to decompile the source code from .so files (in this case it's libil2cpp.so) inside the APK of Unity with IL2CPP scripting backed?
I tried stuff like https://github.com/Perfare/...
- 19
2
votes
0
answers
26
views
Reverse engineering a predictive model with lots of example inputs/outputs
I'm working on a project to approximate an existing model that generates prices for an asset given a large number of input variables. The model comes with ~1,000 unique example lines in batches of ...
- 21
3
votes
0
answers
46
views
x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION
Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So ...
- 31
2
votes
0
answers
83
views
How to determine the encryption type/structure used on a .dat file
I have a .dat file that is saved by a Delphi 5 application. It is basically the applications backup file for it's internal database.
I can't seem to find what type of DB it is. The file starts with ...
- 121
0
votes
0
answers
65
views
What Are These Four Bytes In My File Doing
I have a file that I'm trying to reverse engineer that is generated by an application. The file itself is fairly simple, but there are 4 bytes whose purpose I can't determine. The file consists of a ...
- 109
2
votes
0
answers
106
views
Reverse engineering a flutter built apk
I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
- 219
2
votes
1
answer
66
views
Double constructor when reversing Unity game
When reversing Unity dll, the decompiler (i.e. dnSpy) sometimes would create a class with 2 constructors, which are mostly identical apart from some specific field set / not set.
Here is an example:
...
- 306
1
vote
1
answer
33
views
CAPE-sandbox signatures
When I submit a PDF file to analyse, it triggers a signature called stealth_file. I just added the alerted path into the whitelist as shown, but it didn't solve the problem.
How to resolve it?
- 113
2
votes
1
answer
46
views
IDA Pro 7, idc script to copy 8KB ROM to F000 Segment?
I updated an old .idc script so it will now copy 64kb of a 512kb BIOS file to the F000: Segment under IDA Pro (Free) 7 :
#include <idc.idc>
// The script relocates a copy of the highest 64 ...
- 31
0
votes
0
answers
28
views
problem with LD_PRELOAD
Hell0!!!
I try ld_preload by pwntools and take it...
How can I fix this problem???
- 19
2
votes
1
answer
82
views
Ida+Windbg alternative of Olly's "Back to user code" feature
I'm learning lena151's materials and in 4 lesson she uses Olly's Back-to-user feature to find where the MassegeBox is creating.
It works fine under x32 windows server 2003.
But what about nowadays?!
...
- 31
1
vote
0
answers
17
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 111
1
vote
0
answers
30
views
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I ...
- 19
2
votes
0
answers
47
views
How can I disable watchdog in U-boot using mw command
So I have DVR with 2*Hi3511RBC CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) and when I enter U-boot (how do I know that I'm in U-boot ? ) well over UART I get following message
U-Boot 1.1.4 (...
- 495
3
votes
0
answers
46
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
1
vote
0
answers
49
views
Angr considers REP instruction as the end of a basic block
I'm developing a python script for angr that has to find all the basic blocks present in each function in a binary. I have noticed that angr splits the basic blocks when it finds a REP instruction, I'...
- 99
1
vote
2
answers
128
views
reading data from a binary file
000000 00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 03
000010 17 10 15 27 00 00 01 00 FB 00 0A 00 00 00 38 FF
000020 01 00 FB 00 09 00 00 00 34 FF 01 00 FB 00 09 00
000030 00 00 31 FF 01 00 FB 00 08 ...
- 31
2
votes
0
answers
105
views
Is there an MFC Decompiler available?
I want to know if there is already an MFC Decompiler?
So far, you have to decompile by hand - which is very tedious.
I would like a tool like DeDe Decompiler. The C++ code itself is not important. It ...
- 501
3
votes
1
answer
93
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 41
1
vote
1
answer
47
views
why some functions push data before the prologue
i am a newbie in the world of RE ,
i start to explorer a main entry of a classic game from 90's
and i start to see something confuse me as a newbie
this main entry function start with pushing stuff to ...
- 13
1
vote
0
answers
61
views
RE internship possibilities
I am currently studying computer science and I have to do a mandatory internship (6 months) soon. I am really enjoying re and I would love to get an internship in that area. My problem is that the ...
- 11
1
vote
1
answer
56
views
How do you identify a software framework?
I downloaded a free app but I want to stop it from showing ads.
https://www.statista.com/statistics/869224/worldwide-software-developer-working-hours/
Apparently it's almost certainly in one of the ...
- 109
0
votes
0
answers
29
views
J1939 message payload checksum
I am attempting to reverse engineer some proprietary J1939 CAN traffic so that I can remotely control some actions on a vehicle. I have collected a number of traces covering the events I want to ...
1
vote
0
answers
32
views
Problem while debug with x64dbg
I am debugging with x32dbg a program (x) which at some point opens another program (y). Is it possible to continue debugging also on program (y) when opened by the first one (x)?
Unfortunately, ...
- 11