All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Binwalk firmware analysis

When I run binwalk on a .rom using -Me it shows md5cheksum and a 411 signature under dec hex and description are blank why is it blank I’ve used binwalk on bios chip and got data the binary in ...
Strix Strong's user avatar
0 votes
0 answers
40 views

How did a cheap amazon RF key managed to clone master key with rolling codes?

I have a garage and I have the master key which is 433MHz and the specifications say it is a rolling code. Here is a table of the specifications: Range in open field (m): 100 Frequency: 433.92 MHz ...
Skywalker's user avatar
0 votes
1 answer
15 views

Сode in IDA breaks off

My code breaks off, and then the code color is red, like in the screenshot, a fragment of a function. What can you do here? How to restore the code? Is there a keyboard shortcut for this?
black4's user avatar
  • 333
0 votes
0 answers
19 views

Cloning full content of a pic24fj128gc010 chip (Flash + RAM)

I have some hardware that uses a PIC24fj128gc010 microcontroller. This microcontroller lives on a pluggable board that is plugged in on a main board. This detachable board has the microcontroller with ...
user45316's user avatar
0 votes
1 answer
24 views

Is there any way to read the data in STC11F02E?

I need to read the data from the STC11F02E microcontroller. Is there a way to do this?
akifh's user avatar
  • 1
1 vote
1 answer
61 views

Reverse engineering AES128 Key Derrivation from MAC Address

Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped. From this decompilation I ...
Seb's user avatar
  • 11
0 votes
0 answers
30 views

NxP3143 Uboot encrypted image and roots help

I have an encrypted firmware based on 2 files uImage (kernel) and rootfs (filesystem) and I have got the encryption keys from someone who cracked it. However I don’t know where to start so I can mount ...
Armandooooo's user avatar
0 votes
1 answer
21 views

struggle with Decrypt Byte Array with a key of unity game using il2cpp

So i'm trying to reverse an unity game using il2cpp to get the assets of it. After some reverse stuff i found that the asset's (especially here the png image) byte array get encrypted with a key and i ...
NoName's user avatar
  • 23
0 votes
0 answers
28 views

Change Mac address

I have read the NAND memory MT29F2G08ABAEAWP contents via the RT809F programmer from IP Camera, when I have written the program (.bin) to the new NAND memory the Mac address and serial number of ...
Motaz's user avatar
  • 1
0 votes
0 answers
35 views

Decoding API headers of unknown encoding?

I'm using mitmproxy to monitor facebook messenger app traffic on my android. Firstly I had to enable whitehat settings to use it. After that I found some request headers has some unknown value in body....
Wojciech Wolski's user avatar
0 votes
1 answer
43 views

Protection of the source code of an ML model

I wanted to know how it would be possible to run an ML model in an offline setting securely? What I mean is, if the Python files and libraries are bundled as an .exe file (using libraries like py2exe ...
woka's user avatar
  • 1
0 votes
0 answers
17 views

x64dbg string references can not find

i am trying to register a software with x64dbg, but my experience is not enaugh for do this. Anyone can help me ? i am ready to pay price. Problem is can not find string references in x64dbg.i already ...
KADİR SÖNMEZ's user avatar
0 votes
1 answer
35 views

Inject ELF with an entierly self-contained code section that can statically call standard library functions

What I want to do What I want to do is inject an existing ELF binary with additional code that runs before the original .text section and then transfers control back to it. What I can already do Now, ...
PaperTsar's user avatar
  • 101
0 votes
1 answer
37 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
Grandmaster's user avatar
0 votes
0 answers
20 views

How to use reverse engineering to replicate websocket request

how I can use reverse engineering technique to get known how websocket is working on website. What data my browser is sending to websocket so it reply with data. How I can replicate that process as ...
innocent98's user avatar
0 votes
1 answer
75 views

Function calls to unmapped memory

I'm examining an iOS framework (extracted from a dyld shared cache) and there are a lot of branch-link instructions to functions which don't exist. For example, bl #-0x50e7e04 Performing the ...
August Vrubel's user avatar
0 votes
1 answer
74 views

Reverse engineering RS-232 motor controller

I have a motor controller and I'd like to communicate with it using Arduino. I can communicate with the controller using a software and I used it to sniff some data from RS-232 commnunication and ...
Jdx's user avatar
  • 1
0 votes
0 answers
49 views

Unknown file analysis

I have a file, which supposedly contains an output of CRC32 hash. Problem is, file has no extension, type file (cat analogue) returns mangled gibberish, i.e. ёя╫жW▲{═Sb╨y¶|ИМ▐ВQ╙l9k╖▀у║?╩↓b☼┐R. TrID ...
flying_meatball's user avatar
0 votes
0 answers
47 views

How to use reverse engineering to get paginated threads id on facebook messenger

I'm trying to replicate websocket request in python. I want to get paginated results of threads id that appears after scrolling down the friends chats section. Seems messenger uses websocket for it. ...
Wippar's user avatar
  • 1
0 votes
0 answers
45 views

Improving the output of pseudocode C++ code from IDA Pro

I have some specific questions and some general ones about reverse-engineering a dynamic shared library via IDA Pro 8.3: If I know the compiler used and compiler flags used (via readelf --debug-dump),...
HCSF's user avatar
  • 143
1 vote
0 answers
60 views

How to decrypt Zyxel's 'Backup_Restore' config file?

I have a VMG3625-T50B running an ISP-dedicated firmware version (V550ABTL0b2r). I managed to get the supervisor password yet I can't enable open an SSH port because my SP disabled that option. I've ...
Khalid's user avatar
  • 11
0 votes
0 answers
32 views

Finding JTAG/UART Connections on smart doorbell

Trying to dump firmware of this device. I can't find the UART/JTAG connections. I've searched over it for awhile now; I feel like I must just be missing something.
Eric's user avatar
  • 1
0 votes
0 answers
21 views

Can Ghidra load a directory and translate the binary files within it into assembly code?

Can Ghidra load a directory and automatically convert the binary files within it into assembly code? If not, is there a pre-defined script available, or do I need to write one myself? If Ghidra isn't ...
0xh3xa's user avatar
  • 111
1 vote
1 answer
51 views

Tracing all functions in executable conditionally, to find function of interest

I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/...
tcpie's user avatar
  • 113
0 votes
1 answer
45 views

Location of CoreMedia framework

I've been attempting to dive into mediaserverd which runs on iOS. Pulling the binary and running otool -L on it reveals, unsurprisingly, that it's linked against /System/Library/Frameworks/CoreMedia....
August Vrubel's user avatar
0 votes
0 answers
45 views

Hex-View in IDA [TMS320C3x]

For the target processor TMS320C3x, IDA does not display all data in HEX-VIEW as ASCII, only every 4th byte. The minimum addressable data block for this target processor is a 32-bit word. It seems ...
strannyi's user avatar
0 votes
1 answer
26 views

Get the jar from exe4j executable

I've read this question and it is not a duplicate to mine. I have a .exe file which has different contents inside when opened with 7zip. However let's say I know that it uses EXE4J, how can I ...
Grinding For Reputation's user avatar
0 votes
0 answers
25 views

How do I force IDA to reload PE Header and/or segments?

Introduction I started analyzing an exe, added many comments, structs, byte patches, etc. After 2 months of working on this file I used CFF Explorer to add a new section at the end of it called "....
Kyuuri's user avatar
  • 1
0 votes
1 answer
52 views

What's this connector type?

Does anybody know this kind of connector? It is used as a diagnostic connector on diesel engines. Inner diameter 15mm, outer 19mm.
Alex4102's user avatar
0 votes
0 answers
44 views

How to use reverse engineering to learn how facebook send messages?

I would like to know how I can use reverse engineering technique to learn how Facebook/messenger send messages? I were analyzing my developer tools network tab, but couldn't find anything. Fiddler ...
innocent98's user avatar
0 votes
0 answers
23 views

S30+ Game Development

How can I get started developing games for the S30+ operating system on Windows or Linux? I have a new nokia 150, which seems to run the correct operating system, although I'm not sure if this phone ...
Kynemix's user avatar
1 vote
0 answers
45 views

How to hook or call "non-native/non-exported functions"?

I wrote this simple application in C++ to learn about reverse engineering: #include <iostream> #include <windows.h> void PrintMessage(const char *message) { std::cout << message ...
Unknown X's user avatar
1 vote
1 answer
70 views

Ghidra not displaying member function call

On lines 67, 70 and 77 ghidra makes a call to what I assume is a member function, but it does not show me which member function. Why is that? Example from line 70: (**(code **)(*(longlong *)metaStream ...
Proton's user avatar
  • 13
1 vote
0 answers
38 views

Unknown string encoding

I'm new to reverse, my question may be stupid. I am trying to reverse a function in the application that reads a string at the address and concatenate it to another char[250] v30; char[20] v31; ... ...
SHVED's user avatar
  • 11
0 votes
0 answers
22 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
Unknown X's user avatar
0 votes
1 answer
34 views

How can I reverse engineer a self-contained dotnet executable on MacOS?

For a challenge at OWASP WrongSecrets I have build a self-contained binary to be reverse engineered (see https://github.com/OWASP/wrongsecrets-binaries/actions/runs/8244751569), but, I have not been ...
Jeroen's user avatar
  • 101
0 votes
0 answers
75 views

Decompiling very heavily obfuscated JAR

I have a very very obfuscated jar. I tried using Krakatau and CFR and it won't decompile. With CFR some of the important classes / methods fail to decompile and with krak it says it is writing data to ...
tritheo's user avatar
0 votes
0 answers
24 views

How to draw invisible entities (glow) with DX11?

I'm trying to understand how GLOW hacks work. In some games like CSGO you can just overwrite the memory address to 1 and glow chams are enabled. So you can see people through the walls like in this ...
kuhi's user avatar
  • 161
0 votes
0 answers
23 views

can the source code for video slot machine be pulled using dev tools?

i want to obtain pre built source code and logic for video slots , and then rename my own sprites / skins, ect and essentially create a reskin of said game . can anyone tell me how this can be ...
William Wheeler's user avatar
0 votes
0 answers
27 views

How does Windows determine dll address when using loadlibrary

First, sorry for my bad english. I'm trying to make emulator to emulating PE binary with unicorn emulator. My goal is place every dll in emulator that PE needed and hook some specific APIs. What I am ...
schnabel's user avatar
0 votes
0 answers
21 views

How to access the demangled auto comment?

In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
thejoelpatrol's user avatar
0 votes
0 answers
18 views

How can I use ptr to ptr in idapython?

in hey-rays api there's a method: def find_def(self, *args) -> "minsn_t *": r""" find_def(self, op, p_i1, i2, fdflags) -> minsn_t @param op: mop_t const &...
Ethan Xie's user avatar
0 votes
0 answers
24 views

Hooking a Swift method with frida on iOS to inspect DSA signing arguments

I have an iOS app that is sending a DSA signature with certain requests. Initially, I would just like to be able to hook the method performing the signing and dump the arguments. In ghidra, I can see ...
Jon's user avatar
  • 177
0 votes
0 answers
28 views

Ida Pro: how do I iterate over all typedefs in python

I see how to iterate over all structs, unions, enums, functions. But I cannot find a way to iterate over all typedefs.
thatshowthe's user avatar
0 votes
1 answer
23 views

Buspirate_spi and flashrom opensource software

I have a question about buspirate_spi programmer and flashrom. I have a new Flash rom Boye BY25Q128AS similar to the winbond W25Q128.V in the flashrom list. How can I dump the data from this specific ...
Renin Roy's user avatar
0 votes
0 answers
20 views

wWinMainCRTStartup and wWinMain are filled with uninitialized memory

I have a PE executable (32 bit) GUI program and I tried to reverse engineer it. I opened it in Ghidra and discovered the entry calls wWinMainCRTStartup. However, when I checked wWinMainCRTStartup all ...
notabot's user avatar
1 vote
0 answers
47 views

Argument section recovery for binaries

I am developing a static analysis automation tool to help me on CTFs. It would be nice for me to discover from where a certain argument of certain functions is coming from (does it come from a ...
superuser's user avatar
0 votes
1 answer
43 views

Why does the value stored in a register change after an x/s call? (GDB)

I have run the following commands at a breakpoint in gdb and I don't understand how the x/d $rdx commands returns two different values, one before and one after x/s $rdx is executed. To my ...
GS343597's user avatar
2 votes
0 answers
50 views

Changing instruction that was misidentified in IDA Pro

I am trying to compare a source code to a disassembled version of a Sega Genesis (68000 processor) game. I ran the binary through IDA Pro 7.7 to disassemble it, and when I was going through the code ...
John G's user avatar
  • 21
0 votes
1 answer
53 views

how to print non printable address using python

i have been doin ctf challenge and came across a problem when i have to push the address of a function into eip{instruction pointer} by overflowing the buffer but the main problem here is that the ...
Zishan Ansari's user avatar

15 30 50 per page
1
2 3 4 5
195