# All Questions

6,239 questions
Filter by
Sorted by
Tagged with
15 views

### How to display processes that are running of computer in LordPE?

I tried to install some LordPE version but all when I open then no program that is running displayed in LordPE.I don't know why? I hope you guys show me the way to fix this problem.I appreciate all ...
74 views

### Breakpoint in GDB hit 144 times before first call to function

I am working on a reverse engineering challenge and have a binary file. I know how to get the flag by changing the instruction flow after doing a strcmp so I jump to the function that prints the flag....
96 views

### Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
17 views

### LOG Urls that APK requests using smali

I have an APK that uses pinning. I am having an unbelievable time trying to remove the SSL pinning so i figure it might be easier to modify the smali files and recompile to log the LoadURL events. ...
50 views

### How do you mapped a stripped function back to it's real address?

So basically this is a stripped android 32bit ELF (it's just a linux dll with android handle it a bit different - NDK/JNI), and I unpacked it. Now the function inside is cleaner and you can see ...
21 views

### Causeway DOS Extender unpacker?

I've seen an old Causeway Extender unpacker floating around, at some point being on EXETOOLS before they went forum-only, by the name "CauseWay DOS Extender Unpacker v0.17" or "unpcwc.zip". Is there a ...
33 views

### Z3 and If-logic

Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it: def fact(x): if x == ...
48 views

### SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
39 views

### Packet: Game last byte encrypted?

12:14 WSARecv() C3-73-3E-BE-36-2F-14-37-37 F4-44-09-89-01-18-23-00-00 ------------------------------------------ 12:14 send() C3-73-38-31-0E-35-EE-35-A5-35-7F-34-37-37-8D F4-44-0F-06-39-02-D9-02-92-02-...
64 views

### Writing a DLL in C# vs C++? [on hold]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
57 views

### How to add a message box to a PE

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
31 views

### Can any python coder help to port this OLLVM deobfuscator to ida v7 or below? [on hold]

FYI ida plugin can be py script or be c++. This blog written very well on how the deobfuscation concept work. https://rpis.ec/blog/dissection-llvm-obfuscator-p1/ I don't know anything about c++ or ...
99 views

### Where is the ESP after call instruction?

I've started learning the Reverse Engineering and when I read the Stack Operations and function invocation, there are an issue that I'm confused. -What is the address of ESP after "pop ebp" and "retn" ...
60 views

### How to make a program to read Unicode control characters

I'm learning on how to cause a buffer overflow. My victim program has to read input from a file encoded with UTF-16, 2-bytes by 2-bytes, and I want to overrun the EBP with an address like 0x0012F468. ...
45 views

### How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
77 views

### concat22 in ghidra decompiler

Some portion of code I am analyzing gets decompiled as below in ghidra: if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) && (*(uint *)((int)puVar9 + 6) == (CONCAT22(...
65 views

### What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
32 views

### How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
20 views

### Looking for a coder who can RE IOS/Android Apps [closed]

As the title states, Im looking to hire someone who can reverse engineer ios/android apps.
50 views
+100

### Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
48 views

### Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
15 views

### CPU integrated PCI device functions

I'm trying to reverse an Xeon based hardware bios. During the early initialization in the UEFI SEC phase, I stepped into some CPU embedded PCI devices initialization. After few hours researches, I've ...
45 views

### Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
41 views

### Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
36 views

### Can I bruteforce an .nc blowfish-448 encrypted (mcrypt2.2)?

Still a freshie at RE, but during my first expedition I came across some encrypted files. To be specific: _login.nc: mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit Any ...
52 views

### Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
54 views

### How to Calculate ds Pointer

How do I calculate the location of the string in this sample located at offset 0x1CAD8? The instruction at 0x140001A97 in the sample is: 0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + ...
66 views

### Possible to get address of DRIVER OBJECT programmatically?

I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so: 0: kd> !drvobj HEVD 2 Driver object (ffffa70752fdbe30) is for: \Driver\HEVD ...
8 views

### App Store IPA - why it would suddenly need a “provisoningProfiles” entry in Info.plist? [on hold]

An IPA I have acquired from Apple's App Store has a "provisioningProfiles" in its Info.plist. The "provisioningProfiles" entry was not in previous versions of the IPA file. Looking at another few ...
21 views

### Mach-O ARM64 using literal values instead of a frame pointer (BP) register

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
27 views

### ‘Purple Fox’ Fileless Malware - debug swf [on hold]

In reading TrendMicro's write-up(https://blog.trendmicro.com/trendlabs-security-intelligence/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell/), I ...
38 views

### Undocumented Model-Specific Register on Broadwell Microarchitecture

I'm trying to reverse the BIOS of a machine to learn something. The bigger problem I'm facing is that during early initialization, the code is making heavy usage of MSRs, and most of the time, I found ...
80 views

### Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
93 views

.--------------------------------------------------. | [0x804851b] | ...
87 views

### Malware Samples that defeats emulators by using uncommon API calls

I am looking for a few malware samples that detects sandboxes using uncommon API calls. I understand that one of the drawbacks of OS emulated sandboxes is that the malware can use uncommon API calls ...
47 views

### Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
26 views

### Reverse Engineering MS Access Encryption [on hold]

I have an MDB with a column of what I assume to be encrypted data. The application I'm using shows me the unencrypted form of the data so I know what each encrypted string in the MDB column ...
36 views

### Which instruction at which address calls the address 0x1a95 or the address 0x204a in the following program or rather smart contract?

The Ethereum Virtual Machine uses a Virtual Instruction Set flavored for transaction processing that doesn’t use any registers and where all opcodes are a single byte long and have a single ABI for ...
72 views

### Use GCC and objdump to disassemble any hex to assembly code

What would be the best way (also fewer steps) to generate assembly code for a given hex code ? For e.g., if we know the architecture is x86, and given hex value 0x55, what is the best way to generate ...
42 views

### How do I decompile/modify a .dfu file?

I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the ...
31 views

### CRC Checksum? (Used in can open system)

We want to put our own messages on a can-open system. (So we can program our own functions to the system). We can put our message on the system, but when we do this, the safety relay stops the system. ...
23 views

### Regenerate PEM/DER keys from binary blobs

I have the binary blobs for the components of a private key including modulus, publicExponent, privateExponent, prime1, prime2, exponent1, exponent2 and coefficient, what is the easiest way to ...
46 views

### Can I use the Rich Header To Find out Compiler and Linker used?

I heard that I can use look at the RICH HEADER to find out what compiler was used. I looked at the Rich header and I cannot seem to make sense of this. Can I find the Compiler used for this program ...
23 views

### Can't find the missing part in this HEX blob encoding

I've tried everything but it feels impossible to find out what is missing: This encryption is generated by SQL Report Server 2012 and it holds an XML security schema that needs to be edited. It's ...
110 views

### Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
116 views

### Encoding method of float

I'm reversing this game and got stuck. To make it simple, You have some amount of coins in the game (float or double) and you can spend it on some things. I started sniffing network traffic and ...
35 views

### How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW

Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW i tried every combinanated value but without sucess.
73 views

### What kind of compression/encryption could this be?

I am dealing with a file that seems to use some kind of proprietary compression/encryption I can't figure out. I have a lot of sample files as well as different versions of the same file, so I have ...