All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

What is this CRC32 algorithm (written in C), and how can it be written in Java or Python?

I've been trying to convert this CRC32 algorithm to Java or Python, but I haven't been successful, I believe it's because I'm not familiar enough with c. Note that I believe DAT_804818d0 is the seed, ...
0
votes
0answers
8 views

How to gain access to obfuscated files stored within an app's OBB file?

So, for the last few days, I've been working on this problem. I've been trying to gain access to an Android app's code, and have managed to narrow it down (probably) to the app's .OBB file. I can open ...
0
votes
0answers
14 views

Red color in IDA

Why in IDA the numeric offset next to [ebp- marked with black letters in red background? .text:004015D0 ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)...
0
votes
0answers
12 views

Strategies for dealing with complex tree structures?

I've made quite some good progress in reverse-engineering the game Twisted Metal for PlayStation, if you don't know what it is, basically it's a Mad Max like game where cars have missiles and stuff to ...
0
votes
0answers
7 views

Figure out method name with _dl_runtime_resolve_xsavec

I have a packed Linux shared library that decrypts function stub with INIT_ARRAY. When it's decrypted I'm unable to determine the method name. All method calls are redirected with relocation table. ...
1
vote
1answer
19 views

Trying to reverse web application connection, but the network tab shows nothing

I've been checking out metaverse-sensation Decentraland (play.decentraland.org) and I'm interested in how they've implemented the massive multiplayer netcode to work well for tens of players at the ...
1
vote
0answers
8 views

While debugging kernel ISRs, i need to re set every breakpoint when they are hit ? (IDA pro kernel debugging)

Alright this is pretty weird, my IDA pro is 7.6, and i am debugging an ISR in kernel mode (windows kernel). The weird thing is that inside the ISR, when i set a breakpoint on instruction X, it will ...
0
votes
0answers
23 views

stack explanation from https://revers.engineering/applied-re-the-stack/

I've been reading [1] (By Daax Rynd) to get an understanding the stack and at around the 12th page, I'm a bit stumped by how the value 60 from sub rsp, 60 was arrived at. [Note, all code and quotes ...
0
votes
0answers
19 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
0
votes
0answers
13 views

Put pwntools in DEBUG mode when using library

When using pwntools as a library (that is, not importing everything as an exploit kit, just individual libraries), how can I turn on debug mode, so that tubes print to the screen everything they read ...
0
votes
1answer
29 views

How do I gain access to files that an Android app stores in its persistent internal storage directory?

I was playing a game that had hidden achievements and wanted to find the conditions necessary to unlock these achievements. To do this, I've tried to get the source code of the game, to find the ...
0
votes
0answers
21 views

How to determine file system or open unknown .img file

I have a .img file which will not mount, open, extract or anything within Windows using either the tools built into Windows 10, WinRAR or 7-Zip, they all return errors. I'm trying to look at data ...
0
votes
0answers
12 views

radare2 convenience variables

gdb allows setting arbitrary convenience variables: set $a = "test" set $b = 3 p $a # => "test" p $b # => 3 Is there a way to do something similar in radare2? I'd like to be ...
0
votes
0answers
9 views

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

In IDA Pro, when you create a custom struct, and apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable it only prints ...
1
vote
2answers
71 views

is there a tool to decompile old exe to C?

I follow the free software implementation of OpenRCT2 from the beggining (when it was in other repository). And the first commits are a bunch of C files, these files has a lot of asm blocks of code ...
1
vote
0answers
28 views

Is disassembly of standard gcc programs trivial, or just as difficult as video game ROMs?

I am attempting to do some reverse-engineering of ARM binaries, with the ultimate goal of reverse-engineering GBA ROMs. Of course, GBA ROMs contain a mixture of code and data, so a standard ...
0
votes
0answers
21 views

How to insert asm code in file without overwriting in Radare2

I am learning reverse engineering tools. I notice that when you need to patch some file (as least in visual mode) you need to overwrite instructions, i.e when using shift+a in visual mode or i in ...
1
vote
0answers
16 views

File not want to patch. Radare2

I am learning by doing some cracking in files that i made in C. One of this files is this: file.c: #include <stdio.h> #include <stdlib.h> int main() { char s[15] = "...
0
votes
1answer
63 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
0
votes
1answer
46 views

Program doesn't load a custom .dll from main directory. How can i inject a .dll BEFORE the executable starts?

I want to use DXVK in GTA 5 on Windows 11. Using the needed .dlls (d3d11.dll and dxgi.dll) and launching the game comes with this error Using Process Explorer (while the error message is displayed) ...
2
votes
2answers
181 views

How to load shellcode into Ghidra

I'm trying to learn more about reverse engineering, and I've found some shellcode embedded in a C program: unsigned char shellcode[] = "\x48\x83\xEC\x28\x48\x83\xE4\xF0\x48\x8D\x15\x66\...
0
votes
0answers
47 views

Game Hacking Prevention - General Question

So I'm in a middle of developing an online video game for Windows and was wondering, how does games' hacking is even possible? I mean, assuming I calculate the HP and the location of every player in ...
3
votes
0answers
21 views

Intercepting arguments exchanged (iOS / Objective-C)

Just getting started learning reverse engineering and Frida Poking around with AirDrop (sharingd daemon) I have managed to find out from hooking onto the sharingd daemon, that the class ...
2
votes
1answer
31 views

Why does this hooking function work and never cause a "backwards" jump?

//src = the place to write the hook, dst is the function you jump to, len is length //of stolen bytes (MUST fall on a boundray between instructions) BYTE* TrampHook32(BYTE* src, BYTE* dst, const ...
1
vote
1answer
23 views

what is metaData of assemblies and what is used for

hi there I hope you doing well lately, I have searched about ildasm and how to protect my DLLs from reverse engineering, so I found some great open source projects (ConfuseEx..), it works when I tried ...
1
vote
2answers
36 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
0
votes
0answers
27 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
0
votes
1answer
49 views

please explain the difference between the two types of follow

in file i find mov rcx,qword ptr ds:[404320] when I wanted to see what is at the address 404320 i press "follow in dump" and i got a choice between "constant: file.0000000000404320&...
0
votes
0answers
16 views

Unable to redirect program because function address is not correctly written to the heap

I have a heap overflow example program (heap0.c)compiled as follows: gcc heap0.c -w -g -no-pie -z execstack -o heap0 In order to overwrite the instruction pointer with (BBBB = \x42\x42\x42\x42), I ...
0
votes
2answers
42 views

IDA/Olly changing address bytes after patch during debugging on x86

I'm struggling with a patch in an x86 .exe. I replaced a MOV with a JMP but everytime I run the debugger, the address gets modified as a sort of rebasing: BE E4732201 MOV ESI,App.012273E4 should ...
-1
votes
0answers
22 views

How can i read offset from branch opcode of thumb mode

I have a function that can make a branch opcode: uint32_t JMPCode(uintptr_t func, uintptr_t addr) { uint32_t code = ((addr-func-4) >> 12) & 0x7FF | 0xF000 | ((((addr-func-4) >> 1) &...
2
votes
1answer
50 views

Disable optimization of for loops in Hex Rays Decompiler

Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
2
votes
2answers
39 views

How to import macro as enum into IDA Pro?

Is there any tools can auto generate enum type by macro? For example, NTSTATUS in Windows defined as #define STATUS_ILLEGAL_INSTRUCTION ((NTSTATUS)0xC000001DL) #define ...
1
vote
1answer
37 views

Double jump when calling functions

I wanted to ask why there is a double jump when calling some functions? For example first call: .text:005AC266 push eax .text:005AC267 call j_WinRegisterWindow ...
0
votes
1answer
51 views

Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?

In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
0
votes
1answer
35 views

How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?

; PCWSTR __stdcall RtlGetNtSystemRoot() public RtlGetNtSystemRoot RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p ...
0
votes
0answers
57 views

What do these offsets in the function calls mean?

I am using Ghidra to reverse enigneer a PE file, and I found a lot of function calls that look like this: (**(code **)(*(longlong *) inBunch + 0x30))(inBunch, local_res18, 4); I am very confused, ...
0
votes
1answer
36 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
0
votes
0answers
22 views

help me to debug file packed with molebox and proteced with obsidium

I have a exe file that packed with molebox and protected with obsidium. I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file it says "Component '...
1
vote
2answers
83 views

Does Microsoft's C++ compiler add functions?

I'm working on reverse engineering a classic game (early 2000s) and am fortunate enough to have debug symbols for a different platform other than PC for reference. I've noticed that the same functions ...
0
votes
0answers
41 views

What are hackers hacking in GTA 5's unofficial multiplayer?

I know about changing values in RAM, but how do they create a vehicle or other object in the game? After all, they need to create something, and not just change some value in RAM? Do they hack the ...
2
votes
0answers
38 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
0
votes
0answers
19 views

How to change the color of a graph edge and custom hints in IDA

I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
-2
votes
1answer
163 views

Windows reverse engineered?

Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
1
vote
0answers
26 views

CR16C architecture code pointers in Ghidra?

On CompactRISC CR16C architecture, because instructions only start at even-numbered addresses, code pointers (as used by JAL, JUMP, Jcond) are shifted one bit to the right. These are distinct from ...
0
votes
0answers
17 views

Binwalk, what's advantage of "Show results marked as invalid"?

I'm trying to understand -I option in binwalk. It provides some interesting output yet it isn't clear if these results are "invalid" or if they are valid results of a special type. DECIMAL ...
2
votes
1answer
40 views

Dynamically linked shared objects

From some time I struggle with the dynamically loaded object into process memory. How it exactly works? I found a lot of materials telling that shared objects shares the same code and has only on ...
1
vote
0answers
57 views

Extracting Binary Stream inside an mp3

In the song Chisel by Pruient there seems to be what sounds like a binary octet stream starting at 4:43. The section of noise has distinct sections punctuated with momentary silence which leads me to ...
1
vote
0answers
18 views

silvio packer for shared libray leads to error: "ELF load command address/offset not properly aligned"

I'm trying to implement a packer based on silvio infection. The packer works fine for ET_EXEC. However, it failed with "ELF load command address/offset not properly aligned" error for the ...
1
vote
0answers
22 views

radare2 Loop over literal strings for search

In radare2, I can search and grep e.g. / needle ~:0 2>/dev/null. How I can I do that in a loop for multiple needles? E.g. something like for n in needle1 needle2 needle3; do / $n ~:0 2>/dev/...

15 30 50 per page
1
2 3 4 5
170