All Questions

Filter by
Sorted by
Tagged with
2
votes
0answers
15 views

How to approach a heavily obfuscated binary

I'm dealing with a binary that has been processed by a obfuscator and looks something like this (short excerpt): 4156 push r14 52 ...
0
votes
0answers
21 views

very weird 2-pin debug header

I'm working on a board with little documentation and a custom MCU (no public documentation). There's a two-pin debug header on the board; at first I thought it was SWD or UART without provided VCC and ...
1
vote
1answer
17 views

How can I easily convert little endian pointers in hex dumps?

I am tracking down a data structure whose address is inside the second operand: mov rcx, qword ptr ss:[rbp+E0] When I look at the value of [rbp+E0] I see the following dump: 21 C4 FC 5E 00 00 00 00 ...
0
votes
1answer
24 views

What is the easiest way to dump a REGION of memory in IDA pro?

I'm facing a problem that i need to dump a large region of memory with IDA pro using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
1
vote
1answer
28 views

Segmentation fault after export binary file in Ghidra even without any changes

I trying solve some https://crackmes.one/ simple quests. I newbie on it. But after export binary file (even without any changes), when I run the program in the terminal, I get the message "...
2
votes
1answer
29 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
0
votes
0answers
35 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
2
votes
1answer
53 views

Attempting to reverse engineer an iOS OTA payload-like archival format

Apple's announcement of macOS Big Sur had meant the release of the developer beta. In an attempt to create the appbundle from Apple's softwarecatalog, I attempted to study the contents of ...
0
votes
0answers
27 views

IDA Freeware Debugger crash on attaching

I run a binary that I am trying to reverse engineer from terminal and when I try to attach it with IDA debugger it says "OOPS! Internal error 20099" occurred. I am able to load the binary ...
0
votes
0answers
47 views

Testing apk with frida

I am doing some analysis to apk. I the application retrieves from the server an encrypted data and decrypt it in the application and print the data as is. Is there an easy way that i can check with ...
1
vote
0answers
42 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
0answers
18 views

How can I lookup the current address of a location by file address in lldb?

Going back and forth with a debugger, I can very easily determine the file address of a memory location by doing (lldb) image lookup -a 0x102802574 Address: Program[0x0000000000002574] (Program....
0
votes
1answer
46 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
0answers
59 views

Bypassing IsDebuggerPresent

I am currently trying to attach a debugger to a program with a callback for IsDebuggerPresent. Normally, i would patch the program to pass over this check, but patching the program is not an option. ...
-2
votes
0answers
27 views

How to extract xxtea key from this code

I try to use ida pro to extract xxtea key from a lib.so Regards xxtea_decrypt(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4) { longlong lVar1; ulonglong uVar2; ...
0
votes
0answers
22 views

Reverse engineering a command line argument using angr for an aarch64 binary

I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
1
vote
1answer
25 views

How to turn off XREF comments in Ghidra's disassembly view?

Sometimes a function will have a series of XREF comments next to it in the disassembly view such as in the following example: ******************************************************...
-1
votes
0answers
59 views

i need help in compression algorithm identification

okay so, i'm modding a game which has compressed files, as far i could see, it has apparently 2 "compression patterns", files starting with "00 05" and "00 07". I was ...
1
vote
0answers
23 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
0
votes
0answers
32 views

IDA exported header full of errors

Im a noob when it comes to using reverse engineering tooling. I am doing a reversing challenge (pwn adventure 3 CTF) and I am exporting the various types from IDA. The thing is, the header files are ...
2
votes
2answers
34 views

How to call to function while debug

When I debugging remote process with gdb-server and Ida, and put breakpoint in the code, when the process stopped at this breakpoint how can I call to function and after that return to my code ?
-3
votes
0answers
33 views

Need help to extract xxtea key [closed]

I try to use ida pro to extract xxtea key from a lib.so Regards xxtea_decrypt(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) { longlong lVar1; ulonglong uVar2; bool bVar3;...
1
vote
1answer
40 views

How to fix Mach-O headers from a memory-dumped binary to make it usable again?

I am trying to restore a binary from memory. I re-constructed the binary and analyzed it with a disassembler and it looks okay, but when inspecting the headers with otool I'm getting: truncated or ...
1
vote
1answer
58 views

Reverse engineer an HID device - recreate using arduino

I have an HID device that I'm trying to re-create using Arduino, I have captured the USB packets and I have pretty much analyzed all the data I need to operate the device, the only thing I'm not ...
1
vote
0answers
73 views

why Ghidra failed to disassemble, while objdump and IDA got correct results?

I am using Ghidra to analyze libpng-compat.1.5.10.so downloaded from fedora mirrors. But it didn't load correct disassembly, then I use Objdump and IDA to check the code and they get the same results ...
-2
votes
0answers
18 views

how to dec fully script lua [closed]

i try dec some offline game , but what i get inside after the get dec is not gg.command but "local L0_0, L1_1, L2_2, L3_3, L4_4 function L0_0() local L0_5, L1_6, L2_7, L3_8, L4_9, L5_10, L6_11, ...
0
votes
1answer
27 views

Call of a suspicious method cannot be found

i have a strange apk which I took a closer look at, among others with jadx-gui. It is a gaming app that requires an unusual amount of permissions according to the manifest file. I installed and played ...
0
votes
1answer
31 views

What is this line and how to remove it

I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
0
votes
1answer
61 views

How i can grab a pointer or hook the process procedure without creating a global hook

i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do ...
0
votes
1answer
35 views

WinHex : There's a data that does not belong to any module

I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data). Now , when i open the process Entire memory with in WinHex , i can ...
4
votes
2answers
111 views

What kind of function creates this code pattern?

Apologies if this is a duplicate. Don't know what words to search for as that's what the question is about. I'm relatively new to reverse engineering binaries and while using Ghidra I've noticed that ...
0
votes
0answers
19 views

Is it possible to decompile an apk file and create a communication channel?

The reason I want to decompile the apk file is because I am trying to automate some tasks and I want to make the decompile version of the app be able to communicate or take instructions from a python ...
0
votes
1answer
23 views

Windows PE64 throw error while allocating heap for unknown reason?

For some reason i'm not aware of ( some heap allocation limit ) while allocating memory for some classes, an application ( win64 ) raises this exception: DumpedMini Result[0] Exception Code[...
3
votes
2answers
533 views

C++ Unary equals (unary operator=)

In C++ binaries, I find Qt methods like ??4QString@@QEAAAEAV0@AEBV0@@Z which demangle to public: class QString & __ptr64 __cdecl QString::operator=(class QString const & __ptr64) __ptr64 or ...
-2
votes
0answers
21 views

Decrypt Serum VST preset files [closed]

I would like to decrypt a Serum VST plugin file (.fxp). The file looks like this: I would like to see, how the file looks decrypted. Also I would like to change things and encrypt it again. How can I ...
-1
votes
0answers
34 views

Extract and modify mouse [closed]

I found some similar questions here but they mostly seem to be quite advanced cases, I have something which I believe to be on a simplier side, making it an ideal practice for me to learn some new ...
2
votes
1answer
29 views

How can you dump the unpacked version of a packed library/plugin from memory on macOS?

I'm dealing with a custom-upx packed library that I'm trying to unpack. System is macOS. Given it's a library/plugin, it doesn't have a standalone entrypoint. I ran it through a disassembler but wasn'...
2
votes
1answer
45 views

Linux keyboard driver windows reverse engineering

I have toshiba portege x30-f laptop with Fn keys not working under linux. I've read some articles about usb drivers reverse engineering, but the keyboard connected not via usb. As I can understand it ...
2
votes
1answer
52 views

How to set the type of a variable or function to an std::string?

I'm using IDA Pro and have identified a function that takes an std::string as an argument. However when I click on the function and "Set Item Type", entering its definition: std::__ndk1::...
2
votes
0answers
63 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
3
votes
0answers
68 views

How to see what has changed in a patched binary?

I am exploring MacOS Deckset app. It has a trial version available on the official website. But there's a cracked version available on torrent trackers. I want to know what was changed by the people ...
1
vote
0answers
45 views

Same USB packet (Python/user vs C/kernel) but different result

I'm making a Linux module (my first one) for a closed-source, enclosed (no hardware access) device. Using Wireshark I found what to send and where, so I tried the following command in user space ...
1
vote
1answer
40 views

How to import files and analyze it in Ghidra using a python script?

I want to write a script which imports an exe file, analyzes it, extracts some features and saves it using python. The part which I am not able to understand is, how to import a file from the script ...
1
vote
1answer
67 views

Latest VMProtect vs Latest Themida [closed]

I am working on an app to archive some important files in a compressed-encrypted format, What is the best for me to use (Virtualization) VMProtector or Themida ? Thanks in advance
1
vote
0answers
73 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
30 views

How to find DOS Header and PE Header with an entry point in Radare2?

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But ...
1
vote
2answers
45 views

Defining operand as offset

I have an idapython script which automatically defines bytes as code by a predefined configuration. The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
0
votes
0answers
145 views

Extracting information from a random cipher or a binary file

I have measured data comes from a various types of sensors. After measurement, the data encrypted and stored in a memory. We monitor the serial data(via:RS232 from the memory), and the data was ...
1
vote
0answers
45 views

Determining the encoding of an unknown image format [closed]

I'm trying to reverse engineer a REST API and there is an endpoint that delivers images. Some of them are jpegs but other ones look like they're base64 encoded, except they don't appear to be, as they ...
1
vote
1answer
39 views

Click-thru a virtual function in IDA

I'm reversing some stuff that has RTTI, so finding vftables is easy. I have an instance of some class some_object, there is a method being called through its __vftable. The method_4 has a type of ...

15 30 50 per page
1
2 3 4 5
143