All Questions
1,882
questions with no upvoted or accepted answers
4
votes
0
answers
28
views
How to edite a compiled Reactive Native file "main.bundle"
I bought I vacuum robot from Dreame and needed to replace the Lidar sensor myself as in my country (Brazil) don't have technical assistance, but now it is not working properly because it says that don'...
- 41
4
votes
0
answers
55
views
remove the computrace by flashing the bios
Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
- 81
4
votes
0
answers
58
views
BIOS serial number and UUID tampering
what happens if I tampered the serial number in the bios of a laptop? This laptop was issued to us by our company and what happened was we were laid out without any compensation for what happened so I ...
- 81
4
votes
0
answers
69
views
How can I learn VMP analysis？
I am currently interested in learning reverse engineering, and I have a
foundation in assembly,
PE structure,
and the use of Win32Api.
And also I have some the foundation for writing windows drivers;
...
- 41
4
votes
0
answers
58
views
Why would a packet-based protocol occasionally XOR it's payload?
I'm REing the Bluetooth protocol for the Ecoflow Delta 2 power station, and so far I've had some success. But there's a strange behaviour that, while not hampering my efforts, has me puzzled.
The ...
- 161
4
votes
0
answers
38
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
4
votes
0
answers
95
views
Ghidra not loading classes and types of external library
I'm analyzing a mac OS framework, and while redefining types in the decompilation view,
I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
- 153
4
votes
0
answers
51
views
Decyphering 8kbps audio file format used in Solar Chanting Lotus
I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
4
votes
0
answers
104
views
How to assemble back a disassembled Linux kernel?
I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
- 141
4
votes
0
answers
90
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 141
4
votes
0
answers
25
views
JTAG Version 2.0 or 2.1
I need to identify which device has JTAG Version 2.1 for TI TMS320DM8168CCYG4 (Digital Media Processor). What socket is recommended?
4
votes
1
answer
139
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 195
4
votes
0
answers
100
views
How to correctly inject a [jump + address] instruction into another process (code injection)?
I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct.
For example:
unsigned int addr = ...
- 259
4
votes
0
answers
62
views
Cutter failing to XREF even a simple 1 line 'Hello world'
The disassembler yields 0 reference to the "Hello world" string!
Anyone knows what might be the issue?
IDA 8.2 Free and Ghidra find and shows the XREF as they are supposed to.
4
votes
0
answers
128
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 469
4
votes
0
answers
49
views
Mouse click breakpoint
Im just start to learn and stuck with problem: trying to set breakpoint on mouse click, but ollydbg log shows me only new thread created or terminated.
I did as it is written in these threads:
Thread ...
- 61
4
votes
0
answers
76
views
Decrypt Keybindings for EVE Online
I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless.
I'...
- 41
4
votes
0
answers
534
views
Reverse engineering and exactly re-creating a QR code
The Casio FX-991EX calculator has a QR code feature for accessing the current equation from another device. It supports version 3 QR codes for some menus and version 11 for most menus.
For example, ...
- 41
4
votes
0
answers
279
views
Extract disassembly from Ghidra for reassembling
How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
- 183
4
votes
0
answers
256
views
Ghidra: Reference to external symbols not resolved in decompile
In main() the references to external functions are not resolved in the decompile window, while they seem correct in the assembly:
The other functions of the same application are fine, and the ...
- 41
4
votes
0
answers
51
views
Why do the first bytes of this executable contain a path to busybox?
I'm reverse engineering an old TP-Link TD-W9970v3 router for fun and wanted to examine one of the executables called webWarn. Ghidra was unable to recognise the format, which surprised me. I then ...
- 141
4
votes
0
answers
337
views
Reverse engineering CRC8 algorithm
I am trying to reverse-engineer a protocol which includes a final byte that is (possibly) a CRC-8 with some unknown parameters.
I have collected some data, however, the downside is the fixed length
&...
- 41
4
votes
0
answers
1k
views
Decompiling an executable compiled by vercel/pkg
I have a .exe file that I am trying to get the source code of, After some digging I figured out that it's in node.js and was compiled using vercel/pkg
I tried using pkg-unpacker however the output is ...
- 41
4
votes
0
answers
222
views
What utilities allow you to debug a process without pausing execution?
I was just reading this answer on StackOverflow, "How can you debug a process using gdb without pausing it?"
The Linux kernel provides some support for this via PTRACE_SEIZE, but gdb doesn'...
- 1,714
4
votes
0
answers
697
views
How to extract sound file from a small 1MB binary
I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
- 143
4
votes
0
answers
396
views
Legality of publishing decompiled code
The situation is the following:
Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86).
The binary file does not contain any symbols or ...
- 149
4
votes
0
answers
142
views
QEMU Translation block
I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so ...
- 1,410
4
votes
0
answers
325
views
Trying to identify Renesas custom SoC through CPU die inspection
Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
- 103
4
votes
1
answer
439
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
- 428
4
votes
1
answer
372
views
Checksum Calculation
Can anyone manage to work out how the checksum is calculated in the following data?
Have tried reverse engineering crc and xor and anything else I can think of. There is a definite pattern there, but ...
- 49
4
votes
1
answer
185
views
What is an "mpi register base"?
For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
- 41
4
votes
0
answers
792
views
Using Angr in Vulnerability Research
I would like to use angr for vulnerability research.
I was thinking that if I did the following:
p = angr.Project('a.out', auto_load_libs=False)
sm = p.factory.simulation_manager()
while len(sm....
- 41
4
votes
0
answers
267
views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
4
votes
0
answers
118
views
How does cartridge protection distinguish an original vs fake cartridge?
Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected.
What is ...
Shabnam
4
votes
0
answers
345
views
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.
qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
- 141
4
votes
0
answers
248
views
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.
- 41
4
votes
0
answers
777
views
Finding decompress algorithm for unknown compression
I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression.
You can see the file here.
I think they are using some kind of LZRW 1 ...
- 41
4
votes
0
answers
2k
views
How to save Radare2 Analysis?
How do I save a radare2 session after I did "aa"?
I know there is a command for saving a project, but this isn't working out for some reason (Ps PROJECTNAME). So I am looking for a way to save my ...
4
votes
0
answers
709
views
IDAPRO from command line interface: Exporting IDB file to BINEXPORT file
I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions:
"<path-to-idaq.exe>" -A -OExporterModule:<result-...
- 141
4
votes
0
answers
65
views
Reverse engineering Nord Lead 4 control board
I am reverse engineering a synthesizer named nord lead 4.
I want to tap in between the control board and mainboard which has the microprocessor.
I didn't start analyzing the signals on the board ...
- 141
4
votes
0
answers
3k
views
What is a TROC Filesystem, and how do I mount it?
I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------...
- 149
4
votes
0
answers
4k
views
View static field values in dnSpy
I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields.
However, per this ...
- 765
4
votes
0
answers
378
views
Trouble finding the right Checksum algorithm
After reading a lot of posts here and their solutions, Punching lines in CRC calculators for several days now. I can't seem to find on which Checksum this code is based.
Background
This is a data ...
4
votes
0
answers
515
views
Radare2 project opening
When I open a project r2 -p mypoject I get a bunch of errors with some numbers:
0
0
Cannot add reference to non-function
Cannot add reference to non-function
1482
I use latest version of radare2 ...
- 41
4
votes
0
answers
320
views
How to perform manual flashing of a bricked device?
I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
- 51
4
votes
0
answers
138
views
DSi Data Recovery Process?
I have been asked to recover data from a Nintendo DSi device that has some critical pictures and audio on it.
After looking closely at the system, it appears that the memory must be integraded onto ...
- 141
4
votes
0
answers
339
views
Modern equivalent to rsymtab for reconstructing symbol table for statically linked / stripped binaries?
I'm working with a 32-bit ELF binary that (I believe) has been statically linked against a few different third-party libraries. It has also been stripped, so I don't have much to go on with respect to ...
- 91
4
votes
0
answers
203
views
Trying to obtain embedded flash memory on MCP5554 microcontroller
I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go.
...
- 51
4
votes
0
answers
2k
views
Reverse Engineering a 8 bit CRC checksum
I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am ...
- 41
4
votes
0
answers
3k
views
Well-known JSON obfuscator that puts the string "Salted12" in front of obfuscated files?
I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be ...
- 12.8k