All Questions

2,184 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
151 views

Reverse Engineering Technique "Step by Step"

Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game. By researching these projects - I come to the conclusion that: people just took the code from ...
user avatar
4 votes
0 answers
68 views

How to edite a compiled Reactive Native file "main.bundle"

I bought I vacuum robot from Dreame and needed to replace the Lidar sensor myself as in my country (Brazil) don't have technical assistance, but now it is not working properly because it says that don'...
Trix's user avatar
  • 41
4 votes
0 answers
217 views

remove the computrace by flashing the bios

Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
pao's user avatar
  • 81
4 votes
0 answers
246 views

BIOS serial number and UUID tampering

what happens if I tampered the serial number in the bios of a laptop? This laptop was issued to us by our company and what happened was we were laid out without any compensation for what happened so I ...
pao's user avatar
  • 81
4 votes
0 answers
162 views

How can I learn VMP analysis?

I am currently interested in learning reverse engineering, and I have a foundation in assembly, PE structure, and the use of Win32Api. And also have some of the foundation for writing Windows drivers;...
Jack Lee's user avatar
4 votes
0 answers
93 views

Why would a packet-based protocol occasionally XOR it's payload?

I'm REing the Bluetooth protocol for the Ecoflow Delta 2 power station, and so far I've had some success. But there's a strange behaviour that, while not hampering my efforts, has me puzzled. The ...
MerseyViking's user avatar
4 votes
0 answers
112 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
4 votes
0 answers
422 views

Ghidra not loading classes and types of external library

I'm analyzing a mac OS framework, and while redefining types in the decompilation view, I wish to define one of the types as a type defined as NSData class which is defined inside CoureFoundation ...
Jorayen's user avatar
  • 185
4 votes
0 answers
973 views

Finding older IDA files

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64. On the graph view it is only showing the main ...
securityauditor's user avatar
4 votes
0 answers
550 views

Decoding the Apple vendor tag in the 802.11 beacon

Background Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
thewade's user avatar
  • 41
4 votes
1 answer
3k views

Reverse engineering a flutter built apk

I was trying to reverse engineer an apk built with flutter. I actually feel like reversing flutter built apps did not get much reverse writeups on the community. one of the tools for the task ...
hanan's user avatar
  • 309
4 votes
0 answers
65 views

Decyphering 8kbps audio file format used in Solar Chanting Lotus

I'm trying to reverse engineer a solar powered chanting lotus flower so that I might replace the built in audio with something more interesting. The main chip (JL16B-083A - haven't been able to find ...
Captain Lavender's user avatar
4 votes
0 answers
196 views

How to assemble back a disassembled Linux kernel?

I have a Linux kernel file and I need to tweak the contents of its corresponding initramfs. I did it in the past for standard distros where kernel and initramfs were separate. However, this specific ...
Peter's user avatar
  • 141
4 votes
0 answers
545 views

Comparison of Windows Debuggers

I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
jinscoe123's user avatar
4 votes
0 answers
26 views

JTAG Version 2.0 or 2.1

I need to identify which device has JTAG Version 2.1 for TI TMS320DM8168CCYG4 (Digital Media Processor). What socket is recommended?
Charlie Polidoro's user avatar
4 votes
0 answers
129 views

How can I progress reverse engineering this Novatek NT96650 firmware

I'm trying to RE a Novatek NT96650 based trail cam. This device is circa 2012, and has a MIPS32 24Kec core. I have copies of the firmware, I have extracted the contents of flash, and have a pretty ...
Observer42's user avatar
4 votes
0 answers
559 views

Does IDA Freeware 8.x support plugins?

According to the information I searched, it is not supported in IDA 7.x and before. Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before. refer:...
huang's user avatar
  • 223
4 votes
0 answers
218 views

How to correctly inject a [jump + address] instruction into another process (code injection)?

I am trying to inject a jump instruction into another process (External injection), although the injection operation has been completed the address was not correct. For example: unsigned int addr = ...
Lion King's user avatar
  • 269
4 votes
0 answers
146 views

Cutter failing to XREF even a simple 1 line 'Hello world'

The disassembler yields 0 reference to the "Hello world" string! Anyone knows what might be the issue? IDA 8.2 Free and Ghidra find and shows the XREF as they are supposed to.
Jeremy Jordan's user avatar
4 votes
0 answers
332 views

How to debug windows EFI modules during boot using IDA Pro's windbg?

I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
OneAndOnly's user avatar
4 votes
0 answers
70 views

Mouse click breakpoint

Im just start to learn and stuck with problem: trying to set breakpoint on mouse click, but ollydbg log shows me only new thread created or terminated. I did as it is written in these threads: Thread ...
izparika's user avatar
4 votes
0 answers
89 views

Decrypt Keybindings for EVE Online

I've had this idea for a while for a tool I'd like to make to assist people in getting used to keybinds in EVE Online. Not sure how useful it'd actually be, but seems like a fun project nonetheless. I'...
Dealman's user avatar
  • 41
4 votes
0 answers
1k views

Reverse engineering and exactly re-creating a QR code

The Casio FX-991EX calculator has a QR code feature for accessing the current equation from another device. It supports version 3 QR codes for some menus and version 11 for most menus. For example, ...
hopperelec's user avatar
4 votes
0 answers
1k views

Extract disassembly from Ghidra for reassembling

How can I extract a code listing from a Ghidra project such that I can reassemble with something like vasm? I have gone through a memory snapshot and disassembled the code and marked data sections etc....
Robin Elvin's user avatar
4 votes
0 answers
555 views

Ghidra: Reference to external symbols not resolved in decompile

In main() the references to external functions are not resolved in the decompile window, while they seem correct in the assembly: The other functions of the same application are fine, and the ...
flydutch's user avatar
4 votes
0 answers
591 views

Is there a way to reprint the screen in gdb gef?

I am using gdb-gef and I've searched the manual several times for the answer to this question. Sometimes I run a lot of commands and I would like to re-draw the current program state the way gef ...
the_endian's user avatar
  • 1,860
4 votes
0 answers
457 views

Reverse engineering CRC8 algorithm

I am trying to reverse-engineer a protocol which includes a final byte that is (possibly) a CRC-8 with some unknown parameters. I have collected some data, however, the downside is the fixed length &...
Afck's user avatar
  • 41
4 votes
0 answers
2k views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
Benoit POTIER's user avatar
4 votes
0 answers
969 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
A Dark Divided Gem's user avatar
4 votes
0 answers
123 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
Raafat's user avatar
  • 163
4 votes
0 answers
404 views

Using angr as a pure concrete emulator

I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries. I would like to do the same thing under angr. I don't need any ...
SRobertJames's user avatar
4 votes
0 answers
870 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
Capstone's user avatar
  • 143
4 votes
0 answers
455 views

Legality of publishing decompiled code

The situation is the following: Binary file of a computer game from the 1980s. The binary file ran on a platform that doesn't exist anymore (not x86). The binary file does not contain any symbols or ...
trunklop's user avatar
  • 149
4 votes
0 answers
10k views

Reversing Pyarmor Discussion

Anyone messing around with pyarmor recently? For those of you that are unaware of what pyarmor is, its a protection software that is to help obfuscate and protect your software. Heres an image of what ...
Jimmy Hankey's user avatar
4 votes
1 answer
1k views

Ghidra Decompiler Optimized Strings

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so: If I try to set the type of puStack40 to char[38], I get the following ...
genghiskhan's user avatar
4 votes
0 answers
164 views

QEMU Translation block

I'm studying how QEMU translates native basic blocks and runs them. As far as I understand, it reads native basic blocks then retranslates them, but I wonder how it can deal with exceptions inside, so ...
Ta Thanh Dinh's user avatar
4 votes
0 answers
838 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
Martin Brooker's user avatar
4 votes
0 answers
382 views

Trying to identify Renesas custom SoC through CPU die inspection

Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
Dukes Mayonnaise's user avatar
4 votes
1 answer
555 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
Misty's user avatar
  • 428
4 votes
1 answer
481 views

Checksum Calculation

Can anyone manage to work out how the checksum is calculated in the following data? Have tried reverse engineering crc and xor and anything else I can think of. There is a definite pattern there, but ...
Lodge's user avatar
  • 49
4 votes
1 answer
222 views

What is an "mpi register base"?

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
Rulon Rock's user avatar
4 votes
0 answers
975 views

Android APK debugging: modify value of smali register

I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled. I used to do this with apktool, but looking at their website, smali-debugging is ...
bernd feinman's user avatar
4 votes
0 answers
956 views

Using Angr in Vulnerability Research

I would like to use angr for vulnerability research. I was thinking that if I did the following: p = angr.Project('a.out', auto_load_libs=False) sm = p.factory.simulation_manager() while len(sm....
user3753771's user avatar
4 votes
0 answers
306 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
Alexander Goryushkin's user avatar
4 votes
0 answers
128 views

How does cartridge protection distinguish an original vs fake cartridge?

Based on what explained here, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will mark it as protected. What is ...
user avatar
4 votes
0 answers
222 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
Simeon Pilgrim's user avatar
4 votes
0 answers
365 views

Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm

I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far. qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
Mahouk's user avatar
  • 141
4 votes
0 answers
264 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
dajolelor's user avatar
4 votes
0 answers
2k views

How to decompile a obfuscated mach-o dylib?

I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES" I want to analyze what it really does, so I dragged it in to IDA,...
Jemmy1228's user avatar
  • 141
4 votes
0 answers
919 views

Finding decompress algorithm for unknown compression

I have a raw data of what seems to be a compressed PNG file and I need to find the decompress algorithm for unknown compression. You can see the file here. I think they are using some kind of LZRW 1 ...
no01r's user avatar
  • 41

15 30 50 per page
1
2
3 4 5
44