All Questions
1,890
questions with no upvoted or accepted answers
4
votes
0
answers
3k
views
Well-known JSON obfuscator that puts the string "Salted12" in front of obfuscated files?
I have an application that pulls some JSON definition files from the internet. In former versions of the application, these files were genuine json files; now, in a later version, they seem to be ...
- 12.8k
4
votes
0
answers
778
views
Need help figuring out compression used on a PKDPX file from a Nintendo DS game
So, I've been working on reversing several file formats from the Nintendo DS game Pokemon Mystery Dungeon: Explorers of Sky.
So far most formats were pretty easy to reverse, until I stumbled on a ...
- 41
4
votes
0
answers
317
views
funcap not capturing information in IDA debugger
I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
- 1,022
4
votes
0
answers
327
views
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.
...
- 197
4
votes
0
answers
3k
views
IDA pro and Bochs Debugger
I am debugging a shellcode in IDA Pro
IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2
I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
- 765
4
votes
1
answer
53
views
Trying to use Cycript to access element in the current windpws
I am using cycript,but I have tried some of these commands and not sure where I went wrong.
cy# UIApp.windows[0]
#"<UIWindow: 0x102d0b2d0; frame = (0 0; 320 568); gestureRecognizers = <...
- 161
3
votes
0
answers
42
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
43
views
IDA Pro debugging an ARM binary on windows with QEMU
I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
- 31
3
votes
0
answers
51
views
What is the best emulator/environment for android debugging?
I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want.
There are fast emulators but they don't provide ...
- 41
3
votes
0
answers
29
views
How to unpack emotet with x64dbg and do dynamic analysis?
I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
- 31
3
votes
0
answers
55
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
3
votes
0
answers
72
views
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
3
votes
0
answers
43
views
How to see parameters in stack in x64dbg like in OllyDbg for known API calls?
Based on Detailed API call descriptions not available in x64dbg
When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack:
I've installed both ...
- 161
3
votes
0
answers
37
views
Cant find the string "AutoOpen" in a macro enabled Word document
So, I was testing a Yara rule which goes like this:
rule macro_auto_run
{
meta:
description = "Document with macro that auto runs"
strings:
$s1 = "...
- 319
3
votes
0
answers
40
views
Contents of EAX in IDA Free?
I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.
In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
- 185
3
votes
0
answers
163
views
Is it possible to use GHIDRA to decode .NET ? (1 lvl crackmes with solution, but not in GHIDRA)
I am a beginner, I want to decode 1 lvl in crackmes, I downloaded a GHIDRA as my main tool. I've got a simple keygen app.
Here it is: https://crackmes.one/crackme/5ab77f6433c5d40ad448cb2d. The ...
- 31
3
votes
0
answers
48
views
How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?
I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail.
I'm originally a Windows programmer, ...
- 1,517
3
votes
0
answers
77
views
How does google.com detect I'm in Firefox when already using Chrome's user agent
It's well known that google.com doesn't show the microphone search icon in Firefox, probably to incentivize people to use their web browser. (They give it on youtube.com, which is weird for being ...
- 131
3
votes
0
answers
52
views
How to read the content of these files?
I am looking for a way to read the content of these two files. If that is possible, please let me know.
Google Drive link for the files
- 53
3
votes
0
answers
42
views
x32dbg version causes crash on breakpoint
i'm a newbie to this whole shindig, and have started with https://gamehacking.academy. i'm finding this fun, but am getting stuck here: when i try to apply a breakpoint using x32dbg, as in https://...
3
votes
0
answers
73
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
3
votes
0
answers
43
views
Using "map to another variable" in IDA
I am using in IDA. There is a feature which is called "map to another variable".
but it asks from me to map from the variable from a list. How do u know the exact variable to map into ? (I ...
- 31
3
votes
0
answers
70
views
How do i set these tricky boolean values to true in Smali-Dalvik?
These would allow me to make the input text field clickable and editable but the thing is how to do this.
Instance field
.field private g:Z
1 -
invoke-virtual {p1, p2, v0}, Landroid/content/res/...
- 31
3
votes
0
answers
63
views
How to decrypt query string of an url
I need to decrypt the encoded part of query string i.e. Q7eM0euncHNyrhJPjN06lw== and sWmYdMUi01BJplzumEaxTw== from the following urls?
https://eregistration.gov.bd/deed-check/view-deed-summary?...
- 161
3
votes
0
answers
32
views
How do I make a text field editable when the app is designed to autofill OTP SMS?
Hello fellow rev engineers,
I'm running an app in an emulator and the problem is that for registration it must autofill the OTP sent by SMS, the text field isn't editable/clickable and I can't advance ...
- 31
3
votes
0
answers
88
views
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
- 31
3
votes
0
answers
69
views
Determining power supply needs for a first class, reclining airplane seat
I have a Sicma Majesty 1606 seat pair from a retired Boeing 767-300. My goal is to provide power and get them working as reasonably functional and fun home furniture for a living room. I'm documenting ...
- 31
3
votes
0
answers
146
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 185
3
votes
0
answers
36
views
Linux persistance between runs of program but not between reboots
I am working on reverse-engineering a linux program with a function that reads in configuration information from a file, and then passes this information to the program. However, after I fully exit ...
- 31
3
votes
0
answers
29
views
Reverse engineering a predictive model with lots of example inputs/outputs
I'm working on a project to approximate an existing model that generates prices for an asset given a large number of input variables. The model comes with ~1,000 unique example lines in batches of ...
- 31
3
votes
0
answers
120
views
x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION
Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So ...
- 31
3
votes
0
answers
107
views
How to determine the encryption type/structure used on a .dat file
I have a .dat file that is saved by a Delphi 5 application. It is basically the applications backup file for it's internal database.
I can't seem to find what type of DB it is. The file starts with ...
- 131
3
votes
0
answers
101
views
How can I disable watchdog in U-boot using mw command
So I have DVR with 2*Hi3511RBC CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ) and when I enter U-boot (how do I know that I'm in U-boot ? ) well over UART I get following message
U-Boot 1.1.4 (...
- 505
3
votes
0
answers
172
views
Is there an MFC Decompiler available?
I want to know if there is already an MFC Decompiler?
So far, you have to decompile by hand - which is very tedious.
I would like a tool like DeDe Decompiler. The C++ code itself is not important. It ...
user42316
3
votes
0
answers
24
views
db section in hopper
There is a db section in hopper, which cause the code not being able to go to control follow graph mode
Do advise what cause this issue:
; Section __cstring
; Range: [0x10000a2c0; ...
- 161
3
votes
0
answers
46
views
Identifying a hash function knowing both input and output
I am creating a custom client for an old game. Now I got stuck on login to the server. I made several experiments with wireshark but it doesn't seem to be any common hashes.
From my limited ...
3
votes
0
answers
295
views
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
- 239
3
votes
0
answers
134
views
Flashed "compatible" firmware onto two generic Allwinner A50 tablets
I'm already at least 3 days on this and can't find a way out. I'm still unsure if it fits here, but here we go!
I have 3 A50 Allwinner tablets (HOW HT-705XT) that I wanted to root. Since the only way ...
- 51
3
votes
0
answers
64
views
Java Byte Code Debugger
I'm trying to reverse a highly obfuscated program written in java. None of the deobfuscators seem to work so I have been poking at it in eclipse. I can attach to a running process and have figured ...
- 131
3
votes
0
answers
229
views
Ghidra view stack frame values
I'm learning reverse engineering, and I'm using Ghidra's debugger to analyze a running program. I want to view the values that are on the stack for a function, but I can't figure out how to do this.
I'...
- 131
3
votes
0
answers
86
views
How the hash/code in url is generated
I am trying to scrape publicly available sites by urls. But the problem is I can not understand the urls needed to be accessed.
URLs are like
https://ldtax.gov.bd/ldtax-holdings/individual-rashid-...
- 161
3
votes
0
answers
60
views
Where can I find documentation for IDA Freeware?
I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?
- 131
3
votes
0
answers
198
views
Weird anti-debugging mechanism
I am trying to grasp an anti-debugging trick used in this program. Upon attaching any debugger (x64dbg, VEH debugger) the software crashes after about 2 seconds.
x64dbg shows me that the following ...
- 151
3
votes
0
answers
32
views
Can I get thread counts remotely with Immunity Debugger
I am debugging a program on a Windows server with Immunity debugger.
Immunity debugger offers a remote command line client. I can do basic tasks through this command line.
But is there a way to get ...
- 777
3
votes
0
answers
51
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
- 131
3
votes
0
answers
72
views
How can I progress reverse engineering this Novatek NT96650 firmware
I'm trying to RE a Novatek NT96650 based trail cam. This device is circa 2012, and has a MIPS32 24Kec core.
I have copies of the firmware,
I have extracted the contents of flash,
and have a pretty ...
- 31
3
votes
0
answers
88
views
How do I log a string in smali without its obfuscated function?
I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish.
String stc = ("msg=" + ...
3
votes
0
answers
106
views
What Checksum Algorithm used
I have blocks 1 to 4 of an RFID card with 4-byte Hex data each. Block 5 contains some sort of 4-byte Hex data checksum which I would like to know how it was derived.
Please see the 3 sample data below:...
- 71
3
votes
0
answers
31
views
How to view a QJsonValue while debuging exe with IDA
I'm step by step debugging a program in IDA.
The program uses the Qt-toolkit.
The function that I'm stepping through is handling a json document.
For example here it is accessing the key workgroup and ...
- 31
3
votes
0
answers
79
views
Exporting patches as loader in x64dbg?
Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection?
The resulting file should function as a ...
