All Questions

2,140 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0 votes
0 answers
59 views

is it possible to get code out of chipset through reverse engineering?

for example, encryption/decryption mechanism was inbuilt in a chip, to get the code that performs this mechanisms, is there some ways you can get this code through reverse engineering? what tools and ...
hanan's user avatar
  • 309
0 votes
0 answers
80 views

Does anyone have any information about the file format of a .jdb2 (Jeb Decompiler's Project file) or how to fix one that is corrupted?

I have a .jdb2 JebDecompiler project file which is corrupted and JebDecompiler can not open it. Any information about .jdb2 file format could be useful for me in order to read data from it and even ...
test_dev dev_test's user avatar
0 votes
0 answers
514 views

Extract smartwatch firmware bin file

I'm trying to extract files from a bin file that's the firmware of a smartwatch. I tried using binwalk -Mre firmware.bin but got no files, this is the result: How should I extract/modify this bin ...
Kazem Ma's user avatar
0 votes
0 answers
393 views

How to get symbol in IDA like done in BN code

I am converting BN code into IDA Pro and stuck at this point, following are lines in the code which gives the symbol call #####Get call symbol (if it exists) dr.get_symbol(inst.tokens) and ####### ...
Nav60's user avatar
  • 1
0 votes
0 answers
187 views

Unknown filesystem in GoPro Hero 9 firmware

I'm trying to extract the GoPro Hero 9's firmware to tweak some of the parameters. This is my first time doing any sort of reverse engineering but I'm hoping that by finding the filesystem I can ...
kevmo314's user avatar
  • 101
0 votes
0 answers
299 views

Modify framework.dex which is in boot.oat?

I pulled down boot.oat from an API22 Android phone. It's Android 5.1 Lollipop which brought the change from Dalvik to ART and is a bit mistified. As far as I understand, modifying boot.oat is not easy,...
Daniel's user avatar
  • 101
0 votes
0 answers
44 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
Jhon's user avatar
  • 9
0 votes
0 answers
404 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
Steven Kyle's user avatar
0 votes
0 answers
107 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
Arush Agarampur's user avatar
0 votes
0 answers
68 views

Basic Block generated by IDAPython code are different compared to BN generated output file

I have a query regarding different BB count using two different tools. I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
Nav60's user avatar
  • 1
0 votes
0 answers
126 views

Is it possible to extract the header files used by a Mach-O 64-bit SDK Binary?

I have a Mach-O 64 bit SDK that I've opened up with JEB (community edition) and I'd like to know if it's even possible to see things like the header files (.h) used/referenced by the binary. The ...
Tikiyetti's user avatar
  • 101
0 votes
0 answers
3k views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
c00000fd's user avatar
  • 1,649
0 votes
0 answers
969 views

Improving Ghidra's Auto-Structure creator

I'm currently attempting to read decompilation in Ghidra. I've identified what I believe to be a "God object" that the library is uses to store state for the entire program. It's passed ...
Carcigenicate's user avatar
0 votes
0 answers
88 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...
Maxim van Dijk's user avatar
0 votes
0 answers
147 views

HTTPS post request not showing up in http debuggers

There is this program I'd like to debug of which I already have the source code. When I run the program, it sends a post request to a specific URL with JSON data, but it doesn't show up in http ...
Nqndi's user avatar
  • 35
0 votes
0 answers
259 views

Checksum verification of an apk does not the same as my java program

I'm from the sysadmin side of the IT and have not much experience in programing. I have an app that lets me screen share Android apps on my car's display. Sadly there is a whitelist baked into the app,...
Simon Sutter's user avatar
0 votes
0 answers
372 views

Decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt?

Can I decrypt AES-256-GCM TLS 1.2 encrypted packets, I have the key but I don't have the IV can I still decrypt? I am getting these packets from wireshark. I know that the IV might be at the front of ...
Ova Fleming's user avatar
0 votes
0 answers
323 views

How can I get a value from a memory address that changes almost every millisecond?

After a lot of time, I found an address in the memory that has the target value but there is something unusual in that address! that address changes every millisecond. ScreenShot: I did a hardware ...
Lion King's user avatar
  • 269
0 votes
0 answers
687 views

Bypass Javascript Debug Prevention in Firefox

I've looked around, and can't find an answer for my specific question. The closest I could find was this. I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
Enki's user avatar
  • 1
0 votes
0 answers
71 views

How to maintain function ordering in an executable when replacing machine code with C step by step?

I am working on reversing a DOS game consisting of 16-bit MZ EXE files. I was able to determine the exectuables were generated by Microsoft C v 5.10, and loading the signatures from the static ...
neuviemeporte's user avatar
0 votes
1 answer
810 views

Extracting Userdata from Userdata.bin file backup of oneplus 7pro mobile

I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows DECIMAL HEXADECIMAL ...
pdjam's user avatar
  • 1
0 votes
0 answers
79 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
Rabbit's user avatar
  • 36
0 votes
0 answers
1k views

Reversing PYARMOR (?)

I have already decompiled an .exe file and reached to a .py but it is obfuscated using PyArmor. I have already used ''https://github.com/nlscc/unpyarmor'' to try it, but could not figure it out how to ...
Kyogin's user avatar
  • 1
0 votes
0 answers
176 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
Jakub's user avatar
  • 1
0 votes
0 answers
576 views

Decompiling exe to python source code

I've recently tried to decompile a .exe to .py source code. It partly went well as the majority of the .pyc got translated into python code but partly also failed. Like the following part: --- This ...
Eva's user avatar
  • 1
0 votes
0 answers
316 views

Help me please decode the string (looks like gzip but it is not)

The software sends to the main server such string: \x1f\xe2\x80\xb9\x08\x00\x00\x00\x00\x00\x04\x00E...\x03\x00\x00" decode_gzip(body) Later I've tried to decode it through different online ...
SKulibin's user avatar
  • 101
0 votes
0 answers
1k views

unix executable Error: Reading 0x1b50 bytes extends past end of file for string table

info on the file it is called ld it is a command for linking elfs called link editor. Does Error: Reading 0x1b50 bytes extends past end of file for string table mean I am missing some kind of offset? ...
Peter Robertson's user avatar
0 votes
0 answers
68 views

Determining a password-hashing function knowing plaintext + output

I have a password that has been stored and I'd like to figure out how it's been 'transformed' to be stored in my database. The plaintext password is: k4oK203$ And the password as it is stored 'crypted'...
carl.hiass's user avatar
0 votes
0 answers
234 views

/bin/sh shell not execute when performing ret2libc attack

I have attempted to do a ret2libc attack. It's a simple buffer overflow with the return address pointed to the system call with the string "/bin/sh" on the stack. For some reason, when I try ...
JamesQuinn's user avatar
0 votes
0 answers
44 views

Can you strip a mips64 object file?

-strip doesn’t know what this file is but read elf and objdump recognize it read elf gives entry and all the headers. I’m trying to find main() or the start function. Can I strip the file? Do I need ...
Peter Robertson's user avatar
0 votes
0 answers
391 views

Loading a U-Boot ARM flash image into IDA Pro

I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
nyaol9's user avatar
  • 31
0 votes
0 answers
958 views

Ghidra unable to find the JDK

Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...
Amit wadhwa's user avatar
0 votes
0 answers
6k views

How to decompile a unity apk to a project?

I have tried to decompile a variety of APK's built with unity, but the tools i have used (uTinyRipper, iLSpy, some others) give me some files which give me errors and incomplete code/assets. I see ...
Zopolis4's user avatar
0 votes
0 answers
649 views

Debug multithreaded program in X32dbg

I am still quite inexperienced in reverse engineering. I have a small program that establishes an HTTP connection to a server and send data via POST method to the servert. I see strings like Winhttp....
ppp's user avatar
  • 1
0 votes
0 answers
131 views

Cannot find audio file type

I'm trying to find the audio file type of this file (extension wtj) around 8 minutes). I extracted it from a music box. I've tried many things: Open in Winamp and VLC => no luck Open with ...
Daniel's user avatar
  • 101
0 votes
0 answers
81 views

SSL pinning deep problem

I'm working on one Android app for potential malware analysis and I am trying to MITM it. I found out that the verify function never executes (X509 class) when i hook onto my proxy but rather that app ...
TrueStar's user avatar
0 votes
0 answers
235 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
ringXzero's user avatar
0 votes
0 answers
141 views

How do I decode or decompile this class It seems codes are encrypted?

I've used JD-Gui, Luyten and other couple of Java Decompilers but it's not working what is the problem in here? Thanks! It's A Mod (Minecraft) and I'm porting into different versions. Code: public ...
PoppyDude's user avatar
0 votes
0 answers
787 views

Can I ignore this Ghidra USTACK var?

I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can ...
Perolan's user avatar
0 votes
0 answers
61 views

exports kernel Windows for informations on hardware

Good day! I develop small security software and use a driver like any modern security software. Can you please tell me if there are any exported functions from ntoskrnl.exe or hal.dll or other kernel ...
ALex's user avatar
  • 21
0 votes
0 answers
31 views

Referenced Memory in runtrace for OllyDBG 1.x

I wanted to know if there is any way I could get the referenced memory in the run trace? I tried using OllyDBG 2.x but it doesnt seem to work.
Dhawal Darji's user avatar
0 votes
0 answers
90 views

Radare2 is showing weird disassembly as compared to disassembly of gcc

Today i was playing around with c code in r2. I compiled a file which had the following code. #include <stdio.h> int main(){ int a=9; float b=1.1; int sum; sum = ...
Mr. rc's user avatar
  • 45
0 votes
0 answers
190 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
LucaG's user avatar
  • 1
0 votes
0 answers
149 views

x64dbg & Ghidra change combobox properties app in Visual C++ MFC

Hello in the program code the property combobox is changed from enable to disable I would like to change that the program does not change this property. I have found commands that assign new items to ...
Jorr1's user avatar
  • 1
0 votes
0 answers
35 views

Is this a checksum/CRC response or cryptography?! Thanks

I've been pointed here from the Cryptography Stack Exchange so hopefully you can help me here! Long version of the story at the end....the short version is... I want to identify this CRC/cipher/crypto ...
joehodgy's user avatar
0 votes
0 answers
73 views

Is there a way to aid the IDA decompiling process?

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
rec's user avatar
  • 475
0 votes
0 answers
179 views

Why won't Radare2 display main's paramethers of a 32bit ELF on a 64 bit machine?

I am new to reversing and currently trying to follow this tutorial, in which the binary provided was compiled on a 32 bit machine hence the file is a "ELF 32-bit LSB executable". It runs ...
Yuran Pereira's user avatar
0 votes
0 answers
126 views

Two different values on a register, on the same instruction? (Cheat Engine)

My situation is that I'm trying to find the send function of an online game. I found the buffer pointer and looked what accesses to it. It was obviously an instruction, which used the buffer pointer, ...
Emre Köycü's user avatar
0 votes
0 answers
70 views

Opened up a stick-blender to retrieve its motor but the circuit board broke. What is the circuit I should reproduce?

See question title and pictures. It’s plugged into 230v and has quite high rpm and torque. I’m trying to see if I can reuse this motor in a different application. Edit: Looks like there is a diode ...
Ananas_hoi's user avatar
0 votes
0 answers
523 views

Patching a program in IDA

I've opened a simple Hello World program in IDA (Pro 7.5) like that: global _main extern _printf section .text _main: push message call _printf add esp, 4 push ...
Daros911's user avatar
  • 115

15 30 50 per page
1
36 37
38
39 40
43