All Questions
1,882
questions with no upvoted or accepted answers
0
votes
0
answers
462
views
Does malware ever purposely embed resources to thwart resource analysis and extraction
I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
- 233
0
votes
0
answers
2k
views
How to hack a digital photo frame to remove JPEG compression?
I have purchased this digital photo frame:
http://www.globalshiping.com/en/usb-24-tft-16mb-digital-photo-frame-flash-can-store-32-of-your-favorite-photos.html?language=en¤cy=USD[1]
I am ...
- 11
0
votes
0
answers
961
views
How does iOS hash and salt passwords on its secondary-storage?
I bought a used iPhone from someone, but I accidentally got a lock screen on the phone and can't figure out what the passcode is. Long story short, how does iOS hash the passcodes for entry, what kind ...
0
votes
0
answers
274
views
Weird self-modify instruction
Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address:
DD address1
DD address2
DD myfunction
DD adress4
.. AND SO ON
...
- 1
0
votes
0
answers
128
views
Set up an interrupt handler at kernel mode
I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
- 101
0
votes
0
answers
121
views
Detecting and/or converting binary endianness (PPE [CELL] to Intel)
I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then ...
- 66
0
votes
1
answer
264
views
Handling stack strings in IDA, but with a twist (wchar_t-based, not char-based)
Consider the following disassembly:
mov dword ptr [rbp+430h+var_458], 690068h ; L'i' + L'h'
mov dword ptr [rbp+430h+var_458+4], 2E0064h ; L'.' + L'd'
mov dword ptr [rbp+430h+var_458+8], ...
- 10.8k
0
votes
1
answer
723
views
(Ghidra) How to get the parameter name given a Function object and the storage location as a register string?
Given an instance of something that implements ghidra.program.model.listing.Function, and the register as a string (e.g. x0) how can I get the name of the argument (e.g. param1)?
- 1,341
0
votes
1
answer
526
views
Translate ASM code x86 32 bits in C
I have a exercise which i can't resolve it, and i need help. If anyone can help me it would be great. I have the next ASM code in x86 32 bits which i need to translate in C language:
Dump of assembler ...
- 1
0
votes
1
answer
471
views
Windows User Identification / HWID Limiting
I've been playing a game that has an HWID limit and a bunch of other limitations, such as:
a) Cannot be ran in a VM
b) Cannot be ran using Sandboxie and other Sandbox environments
c) Limits 3 ...
- 1
0
votes
1
answer
141
views
CreateFileA returning invalid handle when file exists
I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
0
votes
1
answer
954
views
How to see the function definition of a function pointer in Ghidra
i was wondering how to get to the function definition of a function pointer. Currently i have a function which is called in the following way:
iVar = (*DAT)(param_2, PTR_s)
When i press on *DAT i see ...
- 11
0
votes
1
answer
117
views
.dll file pull source from compiled study?
Forgive me, I’m new, and not a programmer, but I am needing to see if this is possible.
I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
- 9
0
votes
1
answer
909
views
Resource hacker and Resource tuner don't change taskbar and window icons
I wanted to change a icon of a programs. I tried both Resource Tuner and Resource Hacker programs. When i opened the program there were multiple icons sizes, but when i tried to replace one icon, it ...
0
votes
1
answer
327
views
What is, and why, "byte[ ] + number" in this IDA pseudocode?
This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does?
How would one rewrite this into readable code? I don't mind any programming ...
- 1
0
votes
1
answer
3k
views
Decode 96 column punch card
I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card?
I am doing an exercise but I can't seem to ...
- 21
0
votes
1
answer
278
views
2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]
So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
-1
votes
1
answer
88
views
My IDA have 2 different address for same code How to change it
I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
- 1
-1
votes
1
answer
947
views
Reversing a TXT obfuscated with pyArmor
Ok, so.
PyArmor. Apparently, my friend used it to protect some script, except it's not a python script, it's a few TXT files. Is it possible to reverse engineer it so I can see whats in the actual TXT ...
-1
votes
1
answer
239
views
Call function more times with other args
I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
- 1
-1
votes
1
answer
66
views
can a stdout captured at a parameter to python script
I'm working on a CTF challenge that is find a secret password.This secret password base on the username and password that i input and the hash value had print out after hash calculation and i want to ...
- 1
-1
votes
3
answers
659
views
How to know what does the function do?
I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do.
My question ...
- 9
-1
votes
1
answer
136
views
Is there an ida plugin that disassemble in visual c inline assembly (visual studio)?
I have a question... Is there an ida plugin that disassemble the file in visual studio inline assembly? I found this https://github.com/binrapt/ida but when I load it in ida, it complains about "No ...
- 11
-1
votes
1
answer
121
views
IDA doesn't let me open 32bit .exe vuln program
Today I was reading about vulnerabilities in programs for Windows, and i came across with a vulnerability in VLC 9.0.4. The thing is that when tried to open the .exe to see the assembly, IDA doesnt ...
-1
votes
1
answer
529
views
winmain reversing the assembly to c code
this is I got so far
#include <windows.h>
int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){
int k =0;
int j= 0 ;
MessageBox(0,"crackname","",0);
int i;
...
- 1
-1
votes
1
answer
90
views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
- 9
-2
votes
1
answer
531
views
What obfuscator is used?
In version 3.7.3.7 I was able to modify some parts of the code using dnSpy. The language is C#. But in the new(next) version, I did not succeed and I guess the code is obfuscated. De4dot did not help. ...
- 1
-2
votes
1
answer
1k
views
Aside from Assembly, should I learn C or C++?
With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
-2
votes
1
answer
420
views
EXE Encryption Techniques
Are there any tutorials available for learning how to do encryption of an EXE ? I am particular interested on how it decrypt's itself and runs in memory.
If there are any tutorials or post that ...
- 1
-2
votes
1
answer
3k
views
Change androidmanifest.xml file within apk
I am able to unpack an android apk file with apktool, but when I am repacking the apk file using apktool, it just crashes with errors, and ibotpeaches seems not patching those errors for years. Now ...
- 229
-3
votes
1
answer
2k
views
how to deobfuscate to java zkm?
I will have a question for you, dear forum residents. I have a .jar file encrypted with ZKM which I think will work for me. I don't know how to decrypt this, can you help me?
-3
votes
1
answer
197
views
SQL Anywhere file structure
Where can I find the file structure of a (non-encrypted) Sybase SQL anywhere portable database (for data recovery purposes).
I'm aware of some tools that can do it, but I would like to build my own ...
- 109