All Questions

2,201 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
56 views

Identifying a hash function knowing both input and output

I am creating a custom client for an old game. Now I got stuck on login to the server. I made several experiments with wireshark but it doesn't seem to be any common hashes. From my limited ...
Luigi Pinnilici's user avatar
3 votes
0 answers
1k views

Problem getting root shell on Ezviz camera

I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
raspiduino's user avatar
3 votes
0 answers
560 views

Flashed "compatible" firmware onto two generic Allwinner A50 tablets

I'm already at least 3 days on this and can't find a way out. I'm still unsure if it fits here, but here we go! I have 3 A50 Allwinner tablets (HOW HT-705XT) that I wanted to root. Since the only way ...
Fusseldieb's user avatar
3 votes
0 answers
96 views

Java Byte Code Debugger

I'm trying to reverse a highly obfuscated program written in java. None of the deobfuscators seem to work so I have been poking at it in eclipse. I can attach to a running process and have figured ...
MDK's user avatar
  • 131
3 votes
0 answers
722 views

Ghidra view stack frame values

I'm learning reverse engineering, and I'm using Ghidra's debugger to analyze a running program. I want to view the values that are on the stack for a function, but I can't figure out how to do this. I'...
Alex Q's user avatar
  • 131
3 votes
0 answers
87 views

Where can I find documentation for IDA Freeware?

I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?
edddd's user avatar
  • 131
3 votes
0 answers
359 views

Weird anti-debugging mechanism

I am trying to grasp an anti-debugging trick used in this program. Upon attaching any debugger (x64dbg, VEH debugger) the software crashes after about 2 seconds. x64dbg shows me that the following ...
millionmilesaway's user avatar
3 votes
0 answers
43 views

Can I get thread counts remotely with Immunity Debugger

I am debugging a program on a Windows server with Immunity debugger. Immunity debugger offers a remote command line client. I can do basic tasks through this command line. But is there a way to get ...
Bob5421's user avatar
  • 797
3 votes
0 answers
72 views

Reverse engineering LCD memory map

I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
artsin's user avatar
  • 131
3 votes
0 answers
232 views

How do I log a string in smali without its obfuscated function?

I'm reversing engineering an app and after analyzing with man-in-the-middle, I find that it obfuscates its messages to the server so it looks like a gibberish. String stc = ("msg=" + ...
r3verse3ngineer's user avatar
3 votes
0 answers
158 views

What Checksum Algorithm used

I have blocks 1 to 4 of an RFID card with 4-byte Hex data each. Block 5 contains some sort of 4-byte Hex data checksum which I would like to know how it was derived. Please see the 3 sample data below:...
Topa's user avatar
  • 71
3 votes
0 answers
38 views

How to view a QJsonValue while debuging exe with IDA

I'm step by step debugging a program in IDA. The program uses the Qt-toolkit. The function that I'm stepping through is handling a json document. For example here it is accessing the key workgroup and ...
user42984's user avatar
3 votes
0 answers
207 views

Exporting patches as loader in x64dbg?

Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection? The resulting file should function as a ...
Halil Nevzat Demirel's user avatar
3 votes
0 answers
138 views

format-string + ret2libc (or format string only)?

I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
98m16's user avatar
  • 31
3 votes
0 answers
64 views

IDA remote GDB debugger cannot suspend linux machine

I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
MrG_1900's user avatar
3 votes
0 answers
302 views

What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?

I’m disassembling binaries in IDA Pro. It usually takes 15+ minutes just to pre-process/open one binary, Then another 20-30 min before IDA is fully done disassembling and finally becomes idle. ...
Jacob Wheeler's user avatar
3 votes
0 answers
85 views

purpose for using a == &a

I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file WPP_GLOBAL_Control == &WPP_GLOBAL_Control Actually, I have seen this kind of ...
anonymous bear's user avatar
3 votes
0 answers
396 views

Delphi MT05.3 ecu

Hi I have a Honda IGX800 V twin engine with a Delphi MT05.3 ecu The engine has an idle of 1400 rpm I would like to be able to gain access to the ecu and reduce the idle rpm to around 950 /1000 rpm ...
Squrcle's user avatar
  • 31
3 votes
0 answers
143 views

Inverter BLE communication module receives commands in HCI_ACL but apk shows ATT

I have a solar inverter which can be queried through mobile apps, eSolar O&M or eSolar SET. My goal is to read values from the inverter (solar power, grid consumption...) by querying the device ...
iMil's user avatar
  • 141
3 votes
0 answers
319 views

Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code

I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
ElenaKarimi's user avatar
3 votes
0 answers
70 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
0 answers
167 views

Reverse-engineering 24-bit to make the lock system recognize NFC cards as their own

I own a lock system that uses SRI512 cards. My supplier (manufacturer of the locks) sells the cards at a very expensive price, so I decided to buy them online. Once they arrived, when I tried to write ...
Andrea P.'s user avatar
3 votes
0 answers
202 views

Solved: Unable to hook Apple binary on iOS 14.x with Frida

I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
AGreen BHM's user avatar
3 votes
0 answers
2k views

Steghide Linux Steganography how to get "Passphrase"

I am currently on Parrot Linux and have an image has a hidden steganographic inside. I know I need to decode it with Steghide in the Parrot Terminal. I also know that I will find out what the hidden ...
DrJacoby's user avatar
3 votes
0 answers
126 views

debug stripped file

I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
timb55's user avatar
  • 31
3 votes
0 answers
49 views

How to debug a file that can't treat with it directly?

I have a game that has ("ex: GameGate.exe") file to open. I found out later that file is not responsible for opening the game directly but it's just a gate to open another file ("ex: ...
Lion King's user avatar
  • 269
3 votes
0 answers
525 views

How to decompile an APK written in Golang?

I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to ...
CJK's user avatar
  • 31
3 votes
0 answers
313 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
Linus's user avatar
  • 31
3 votes
0 answers
163 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
Barakinio's user avatar
3 votes
0 answers
495 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
3 votes
0 answers
74 views

Tracing without breakpoints

I need: To start tracing without breakpoints. To do something in a program. To stop tracing. This step may be replaced with a breakpoint but not the first step. The thing is I need to do some ...
oleedd's user avatar
  • 163
3 votes
0 answers
485 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
Tom Seddon's user avatar
3 votes
0 answers
45 views

Data placement in memory

I am playing with buffer overflow attacks in C. I have the following code: int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory int main(int argc, char**...
Stone Paul's user avatar
3 votes
0 answers
60 views

plugin/script for radare2 similar to mona for immunity debugger

I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
s1gsegv's user avatar
  • 31
3 votes
0 answers
151 views

How to leak buffer address on the stack?

I am new to buffer overflows and I was trying to overwrite the saved RIP to point to a buffer containing a shellcode. The buffer is located onto the stack so its address is randomized. How can I leak ...
Jacob's user avatar
  • 51
3 votes
0 answers
101 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
the_endian's user avatar
  • 1,870
3 votes
0 answers
97 views

Using output of a command as argument in radare2

I'm trying to use the output of a command as argument for my program that i'm trying to debug. I created the following profile, similar to using a command output for stdin $ cat profile.rr2 #!/usr/bin/...
Mime's user avatar
  • 131
3 votes
0 answers
60 views

How to decode a bluetooth package from PH bluetooth meter

I'm trying to perform some Bluetooth reverse engineering with a PH/ORP/TEMP probe. I know where the data comes, but I don't know how to translate it. The probe shows these values in its Android app: ...
pirracas77's user avatar
3 votes
0 answers
94 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
3 votes
0 answers
316 views

How would I crack a software that has Xor encryption

So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
user42257's user avatar
3 votes
0 answers
40 views

Find location to override PC by stack frame with stackoverflow

I have stackoverflow in MIPS arch (without ASLR/canary) In Ida I see that the buffer that has the overflow located in SP+200 In the beginning if function I can see the stack size because I see the ...
Kokomelom's user avatar
  • 281
3 votes
0 answers
243 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
user19819208's user avatar
3 votes
0 answers
555 views

Reverse-engineering the Sony Camset (Camera Settings) file format

Context Newer Sony cameras have functionality that allows them to: save the current camera settings (shooting mode, auto-focus mode, etc.) to a file load the camera settings from a file into the ...
Raleigh L.'s user avatar
3 votes
1 answer
391 views

Changing Offset Value with frida

So I found this offset in ghidra, and I want to change that offsets value in Frida with this picture I have deduced that the offset is 0x6ae210 What I want to do with this is change game....
Rebel Gaming's user avatar
3 votes
0 answers
218 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
EatingTechnobladesRemainsAt3am's user avatar
3 votes
1 answer
773 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
throwawayn000b9999's user avatar
3 votes
0 answers
60 views

Are there sampling profilers for stripped binaries?

I have a stripped binary in which I need to find the code for a particular function. I can run the binary on input which will make it spend a significant percentage of CPU time in that function. Maybe ...
Rafał Dowgird's user avatar
3 votes
0 answers
1k views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 309
3 votes
0 answers
591 views

How to decrypt cocos2d luac type?

I am new with IDA and cocos2d. Since I have learned how to decrypt cocos2d Lua file, I found xxtea tool with Sign and Key and how to find Sign header in some game in Lua file. But that method does not ...
Lan Cuong's user avatar
3 votes
0 answers
674 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
sharma21's user avatar

15 30 50 per page
1 2 3
4
5
45