All Questions

1,884 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
78 views

Exporting patches as loader in x64dbg?

Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection? The resulting file should function as a ...
Halil Nevzat Demirel's user avatar
3 votes
0 answers
80 views

format-string + ret2libc (or format string only)?

I found that we have a format-string bug with in argument 7. I found a function containing system(/bin/sh)). So I'm not saying stupidity I have to mess with a format-string and a ret2libc (correct me ...
98m16's user avatar
  • 31
3 votes
0 answers
40 views

IDA remote GDB debugger cannot suspend linux machine

I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
MrG_1900's user avatar
3 votes
0 answers
94 views

What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?

I’m disassembling binaries in IDA Pro. It usually takes 15+ minutes just to pre-process/open one binary, Then another 20-30 min before IDA is fully done disassembling and finally becomes idle. ...
Jacob Wheeler's user avatar
3 votes
0 answers
67 views

purpose for using a == &a

I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file WPP_GLOBAL_Control == &WPP_GLOBAL_Control Actually, I have seen this kind of ...
anonymous bear's user avatar
3 votes
0 answers
186 views

Delphi MT05.3 ecu

Hi I have a Honda IGX800 V twin engine with a Delphi MT05.3 ecu The engine has an idle of 1400 rpm I would like to be able to gain access to the ecu and reduce the idle rpm to around 950 /1000 rpm ...
Squrcle's user avatar
  • 31
3 votes
0 answers
215 views

Does IDA Freeware 8.x support plugins?

According to the information I searched, it is not supported in IDA 7.x and before. Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before. refer:...
huang's user avatar
  • 213
3 votes
0 answers
100 views

Inverter BLE communication module receives commands in HCI_ACL but apk shows ATT

I have a solar inverter which can be queried through mobile apps, eSolar O&M or eSolar SET. My goal is to read values from the inverter (solar power, grid consumption...) by querying the device ...
iMil's user avatar
  • 141
3 votes
0 answers
104 views

Setting a breakpoint on a shared library's decompiled exported function, and making Ghidra actually stop on that function when debugging a client code

I am very new to Ghidra, so please accept my apologies if my question sounds too simple. Despite the poor quality of the Internet in my country, I tried my best to find an answer online before asking ...
ElenaKarimi's user avatar
3 votes
0 answers
35 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
3 votes
0 answers
134 views

Reverse-engineering 24-bit to make the lock system recognize NFC cards as their own

I own a lock system that uses SRI512 cards. My supplier (manufacturer of the locks) sells the cards at a very expensive price, so I decided to buy them online. Once they arrived, when I tried to write ...
Andrea P.'s user avatar
3 votes
0 answers
143 views

Solved: Unable to hook Apple binary on iOS 14.x with Frida

I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
AGreen BHM's user avatar
3 votes
0 answers
328 views

Steghide Linux Steganography how to get "Passphrase"

I am currently on Parrot Linux and have an image has a hidden steganographic inside. I know I need to decode it with Steghide in the Parrot Terminal. I also know that I will find out what the hidden ...
DrJacoby's user avatar
3 votes
0 answers
70 views

debug stripped file

I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
timb55's user avatar
  • 31
3 votes
0 answers
45 views

How to debug a file that can't treat with it directly?

I have a game that has ("ex: GameGate.exe") file to open. I found out later that file is not responsible for opening the game directly but it's just a gate to open another file ("ex: ...
Lion King's user avatar
  • 269
3 votes
0 answers
262 views

How to decompile an APK written in Golang?

I recently started trying to learn basic reverse engineering and Golang. Decompiling Android apps written in C++ and Java/Kotlin seems easy as there are tons of documents and tools that enable you to ...
CJK's user avatar
  • 31
3 votes
0 answers
148 views

Next steps for android native library RE (JNI_OnLoad, root check)

I'm trying to RE an Android app that detects root on a system. Using frida to backtrace 'access' calls I found out that the root check happens natively: access(/system/xbin/su, 0x0) Interceptor ...
Linus's user avatar
  • 31
3 votes
0 answers
119 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
Barakinio's user avatar
3 votes
0 answers
256 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
3 votes
0 answers
61 views

Tracing without breakpoints

I need: To start tracing without breakpoints. To do something in a program. To stop tracing. This step may be replaced with a breakpoint but not the first step. The thing is I need to do some ...
oleedd's user avatar
  • 163
3 votes
0 answers
244 views

Specifying struct offsets in Ghidra

I'm using Ghidra to disassemble some 68000 code. I only want to look at the disassembly listing, and I have no interest in the decompilation view. Here's one instruction I'm looking at. ...
Tom Seddon's user avatar
3 votes
0 answers
39 views

Data placement in memory

I am playing with buffer overflow attacks in C. I have the following code: int foo(void*, void*); // Calculates the distance (in bytes) between two addresses in memory int main(int argc, char**...
Stone Paul's user avatar
3 votes
0 answers
32 views

plugin/script for radare2 similar to mona for immunity debugger

I would like to use radare2 for windows exploit-development, however I could not find a way to emulate the functionality of using Immunity-Debugger + mona.py when checking for badchars. Is there a ...
s1gsegv's user avatar
  • 31
3 votes
0 answers
268 views

Reversing Novation's Circuit Tracks firmware

Motivation: The Circuit Tracks is a great little groovebox made by Novation, but it feels like they intentionally limited it's capabilities. They also sell the Circuit Rhythm, which has some of the ...
Kosro's user avatar
  • 31
3 votes
0 answers
97 views

How to leak buffer address on the stack?

I am new to buffer overflows and I was trying to overwrite the saved RIP to point to a buffer containing a shellcode. The buffer is located onto the stack so its address is randomized. How can I leak ...
Jacob's user avatar
  • 51
3 votes
0 answers
87 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
the_endian's user avatar
  • 1,770
3 votes
0 answers
61 views

Using output of a command as argument in radare2

I'm trying to use the output of a command as argument for my program that i'm trying to debug. I created the following profile, similar to using a command output for stdin $ cat profile.rr2 #!/usr/bin/...
Mime's user avatar
  • 131
3 votes
0 answers
218 views

Is there a way to reprint the screen in gdb gef?

I am using gdb-gef and I've searched the manual several times for the answer to this question. Sometimes I run a lot of commands and I would like to re-draw the current program state the way gef ...
the_endian's user avatar
  • 1,770
3 votes
0 answers
39 views

How to decode a bluetooth package from PH bluetooth meter

I'm trying to perform some Bluetooth reverse engineering with a PH/ORP/TEMP probe. I know where the data comes, but I don't know how to translate it. The probe shows these values in its Android app: ...
pirracas77's user avatar
3 votes
0 answers
51 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
3 votes
0 answers
244 views

How would I crack a software that has Xor encryption

So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
user42257's user avatar
3 votes
0 answers
31 views

Find location to override PC by stack frame with stackoverflow

I have stackoverflow in MIPS arch (without ASLR/canary) In Ida I see that the buffer that has the overflow located in SP+200 In the beginning if function I can see the stack size because I see the ...
Kokomelom's user avatar
  • 181
3 votes
0 answers
166 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
disharm0niz's user avatar
3 votes
0 answers
107 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
EatingTechnobladesRemainsAt3am's user avatar
3 votes
1 answer
353 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
throwawayn000b9999's user avatar
3 votes
0 answers
41 views

Are there sampling profilers for stripped binaries?

I have a stripped binary in which I need to find the code for a particular function. I can run the binary on input which will make it spend a significant percentage of CPU time in that function. Maybe ...
Rafał Dowgird's user avatar
3 votes
0 answers
649 views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
Benoit POTIER's user avatar
3 votes
0 answers
438 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 279
3 votes
0 answers
332 views

How to decrypt cocos2d luac type?

I am new with IDA and cocos2d. Since I have learned how to decrypt cocos2d Lua file, I found xxtea tool with Sign and Key and how to find Sign header in some game in Lua file. But that method does not ...
Lan Cuong's user avatar
3 votes
0 answers
384 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
sharma21's user avatar
3 votes
0 answers
354 views

Intercept android app DNS lookup with Frida

I have been attempting to intercept when an app performs a DNS lookup using Frida. I assumed that ultimately a DNS lookup will end up in a libc call to gethostbyname or getaddrinfo but this does not ...
SivaDotRender's user avatar
3 votes
0 answers
95 views

Brute Force USB Fuzzing

I am working to reverse engineer a USB based robot arm, but the operating system for the robot won't allow me to create simple enough moves that I can isolate the commands with a USB Sniffer like ...
bcarroll14's user avatar
3 votes
0 answers
84 views

Spy on LCD screen with Raspberry Pi

I have this digital crane scale. It has a 5 digit 7 segment LCD display. My objective is to be able to read what is displayed on the LCD display with a Raspberry Pi. This is what the PCB looks like: ...
Ben Walker's user avatar
3 votes
0 answers
40 views

Image decompression: Reconstructed LZW dictionary somewhat, not exactly matches original dictionary

I am attempting to reverse an animation format that uses (I think) some form of LZW for each of the frames. I have determined that a 12-bit code is used throughout the image. Here is a short target ...
Nathanael Gentry's user avatar
3 votes
0 answers
177 views

Borland C++ 3.0 - Which code might produce this strangely convoluted ASM sequence?

I'm reverse-engineering a DOS binary that was compiled with Borland C++ 3.0, and I'm trying to create C code that will produce the same assembly as the original when compiled with the same compiler. ...
lethal-guitar's user avatar
3 votes
0 answers
68 views

Trying to understand a simple compiled PSI binary file

I was working with an old ios game, and found that it saved most of its data (players, worlds, anything in-between) in MDB files.. titled data.mdb and lock.mdb. There is a pair for every object type (...
Mister SirCode's user avatar
3 votes
0 answers
639 views

Understand a function within Hermes byte code

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode. I was able to disassemble the binary file ...
A Dark Divided Gem's user avatar
3 votes
0 answers
144 views

Why can't I view certain USER32.dll API calls in the disassembly?

I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
n0rmalguy011's user avatar
3 votes
0 answers
104 views

Disable IDA Downloading Symbols Automatically

How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
n0n4meRE's user avatar
3 votes
0 answers
109 views

Reverse-engineering the S-Note (.spd) file format?

Context Samsung phones have an application called 'S Note' that let you use the stylus/keyboard to take notes in a free-form format, similar to Microsoft OneNote. These notes are stored in files ...
Raleigh L.'s user avatar

15 30 50 per page
1 2 3
4
5
38