All Questions
1,890
questions with no upvoted or accepted answers
3
votes
0
answers
187
views
Reverse engineering firmware to CD/DVD drive to enable scrambled mode support
I am a volunteer of the redump.org project, the goal of our website is to archive game CDs in the best possible quality. Unfortunately, this site requires only DiscImageCreator to be used for CD and ...
- 31
3
votes
0
answers
426
views
How to deal with this Ghidra decompile error?
I'm getting the following Ghidra decompile error on one function:
Low-level Error: Symbol $$undef00000008 extends beyond the end of the address space
I don't see anything unusual about the ...
3
votes
0
answers
36
views
How to patch bootstrap in NAND flash?
I read the layout or my NAND flash and saw that in the beginning of flash there is a bootstrap the the CPU load. That flash has ECC
I read/write that flash.
How can I analyze the bootstrap and change ...
- 181
3
votes
0
answers
60
views
Cutter console does not show printf result
I'm using last version (2.0.5) of Cutter. I am not able to find a way to display std in/out in Cutter Console. In the picture I cleared the console before starting debugging and you can see it after ...
- 31
3
votes
0
answers
888
views
Frida class constructor hook not called while there do exist instances of the class
I have an (obfuscated) app with a certain class from which I would like to hook the constructor. The class has only 1 constructor defined and so I hooked the class as follows:
var Aclass = Java.use('...
- 61
3
votes
0
answers
235
views
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following ...
3
votes
0
answers
219
views
Using angr as a pure concrete emulator
I am able to successfully run my target binary under Qiling, an emulator that supplements Unicorn with hooks for system libraries. I would like to do the same thing under angr. I don't need any ...
- 227
3
votes
0
answers
451
views
Intercepting arguments exchanged (iOS / Objective-C)
Just getting started learning reverse engineering and Frida
Poking around with AirDrop (sharingd daemon)
I have managed to find out from hooking onto the sharingd daemon, that the class ...
- 31
3
votes
0
answers
71
views
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:
if (Status >= 0)
{
// ... some other pseudo code
}
Is it possible to prettify this code with the NT_SUCCESS() macro, like this:
if (...
- 10.8k
3
votes
0
answers
109
views
WinApi of UWΡ Shаdοws
I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ.
What I know:
This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
3
votes
0
answers
245
views
Cannot load pdb in IDA Free 7.6
I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach.
I have just installed the last version of free IDA (7.6) ...
- 141
3
votes
0
answers
51
views
Help required to figure out the JTAG or UART pins
I have an old CDMA dongle lying around, so I thought to try to reverse engineer them, but am unable to figure out the UART or JTAG pins, I have attached a photo of the probable pins, can anyone help ...
3
votes
0
answers
211
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
3
votes
0
answers
126
views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
- 31
3
votes
0
answers
51
views
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:
#include <idc.idc>
static main()
{
for (i=0; i<10; i++)
{
PauseProcess();
...
- 371
3
votes
0
answers
86
views
How to go to the variable's stored location directly in decompiler mode of IDA?
When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to "stack locations" instead of the actual address that the variable/...
- 166
3
votes
0
answers
218
views
Where to start with reversing a custom JavaScript VM?
I have recently ran into the most heavy JavaScript obfuscation I've seen. It is using a custom VM to execute bytecodes. I have never dealt with such obfuscation, and I am wondering where I can start ...
- 31
3
votes
0
answers
380
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
- 53
3
votes
0
answers
136
views
Logitech UE (Mega)Boom Broadcast Audio
I am interested to build a tool which can stream audio synchronized to multiple UE Boom speakers.
UE (Mega)Boom speakers already have the ability to build up a broadcast/multicast domain to play audio ...
- 31
3
votes
0
answers
610
views
How can I practically approach VM-obfuscated code with symbolic analysis/execution?
Dealing with VM-obfuscated code and started learning about symbolic analysis but having a hard time wrapping my head around how to practically apply it to a problem. If someone can give me some ...
- 143
3
votes
0
answers
503
views
Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?
I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
- 131
3
votes
0
answers
1k
views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
- 51
3
votes
0
answers
143
views
How to see what has changed in a patched binary?
I am exploring MacOS Deckset app.
It has a trial version available on the official website.
But there's a cracked version available on torrent trackers.
I want to know what was changed by the people ...
3
votes
0
answers
294
views
Garage door rolling code: identifying the implementation
I'm trying to reverse engineer my garage door remote (we're having robbery problems here, so I check if it's a weak point), here's what I found, listening on 868MHz:
There's a "preamble" composed of ...
- 131
3
votes
0
answers
246
views
Display open handle ids in IDA Pro
Is there a way to display all the open handles of a process in IDA Pro while debugging it?
I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.
I want to ...
- 765
3
votes
0
answers
803
views
How to use Ghidra to work with VM obfuscated binaries?
By "VM obfuscated binary", I mean a binary that contains one or more implementations of a VM internally, and also some bytecode that can run on this VM. One of the reasons why this binary is this way, ...
- 454
3
votes
1
answer
866
views
Ghidra Decompiler Optimized Strings
Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:
If I try to set the type of puStack40 to char[38], I get the following ...
- 368
3
votes
0
answers
1k
views
For some reason Ghidra SRE cannot determine some imports
After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect:
DAT_00aea270 FUN_004ae180:004ae1ee,
...
3
votes
0
answers
82
views
How to retrieve generically memory reads of an input and determine all relevant offsets?
I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
- 31
3
votes
0
answers
731
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
3
votes
0
answers
285
views
Blank binwalk and binvis.io
I've been trying to extract a Bluetooth door lock's firmware. When I tried extracting it, I got an empty output.
I then found a post which I thought would help me but when I tried using binvis.io, ...
- 63
3
votes
0
answers
1k
views
Extracting specific files from a unknown archive file format
I'm trying to extract some binary blobs from a unknown archive format. (*.pakz).
I know this archive contains some .xtreme binary files that are the files I'm looking for. My goal is to extract those ...
- 131
3
votes
0
answers
50
views
IDA's debuggers disappeared
Using IDA 7
I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
- 31
3
votes
0
answers
248
views
Uniden FW Hacking
I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly.
FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
- 31
3
votes
0
answers
151
views
What in this modified PE file causes MsMpEng.exe to consume 4 seconds of CPU?
The relevant files for this question are here:
https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip
Contains a before and after DLL. This simple PHP script demonstrates the problem:
<?php
...
- 141
3
votes
0
answers
109
views
Extracting Archive-Like file format analysis that does not seem to match known formats
Good afternoon,
I am looking to try me skills at extracting some data from a proprietary format. I have made some progress but I wanted to contact the experts to see if I could gain some insights. ...
- 131
3
votes
0
answers
51
views
How to prepend offset to smart names?
So I'm trying to reassemble an PE to ELF so I can debug it with rr.
However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
- 445
3
votes
0
answers
146
views
Z3 and If-logic
Z3 is a fantastic tool which helped me a lot! But sometimes I'm stuck on the binary code which implements custom If-logic. Recursive factorial function is good example of it:
def fact(x):
if x == ...
- 111
3
votes
0
answers
226
views
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
- 131
3
votes
0
answers
812
views
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
- 173
3
votes
0
answers
828
views
Android APK debugging: modify value of smali register
I am debugging an apk app that I do not have the sources for. I want to debug it on a smali level, not decompiled.
I used to do this with apktool, but looking at their website, smali-debugging is ...
- 423
3
votes
0
answers
146
views
Reverse engineering non-standard LIN protocol
I'm trying to reverse engineer an ECU / GSU protocol from a model airplane jet turbine, in order to make a telemetry adapter.
I have decoded several other protocols in the past with good success but ...
- 31
3
votes
0
answers
810
views
How to prevent angr from taking dozens of hours and GB of memory solving a (seemingly) simple CTF problem
I was recently working on a (seemingly) simple CTF challenge where the input was a base64 encoded file and the binary would check for correctness in one function call. The catch is that the checking ...
- 183
3
votes
0
answers
427
views
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
- 151
3
votes
0
answers
188
views
Handling firmware with many copies of the same code/data in different address spaces
When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region.
I normal load the code/data into the destination location and leave the ...
- 932
3
votes
0
answers
2k
views
How to decompile a obfuscated mach-o dylib?
I am trying to decompile a dylib called libConfigurer64.dylib, which is loaded from the environment variable "DYLD_INSERT_LIBRARIES"
I want to analyze what it really does, so I dragged it in to IDA,...
- 131
3
votes
0
answers
506
views
Find vtable without complete object locator
I am learning to reverse Visual C++ objects.
I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
- 131
3
votes
0
answers
293
views
radare2 difference between function offset and minbound
I am trying to understand the difference between a function's offset and its minbound in radare2. Consider this function in radare2 (output of aflj):
{
"offset": 4549740,
"name": "...
- 31
3
votes
0
answers
176
views
Recovering data from mystery signal
I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following audio. (Wav ...
- 31
3
votes
0
answers
2k
views
Deobfuscate PHP that contains - goto
I've found a bunch of obfuscated PHP scripts in my server but it seems I cannot deobfuscate them to follow the code flow. I came to the conclusion that the files have been obfuscated with https://www....
- 131