All Questions
1,882
questions with no upvoted or accepted answers
14
votes
1
answer
4k
views
Howto clone Android RSA SecurID Software Token
At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
13
votes
0
answers
542
views
Problems calculating checksum for AirConditioner
I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes.
I discovered that the upper and lower nibbles need to be ...
- 131
13
votes
0
answers
1k
views
Reverse Engineering 2 byte checksum on RFID card
I am currently researching my studentcard.
Money is stored on this card.
But the vending machine also checks a checksum on the card.
I already did a lot of effort to find it but didn't succeed.
The ...
- 139
10
votes
0
answers
2k
views
Ghidra loading Linux kernel function signatures
TLTR
I want to load Linux kernel headers vs. 4.19 to Ghidra so that it recognizes kernel structures and function signatures.
Full description
I'm trying to reverse engineer a Linux kernel module (...
- 123
10
votes
0
answers
3k
views
RE Tplink TD-W8960N V7
I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
- 265
9
votes
0
answers
1k
views
Firmware analysis, can't find file system
I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
- 91
9
votes
0
answers
364
views
replicate external bank switching in IDA Pro
I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
- 191
9
votes
1
answer
6k
views
How to unpack manually an upx packed elf file
I am trying to learn to manually unpack an upx packed elf file. The examples I have found are for Windows, mostly with Ollydbg, and as I see the first step is to look for pushad and popad instructions....
- 857
8
votes
0
answers
629
views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
- 81
8
votes
0
answers
812
views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
- 81
8
votes
0
answers
3k
views
Identifying a USB device for a forensics CTF challenge (with no GET DESCRIPTOR)
I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no ...
- 363
7
votes
0
answers
284
views
running iOS debugserver on non-jailbroken devices
There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
- 506
6
votes
0
answers
543
views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
- 173
6
votes
0
answers
1k
views
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:
a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
a2ed8: e1a04000 mov ...
- 161
6
votes
0
answers
769
views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
- 428
6
votes
0
answers
950
views
Audio file compression identification
I've been working on reversing file formats from the game of star wars episode 1: the phantom menace.
I have managed to extract the audio files from the .lab file in which they were contained. I ...
- 183
6
votes
0
answers
557
views
How does my S62 engine utilize MAF sensors to convert voltage to mass flow?
We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
- 111
6
votes
0
answers
683
views
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:
Local variables on stack of different types, including types defined in local types window
Local variables of different types ...
- 8,215
6
votes
0
answers
648
views
Shotcuts in immunity debugger
Recently I started using Immunity Debugger instead of Olly where I got really got used to my custom keybidings. I could not seem to find an option to configure shortcuts/keybindings in immunity ...
- 2,028
6
votes
0
answers
2k
views
Why does Hex-rays thinks that 32bit PE is 16bit?
I'm using IDA 6.1 32-bit version.
I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
- 233
6
votes
0
answers
221
views
How to find the symbol table in a TI DSP. (TMS320C5510)
That's it, just want to know how to find the symbol table in a binary I pulled from a DSP chip. I know it could be stripped, just don't know how to tell.
- 401
5
votes
0
answers
124
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 151
5
votes
0
answers
321
views
Patching Jar File (2022)
Currently reversing a .jar program recreationally, and I understand the workflow proposed here:
https://www.netspi.com/blog/technical/thick-application-penetration-testing/patching-java-executables-...
- 51
5
votes
1
answer
2k
views
Huawei HG8245H, can't read some system files
I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:
SU_WAP>shell
...
- 91
5
votes
0
answers
6k
views
Unpack, modify and rebuild an Android App Bundles (.aab) file
I would like to unpack an .aab file, decompile/recompile the classes.dex (baksmali/smali), edit the manifest and, finally, generate a new .aab file.
Basically, I am looking for an apktool for .aab
- 175
5
votes
0
answers
120
views
IDA stack depth differences when branching
I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions.
For example:
call dword ptr [edx+0xC8h]
which is really:
pD3DDevice->SetRenderState();
IDA doesn't ...
- 51
5
votes
0
answers
11k
views
Deobfuscating Unknown C# obfuscator?
Hello,
I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my ...
- 51
5
votes
1
answer
317
views
Are there existing automated approaches to reverse engineering the data types in a binary data stream?
Consider a stream of data packets of a known and consistent size, i.e., N bytes per packet.
Are there existing tools that automatically detect (or estimate) the various data types present and their ...
- 151
5
votes
0
answers
278
views
Radare2 8051 code bank switching
Some of 8051 chips use bank switching to extend accessible code memory.
Good example is Silabs C8051F12x. Another example is here.
Code area in range 0x0000..0x7ffff is common always accessible code ...
- 159
5
votes
0
answers
117
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
5
votes
0
answers
4k
views
Extracting ARM Boot zImage
I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
- 380
5
votes
0
answers
867
views
How do I perform concolic execution with Angr and collect constraints on input?
I have a program that takes a string (with some structure) as input. My aim is to collect information on what values each character in input is compared to as it gets parsed using concolic execution. ...
- 151
5
votes
0
answers
356
views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
- 180
5
votes
0
answers
1k
views
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed the tutorial IDA Help: Debugging code snippets with QEMU.
It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:
Should I adjust ...
- 51
5
votes
0
answers
374
views
Static Address in Dynamically Loaded DLL
I am trying to re-write the following function in my injected DLL.
mov edi,edi
push ebp
mov ebp,esp
mov eax, [sound.dll+1AE0]
push eax
mov ecx,[ebp+08]
mov eax,[ecx]
mov eax,[eax+0C]
push eax
call ...
- 319
5
votes
0
answers
639
views
Reverse engineering an hydrometer's Bluetooth communication
This is a very specific question.
I'm currently working on a project to create an android application capable of reading the values of an hydrometer via Bluetooth. By reading the datasheet, I suspect ...
- 135
5
votes
0
answers
3k
views
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
- 151
5
votes
0
answers
896
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
5
votes
0
answers
3k
views
Load multiple modules in one IDA database
I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
- 51
5
votes
0
answers
1k
views
Emulate TP-Link WR841N using Qemu
I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points.
Following instructions ...
- 51
5
votes
0
answers
734
views
Page Fault Handler in Windows
Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.
When a Page Fault occurs and nt!KiTrap0E ...
- 317
5
votes
0
answers
857
views
Reverse Engineering XORed string
I am trying to reverse engineer some data received over serial port.
The hardware sending the data consists of a gps, compass and a power monitoring unit (which sends information about the battery).
...
- 59
5
votes
1
answer
2k
views
Understanding AutoIT "compilation"
I'm trying to de-compile a cheat created for my game so I can fix it. The problem is the version used is 3.3.14.2 which no longer has official de-compiler support.
I have tried looking for 3rd party ...
- 215
5
votes
2
answers
725
views
Getting empty files using firmware modification kit
im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far.
I got the admin ...
- 51
4
votes
0
answers
62
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,707
4
votes
0
answers
54
views
Replace a function in a Windows 32-bit binary with a custom C function
I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
- 181
4
votes
0
answers
37
views
How can I generated the function call graph (with API calls) of a .NET executable?
For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
- 469
4
votes
0
answers
61
views
How to trace with Frida some specific functions in ARM ending with BX LR
I'am trying to trace down with Frida v16.0.11 (frida-trace) all calls to exported functions from "libssl.so" (Android, 32bit). But turns out that Frida is unable to hook some functions. One ...
- 41
4
votes
0
answers
112
views
Reverse Engineering Technique "Step by Step"
Sometimes, I see how someone puts on the github, some reverse engineering project for some famous game.
By researching these projects - I come to the conclusion that:
people just took the code from ...
user42316