All Questions
9,711
questions
1
vote
0
answers
3k
views
Unable to install ltrace on Kali [closed]
I am kind of stuck with the installation of ltrace on my Kali VM.
My /etc/apt/sources.list file is updated with following entry:
deb http://http.kali.org/kali kali-rolling main non-free contrib
I ...
- 27
1
vote
0
answers
784
views
C# Hidden Method through transparent proxy object?
I'm dealing with an interesting form of obfuscation. A C# program I am reversing has a central API, let's call it "Central API". This Central API has several functions that aren't exactly defined.
...
- 131
1
vote
0
answers
47
views
Legal Reverse Engineering for Security Review in US for Korean Provided Module
My company has received a command-line stand-alone (ELF) executable from a Korean company that provides a service for validating Korean users. It took them a few tries to get us a version that runs on ...
- 19
1
vote
0
answers
213
views
How to dump firmware from R5F71424 MCU
I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware.
It has a limited boot mode that only allows writing to the MCU.
Any pointers or ideas would be helpful....
- 11
1
vote
0
answers
415
views
Need help understanding IDA Pro pseudocode
I am new into IDA and have some questions about the pseudocode in C.
Could someone please explain to me the meaning of the following two lines:
(*(void (__fastcall **)(int *, _DWORD))(*v1 + 196))(v1, ...
- 21
1
vote
0
answers
144
views
Is Dynamic Binary Instrumentation legal in UK/EU for malware analysis?
I am doing a university project about performing malware analysis on binary files. The end goal would be to analyze real world executables(Microsoft Office installation file for example). If I use DBI,...
1
vote
0
answers
44
views
IDAPython: Get the operand string without any substitutions [duplicate]
I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset ...
- 11
1
vote
0
answers
103
views
Can I see Stack and Heap value/addresses from this simple C# program process?
I am studying reading dumped memory image and analyzing it with volatility.
I wrote this c# program and I was hoping to see the analyzed data from Volatiliy
namespace CSharpEx1
{
class Program
...
- 111
1
vote
0
answers
117
views
Is there any way to capture the state of an application so as to restore execution of it later?
There are certain older, non-DirectX-based games that I can hack inside of a VM, which is amazing because I can save snapshots of states to then restore if, say, the game crashes after I attempt ...
- 2,234
1
vote
0
answers
345
views
Naruto Uzumaki Chronicles 2 .RAW Files [PS2]
I'm have been trying to mod these game for years, but I still stuck with the raw files from RACJIN games, [same case as Fullmetal Alchemist & Bleach]. The files appear to be compressed, and a ...
1
vote
0
answers
171
views
Reversing Arduino mega bytecode
I have an hex dump of the 256k of my arduino mega's flash memory.
I do not understand where is the bootloader. I see at 0x0000 address an interupt vector for reset but i do not understand how the ...
- 797
1
vote
1
answer
79
views
Need Advice for the purposes of learning [closed]
I would really like to make a multiplayer mod for Fallout 4, I know how to program and i have a basic understanding of how to get opcodes and read/write to those. Now what i don't understand is how to ...
- 11
1
vote
0
answers
412
views
random address in call instruction
I am trying to use write system call shellcode in assembly but when i run it i am getting a segmentation fault. I did debug it and its because of the call instruction which is having a random address ...
- 19
1
vote
0
answers
1k
views
Is there any way to access assembly-csharp from installed apk? (unity game, gamedata)
I'm playing a Japanese Unity game on my phone. I've translated everything that exist in the apk to English but the game downloads new content once you run the apk for the first time. Is there any way ...
- 11
1
vote
2
answers
219
views
How can a Javascript file drop .exe written in Visual Basic without network communication?
I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable ...
- 197
1
vote
0
answers
188
views
x64dbg flow-indent style trace logs
I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
- 180
1
vote
0
answers
219
views
Attempting to RE DI-8002W Dlink Firmware. Cannot find file system
I'm attempting to reverse engineer the DI-8002W firmware from Dlink in order to search for vulnerabilities within the router. I'm at the point where I've recovered the Linux Image, but I cannot ...
- 111
1
vote
1
answer
117
views
Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?
I am studying assembly and hooking.
I know how to hook x86 assembly now.
so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function.
I think ...
1
vote
0
answers
353
views
Reverse engineer CRC16
I have not had success with reveng on figuring out how to calculate these CRCs.
I successfully figured out another similar CRC from the same author so I'm pretty sure that the first four bytes as ...
- 11
1
vote
0
answers
1k
views
How determine correct checksum algorithm for this NFC Data?
I maae a dump of a Mifare Classic, NXP, tag.
I can read some information without a problem, but if I write data in a block, I need to terminate the block with a checksum (CRC?, one byte).
I tried ...
- 23
1
vote
1
answer
655
views
IDA Python call func from idb names with specific arguments
I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 ...
- 113
1
vote
0
answers
282
views
Building custom image with firmware mod kit
basically I have netis WF2409E router and i want to update it with custom image so I decided to try fmk. First I added gdbserver to usr/bin and re-packt it with fmk and upload it. After finishing ...
- 515
1
vote
0
answers
608
views
Trying to identify block of code which generates 256 bit key
I'm reversing a C++ program using IDA PRO to examine how the some data is stored, encrypted and decrypted.
I've managed to identify the data is encrypted with AES CBC 16 block and 256 bit key. I have ...
- 113
1
vote
0
answers
470
views
debugger trap with angr
Let's suppose this (very ugly) c code:
#include <stdio.h>
#include <string.h>
#include <signal.h>
char sav_argv[100];
void on_sigtrap(int signo)
{
if (strcmp(sav_argv, "hello")...
- 797
1
vote
0
answers
129
views
Missing Map from Java Native Method to C Code
When writing a C implementation for a native Java method in Android, the rule is to name the C function according to the convention "Java_com_...". But I encountered an APK in which there are no such ...
- 121
1
vote
0
answers
215
views
Immunity error BB010002
I am trying to make this exploit work and having some difficulty.
So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:
https://github.com/cokebottle/oscp-...
- 11
1
vote
0
answers
167
views
Binary Analysis Tool (BAT) no longer maintained - alternatives? [closed]
I read on the BAT github page that BAT is no longer actively maintained.
Why did the project come to an end?
What alternatives are there to unpack all kinds of archives /
firmwares / binary ...
- 1,560
1
vote
0
answers
211
views
Challenges to learn jemalloc exploitation on FreeBSD [closed]
I'm studying this phrack article: http://www.phrack.org/issues/68/10.html
Very interesting but the only valid way to be confident with an exploitation technique is an hands-on.
I'm searching for ...
1
vote
0
answers
114
views
File Decryption Problems
over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean).
Sadly, besides me, other ...
- 11
1
vote
0
answers
94
views
Can Radare2 emulate null pointer exceptions and others?
I'm wondering if anyone has had any luck with Radare2's configuration variables, esil.exectrap, esil.iotrap, and esil.nonull while emulating?
xor eax, eax
mov eax, dword [eax] <-
From what I can ...
- 133
1
vote
0
answers
70
views
Trace back Offset Function
I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position.
Thanks!
Offset ...
- 11
1
vote
0
answers
429
views
IDA fixups, why and how
I'm using IDA 7 Freeware, not Pro. I've been using IDC to re-invent the wheel somewhat, but I'm learning a ton of stuff as I go along.
I have a 16-bit MSDOS exe which I'm reversing. I stripped out ...
- 11
1
vote
0
answers
178
views
Is there any way to get value from bytecode under JDWP without access to source?
When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the ...
- 118
1
vote
0
answers
152
views
ODBC Finding the password an application uses to access the database
I have a program which uses ODBC to access an accdb database. I can open it in access but it asks for a password.
The application accesses it through a DSN string. I have found the string using ODBC ...
- 19
1
vote
0
answers
1k
views
radare2 not showing function names
I'm using radare2 and I've noticed that it simply prints function offsets rather than function names.
I've done some tests and I've discovered that on Kali it prints offsets and on debian it prints ...
- 121
1
vote
0
answers
772
views
Patching an ipa (iPhone app) using Hopper Disassembler
I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
1
vote
0
answers
976
views
How to hook into OpenSSL shared library?
To preface, I am not a well-versed developer in the whole business of reverse engineering or even most basic programming. This is a project I made with the goal of attempting to replicate an existing ...
- 11
1
vote
0
answers
63
views
How to make sense of this one pin serial communication
I am trying to reverse engineer a serial communication between to microcontrollers (1 device & 1 microcontroller on a board). One MCU validates the other MCU and I want to crack the validation and ...
- 111
1
vote
0
answers
317
views
Compression algorithm working with bitstream
I'm trying to reverse decompression algorithm for one of old games. After some reversing I found that it reads bit stream, not byte by byte. It looks like this:
std::vector<uint32_t> TABLE_1 = {...
- 111
1
vote
0
answers
87
views
Movies Anywhere ID?
I'm looking to automate requesting movies from different retailers on Movies Anywhere. The URL for the request is: https://retailer.moviesanywhere.com/api/purchase/initiate?retailer={retailer}&id={...
- 11
1
vote
0
answers
592
views
Getting R6034 error message when starting IDA Pro
I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
- 11
1
vote
0
answers
197
views
Are there tools or plugins for IDA Pro that can find ELF sections?
I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
- 380
1
vote
0
answers
528
views
Decompiling or modifying .exe file generated from .jar
I have one .exe file which is generated from .jar file but I'm not sure how it was made. I cannot open it with winrar or something. I need to modify it or just to decompile it. Any answer should be ...
- 11
1
vote
0
answers
139
views
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
- 11
1
vote
1
answer
1k
views
Map an obfuscated javascript file to the original
Among other approaches, there are ways to "prettify" obfuscated javascript. But most of such approaches are geared towards someone trying to understand code that's not their own (e.g. from a website, ...
- 113
1
vote
0
answers
66
views
how can i get real hex values of vdso outputs [closed]
I'm trying to get an algorithm in a program but i can't see the hex codes.
At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
0
answers
346
views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
- 123
1
vote
1
answer
2k
views
Reading from text file and printing it in IDA Pro
I have a text.txt file and I want to read it and print its content in the Output Window of IDA Pro (Free version).
I wrote an .idc script as follows:
#include <idc.idc>
static main() {
...
- 123
1
vote
0
answers
64
views
Threads blocking in kernel when I attach, can't control them
I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
- 153
1
vote
0
answers
259
views
Reverse engineering IE thick client
Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO).
In trying to reverse one such thick client I noticed that the website downloads about ...
- 437