New answers tagged binary-analysis
0
As suggested in one of the answers, it's because of the base address, I used rbasefind to find the base_address of the firmware, and edited it to find the address of the bootloader as there was only two strings plus 11 false string positives.
0
Not really a reverse engineering question but,
Use this in the terminal:
cat textfile.txt | xxd -r -p > image.jpeg
0
The button is greyed out, or "disabled". This is most likely done by one of two ways:
Creating the button as initially disabled, by passing the WS_DISABLED flag as dwStyle parameter to CreateWindow/CreateWindowEx API.
You can set a breakpoint on this function and reset the dwStyle param. Zero will do.
Disabling the button by calling the EnableWindow API ...
2
@0xec's answer is great. This script will help you get blocks function wise.
from ghidra.program.model.block import BasicBlockModel
blockiterator = BasicBlockModel(currentProgram).getCodeBlocks(monitor)
# dictionary contains function wise basic block information
functions = {}
def add_block(function, block):
if function not in functions:
...
1
0xec has answered you but if you are interested in functions you can iterate as below
#TODO Lists Functions in a given program
#@author blabb
#@category _NEW_
funcs = currentProgram.getFunctionManager().getFunctions(True)
f1 = funcs.next()
print("Function Name",f1.getName())
print("Function Body" , f1.getBody())
print("Function Entry" , f1.getEntryPoint()...
0
Another blunt way that seemed to work for me on Catalina (note that this strips all attributes):
xattr -cr /path/to/your/program.app
3
You can obtain the list of all defined basic blocks using BasicBlockModel
Example
from ghidra.program.model.block import BasicBlockModel
from ghidra.util.task import TaskMonitor
bbm = BasicBlockModel(currentProgram)
blocks = bbm.getCodeBlocks(TaskMonitor.DUMMY)
block = blocks.next()
while block:
print "Label: {}".format(block.name)
print "Min ...
-1
codesign --remove-signature /path/to/binaryAppName
Tested it on macOS 10.15.3 Catalina, works perfectly.
You can edit the hex values of the now removed code signature binaries and it will launch on macOS with out a hitch.
0
A few things you could do is go through the strings and see what kind of program it could possibly be loading inside of the software you are reversing. This could give some leads as to if your hypothesis is true.
Another thing you can do is see if it's a module being loaded. Breakpoint on entry when you run the software in a live debugger and see what DLL's ...
Top 50 recent answers are included
