Skip to main content
2 votes

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I would suggest compiling small helloworld type programs then reversing them yourself to identify boilerplate/runtime vs. user code.
Igor Skochinsky's user avatar
  • 36.8k
1 vote

How can I debug if the program closes directly?

Possibilities worth checking: Try combinations of these and see if the behaviour changes: Disable all exception filtering by the debugger (pass all exceptions to the program). If the program uses ...
Yotamz's user avatar
  • 1,227
1 vote

IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available

Try debugging on a device that has a less recent API level (try 27 or lower). I remember a similar issue that I resolved by running a not-too-recent Android version via the emulator bundled with ...
kirschju's user avatar
1 vote

Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing

I'd recommend debugging the decryption loop in your code, and the encryption loop in the original binary, side-by-side and comparing the values at each step. It's possible that your binary's rand() ...
Rolf Rolles's user avatar
  • 9,198
1 vote

How can I jump to the start/end of a function in x64dbg?

In x64dbg, You can right-click the beginning of the function or any place in the instructions/disassembly that you want the execution to continue from for that matter, and simply press on "Set ...
rotem.salinas's user avatar
1 vote
Accepted

How can I jump to the start/end of a function in x64dbg?

Finding the start of a function The start of a function is indicated by push ebp The easiest way to find it for a function is to use the well-known xAnalyzer plugin: Analyze the module by right-...
MendelG's user avatar
  • 53
1 vote
Accepted

What triggers RIP_EVENT?

AFAIK you're not supposed to handle it and I doubt you reasonably could. The sources you cite are right about what RIP means in this context. This event occurs in response to a DBG_RIPEXCEPTION (== ((...
0xC0000022L's user avatar
  • 10.9k
1 vote

How to reverse a USB firmware patching tool for another device?

I've made a quick research - if you're getting [!] No devices found prompt this is likely due to the updater getting no adapter results with the below WQL query: I guess checking if you have ...
mimak's user avatar
  • 579
1 vote

Should shell32.dll be in executable search path for winword.exe with WinDBG?

As i commented the area you are disassembling does not look like a valid code As to how did it happen you should know better you have provided the address for disassembling 0x7ffc6b54000 and that ...
blabb's user avatar
  • 16.4k
1 vote

Malware analysis - Debugger hangs at HttpSendRequestA

I don't know if it's still a problem for you, but it might be related to this: https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-best-practices and more particularly this ...
Stanislas Arnoud's user avatar
1 vote

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

If it is still interesting for someone- the pads are: SDA, GND, SCL, VCC(~3V)maybe standard 3.2v; from left to right in front of printer/or as seen connector inside. The VCC is not constant, starting ...
elmech's user avatar
  • 11

Only top scored, non community-wiki answers of a minimum length are eligible