15
votes
Accepted
In which language is the BIOS written?
So, in which language, instruction set or machine code is it written?
It's written in a language that can be compiled to machine code that can be executed by the processor (the CPU). Typically, it's ...
- 20.7k
7
votes
Accepted
Manually unpacking upx
You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed.
Easiest ...
- 116
6
votes
Accepted
Why to dump precisely at OEP while manual unpacking?
But how does knowing OEP relate to IAT?
OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer.
When ...
- 11.7k
4
votes
I need advice on how to JTag a Microsoft Band
You have picked a particularly hard target to try and find JTAG on, if this is your first project.
There are no obvious JTAG ports on the board. The microcontroller looks to be in a BGA package, so ...
- 1,762
4
votes
Why to dump precisely at OEP while manual unpacking?
I think there is something mixed up here.
But how does knowing OEP relate to IAT?
It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware ...
- 2,896
4
votes
Help mounting jffs2 dumped from NAND flash.
It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong.
Instead of mounting it maybe try just extracting the files ...
- 36.4k
4
votes
Accepted
Retrieve & dump type information from IDA Pro
It's obviously doable (you already noted the Create C header file functionality), but if you want to customize the output, you'll have to code it yourself.
Here's what you'll need:
ida_typeinf....
- 9,178
3
votes
Accepted
How to examine/edit stack memory contents using radare2 in debug mode?
To examine in radare2 you can think as 'print values' and you can use:
px show hexdump
pxl display N lines (rows) of hexdump
pxr[j] show words with ...
- 476
3
votes
Manually unpacking upx
Just set a breakpoint in 0x00ef674c.
Press F9.
When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file.
Just make sure that the EIP is the OEP.
- 417
3
votes
How to dump a firmware from an old cell phone with Linux?
Looks like Wiko use Android as OS [based on http://www.wikogeek.com/], so Android tricks should work here as well.
If you need access to SoC on RDA8851CL in more "user-friendly" way, try to connect ...
- 2,438
3
votes
Accepted
Router flash dump unknown filesystem
From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
- 1,331
3
votes
Accepted
Process Dumping and Ida
If your binary is allocating a new memory page & writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new ...
- 565
3
votes
Accepted
Decoding algorithm with checksum
Looks like it's just addition for the checksum, so nice job on that.
The mystery byte is part of the checksum.
The accumulator is 2 bytes.
data = """...
- 878
2
votes
Unpacking and dumping using ollydump
The malware could destroy its PE Headers at runtime so you might want to look for a tool that is capable of handling those cases.
Scylla should do the job.
- 156
2
votes
Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error
I think this is too late but let's reply though.
By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options :
1 - Untick it in options ...
- 21
2
votes
I need advice on how to JTag a Microsoft Band
First, you will need to make a map of every pins on the PCB, you will find a good starter here.
Once done, what I propose is to use a JTAG discovery tool. You can find some like this one or this one ....
- 161
2
votes
How do I figure out what is burned on an Arduino ROM?
On windows for an arduino nano, you do this:
cd "C:\Program Files (x86)\Arduino\hardware\tools\avr\bin"
followed by this:
"C:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avrdude" -F "-CC:\...
- 21
2
votes
Fixing dump files in ida
If possible, please try to dump modules together.
If that is not possible, load any of them in IDA and go to File -> Load file -> Additional binary file to load each file one after another. ...
- 2,896
2
votes
Dump a child process created by malware with an ALTERNATIVE process hollowing process
The technique you described above is known as "dynamic forking" or "process hollowing".
You can find the entry point of the child process by following the steps described in https://...
- 20.7k
2
votes
Dumping Memory to Raw File
you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )
the code below is rubbish hack you may need to declare proper ...
- 16.3k
2
votes
Accepted
Dump Sequence Data from Casio electronic keyboard
First Step: Research
First off just do some research on your product. See if anyone has done any research or reverse engineering on your particular keyboard model. If no one has done any work on it ...
- 301
2
votes
How to wrap dump process and execute it in another PC
If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to ...
- 336
2
votes
Custom nanddump and nandwrite tools
Don’t know what swap is about, but spare area, or OOB area is an additional area at the end of each page storing metadata such as:
bad block markers
ECC (error checking and correcting) code
custom ...
- 36.4k
2
votes
Accepted
Rebuild IAT after manually unpacking DLL
I solved this by manually fixing each missing import API.
First I did a text dump of the unpacked dll using BinText where I found a list of imported API's.
I then compared it to the list of API ...
- 225
1
vote
Manufacturer interface on OCZ Agility 4 SSD
J5 looks like a UART connector and the JT_ pins are likely JTAG. UART should give you console access to manufacturing/diagnostic commands, and JTAG should allow you to the debug the code (firmware) ...
- 36.4k
1
vote
Can a program's memory be dumped and then reinserted?
Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by ...
- 1,391
1
vote
Accepted
Dumping Memory to Raw File
I have recently made an API in python to read and write memory - could be useful for a quick solution.
https://github.com/samsonpianofingers/pymem
you could use this like this
import pymem
handle = ...
- 196
1
vote
How can I determine if NAND blocks are good blocks?
I don't know if it applies exactly but the following document from QNX suggests that:
spare is made up of "sequence #", "file ID", "offset", "CRC" and "ECC"
there are special blocks that contains ...
- 226
1
vote
Dumping ipa file on iOS 10.2
So Installing ipainstaller through Cydia and then dumping with command (through ssh)
ipainstaller -b com.example.targetapp -o /tmp/example.ipa
does the work
- 11
1
vote
Accepted
Dumping Flash Memory Using Bus Pirate
Sounds like you're good to go. Yes the Raspberry has a SPI interface so you can connect the Winbond to it and use the "flashrom" to dump it. Attach the SOIC clip to the chip and connect the pins to ...
- 105
Only top scored, non community-wiki answers of a minimum length are eligible