Skip to main content
6 votes
Accepted

DGA(Domain Generation Algorithm) based malware files

I know of no collection of malware samples, focusing specifically on DGAs. However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a ...
pnX's user avatar
  • 416
6 votes
Accepted

What Checksum/CRC algorithm in RF packet?

The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26. I wrote a script to test it: #!/usr/bin/python import binascii def checksum(data): payload =...
Johann Aydinbas's user avatar
3 votes

Windows : Which process sent TCP/IP packet?

You can use the procmon to see which processes send and receive network packets. Procmon is a tool in windows Sysinternals tools set,you can download from this link
Lnju's user avatar
  • 31
3 votes

Reverse engineer CAN-Bus checksum

As can be demonstrated by this page: CRC width: CRC-8 CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff) CRC Input Data: Bytes, D1-D7
booto's user avatar
  • 931
3 votes

Limited BusyBox shell

The command you need is chsh (change shell) - this is part of the shadow or shadow-utils package. You can also manually edit /etc/password to change the shell from /bin/ash to something else: BUT => ...
Stuart Cardall's user avatar
2 votes

Limited BusyBox shell

BusyBox is mainly focused on size-optimizing and commands could be excluded/included during compile time. So, without providing additional informations, it seems to be a very limited set of installed ...
knx's user avatar
  • 1,257
2 votes
Accepted

Reverse engineer LMTools server status enquiry

This is possible using the APIs available in the FlexNet Publisher SDK. I suggest you to consult the SDK documentation and contact Flexera support in case of problems. In theory you could also ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Network support when emulating firmware with QEMU

Use the -net argument -net nic,model=rtl8139. Of course replace rtl8139 with your network device model (e1000, i82551, i82557b, ...) Further explanations are found on this Wiki Documentation
محمد جعفر نعمة's user avatar
2 votes

Encoding method of float

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 ...
Ian Cook's user avatar
  • 2,558
2 votes

NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?

Depending on the calling convention, the indirect call you NOPped out might end in "RET nn". IIRC this is in fact the case in Microsoft's variant of the x86 thiscall convention. If you NOP the call ...
Michael Karcher's user avatar
2 votes

Identifying hosts on a network with no DHCP

Connect a machine to the network / router. Run wireshark or tcpdump to capture packets. Look at captured packets to see what addresses and subnets are used. Try going in on serial: reset instructions. ...
pythonpython's user avatar
2 votes

How to breakpoint exe tcp packet

open procmon from sysinternals add a filter with your process name and take a look at stack trace if you have configured symbols then you get a pretty good overview a small python server and ...
blabb's user avatar
  • 16.5k
2 votes

CaptureBAT equivalent on Windows 10?

Alternatively, you can use Microsoft Network Monitor tool to filter the traffic of a specific process. Archive Download Link: https://www.microsoft.com/en-us/download/details.aspx?id=4865 EDIT: ...
Abdullah Mohamed's user avatar
2 votes
Accepted

Malware analysis - Debugger hangs at HttpSendRequestA

Ok after hours of struggle, I found a solution (sort of). First of all, I still don't know what causes the deadlock, but I found that this happend only when debugging the malware as a dll. How I came ...
Luca D'Amico's user avatar
1 vote

Identifying hosts on a network with no DHCP

This is more of a netsec question but I think dumping the ARP table (arp-a) could work.
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Trying to reverse web application connection, but the network tab shows nothing

The web application may use the browser's raw socket API or something similar for TCP and/or UDP protocol (extensions, java stuff, etc.) The browser's HTTP(s) debugger - actually any HTTP(s) debugger ...
Ben's user avatar
  • 146
1 vote

Trying to reverse web application connection, but the network tab shows nothing

You can use Wireshark tool which is available here: https://www.wireshark.org Repeat all your steps while you're sniffing network connections, see if it solves the problem
bob's user avatar
  • 11
1 vote

CaptureBAT equivalent on Windows 10?

Really, if all your after is the procmon filters from CaptureBAT, go to the git hub page and download just them. They will be about a decade old, though. I guess they'll give you a start. You can ...
waydaws's user avatar
  • 11
1 vote

CaptureBAT equivalent on Windows 10?

An alternative to CaptureBAT on Windows 10 is FakeNet-NG.
amd's user avatar
  • 11
1 vote

How to read data from android.car.cluster

I'm going to guess this is MPEG Streaming of some manner. Here's what file run at various byte offsets into the first 10k bytes of the file produces: 598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 ...
pythonpython's user avatar
1 vote

Inbound network queries not appearing in developer tools of browser

Network sniffing tools such as Wireshark are your best bet. That will let you see all the traffic going across a network interface. You can use Statistics > Conversations to help narrow in on the ...
pythonpython's user avatar
1 vote

What browser do during initial web page request?

There are two major differences between a web page loaded via web browser and via script: While loading the web page a web browser also loads linked resources like scripts, images, css files, ... ...
Robert's user avatar
  • 1,097
1 vote

Spoofing DNS to intercept iot traffic

Does any software exist already, with the kind of MITM features I am looking for: copy and dump the http traffic? Anything simpler than the above? Yes, you could put your IoT devices behind a system ...
multithr3at3d's user avatar
1 vote

Which JSON object compact binary serialization is this?

1f 8b is gzip header magic so try decompressing it first, it may just be raw json
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Break when exe send tcp packet

If you can see the send event in ProcMon, just double click it and check the Stack tab to see what API the program used to perform it. Note that the stack trace usually includes the kernel part; you’...
Igor Skochinsky's user avatar
  • 36.8k
1 vote
Accepted

Difficulty obtaining malware traffic

Ok, nevermind. The answer to my question is that my particular sample uses it's own custom protocol that it sends over SSL. I can't go into further detail without mentioning the particular sample ...
solumnant's user avatar
  • 173
1 vote

How to breakpoint exe tcp packet

There's a huge variary of windows API functions that let a program send TCP packets. Non of those (as far as I recall) contain the strings tcp or send buffer in their name. to reverse engineer ...
NirIzr's user avatar
  • 11.8k
1 vote

How to debug packet processing with overlapped socket on Windows

So the problem was, the network application was using GetQueuedCompletionStatus instead of WSAGetOverlappedResult. It is explained here: https://support.microsoft.com/cs-cz/help/181611/socket-...
Youda008's user avatar
  • 141
1 vote

Getting started with reversing device network traffic

You can modify packets with scapy ,create custom python code using scapy module to send custom packet.
Saif's user avatar
  • 11
1 vote

Lutron Caseta Protocol over HTTPS

This isn't a complete answer but I don't have enough rep to comment yet. First off, giving us binary data with all the non-printable characters presented as ? doesn't help. Try piping it through xxd (...
scruffy's user avatar
  • 36

Only top scored, non community-wiki answers of a minimum length are eligible