7 votes
Accepted

Is this a known encoding or cipher? (multiplayer game network traffic)

Writing your example, aaa b in binary, and as well the encoded string, 0xb0 0xb0 0x30 0x10 0x31: a a a ' ' b 01100001 01100001 01100001 00100000 01100010 10110000 ...
user avatar
6 votes
Accepted

What Checksum/CRC algorithm in RF packet?

The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26. I wrote a script to test it: #!/usr/bin/python import binascii def checksum(data): payload =...
user avatar
6 votes
Accepted

DGA(Domain Generation Algorithm) based malware files

I know of no collection of malware samples, focusing specifically on DGAs. However, there are some resources that generally concentrate on DGAs and may provide you enough pointers to identify a ...
user avatar
  • 416
4 votes
Accepted

Identifying protocol in a pcap file?

Is it possible to identify a protocol in a pcap file? Yes, but this appears to be a proprietary protocol over TCP/IP. The first four bytes of every message is a 32-bit big-endian value that ...
user avatar
3 votes

Windows : Which process sent TCP/IP packet?

You can use the procmon to see which processes send and receive network packets. Procmon is a tool in windows Sysinternals tools set,you can download from this link
user avatar
  • 31
3 votes

Reverse engineer CAN-Bus checksum

As can be demonstrated by this page: CRC width: CRC-8 CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff) CRC Input Data: Bytes, D1-D7
user avatar
  • 881
3 votes

Limited BusyBox shell

The command you need is chsh (change shell) - this is part of the shadow or shadow-utils package. You can also manually edit /etc/password to change the shell from /bin/ash to something else: BUT => ...
user avatar
3 votes
Accepted

What checksum algorithm is this network protocol using?

Got it! The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short: Polynomial: 0x2e97 Xor In Value: 0 Xor Out Value: 0 Reflect Input: True Reflect Out: ...
user avatar
  • 41
2 votes

Find the right layer header for a corrupt pcap

I'm quite sure this isn't a pcap file at all, despite what file says, and the D8 doesn't seem to be a network type at all. First, because D8 (216) isn't a valid link type according to http://www....
user avatar
2 votes

Find out how an Android app controls my AV Receiver

I would start by tracing all the traffic coming in and out of your application. A good summary of ways to do that are well documented in this stack overflow answer (). Once you capture the traffic, ...
user avatar
2 votes

Limited BusyBox shell

BusyBox is mainly focused on size-optimizing and commands could be excluded/included during compile time. So, without providing additional informations, it seems to be a very limited set of installed ...
user avatar
  • 1,227
2 votes

Network support when emulating firmware with QEMU

Use the -net argument -net nic,model=rtl8139. Of course replace rtl8139 with your network device model (e1000, i82551, i82557b, ...) Further explanations are found on this Wiki Documentation
user avatar
  • 111
2 votes
Accepted

Reverse engineer LMTools server status enquiry

This is possible using the APIs available in the FlexNet Publisher SDK. I suggest you to consult the SDK documentation and contact Flexera support in case of problems. In theory you could also ...
user avatar
  • 34.9k
2 votes

How to breakpoint exe tcp packet

open procmon from sysinternals add a filter with your process name and take a look at stack trace if you have configured symbols then you get a pretty good overview a small python server and ...
user avatar
  • 15k
2 votes

Encoding method of float

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 ...
user avatar
  • 2,229
2 votes

NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?

Depending on the calling convention, the indirect call you NOPped out might end in "RET nn". IIRC this is in fact the case in Microsoft's variant of the x86 thiscall convention. If you NOP the call ...
user avatar
2 votes

Identifying hosts on a network with no DHCP

Connect a machine to the network / router. Run wireshark or tcpdump to capture packets. Look at captured packets to see what addresses and subnets are used. Try going in on serial: reset instructions. ...
user avatar
1 vote

Spoofing DNS to intercept iot traffic

Does any software exist already, with the kind of MITM features I am looking for: copy and dump the http traffic? Anything simpler than the above? Yes, you could put your IoT devices behind a system ...
user avatar
1 vote

Which JSON object compact binary serialization is this?

1f 8b is gzip header magic so try decompressing it first, it may just be raw json
user avatar
  • 34.9k
1 vote
Accepted

Difficulty obtaining malware traffic

Ok, nevermind. The answer to my question is that my particular sample uses it's own custom protocol that it sends over SSL. I can't go into further detail without mentioning the particular sample ...
user avatar
  • 153
1 vote

How to breakpoint exe tcp packet

There's a huge variary of windows API functions that let a program send TCP packets. Non of those (as far as I recall) contain the strings tcp or send buffer in their name. to reverse engineer ...
user avatar
  • 11.4k
1 vote

Limited BusyBox shell

Unfortunately for you, nowadays most embedded devices (i.e. routers, iot devices, etc..) try to prevent the users to access the inner system so they can't hack or modify it. This is a measure to ...
user avatar
1 vote

How to debug packet processing with overlapped socket on Windows

So the problem was, the network application was using GetQueuedCompletionStatus instead of WSAGetOverlappedResult. It is explained here: https://support.microsoft.com/cs-cz/help/181611/socket-...
user avatar
  • 141
1 vote

Getting started with reversing device network traffic

You can modify packets with scapy ,create custom python code using scapy module to send custom packet.
user avatar
  • 11
1 vote

Lutron Caseta Protocol over HTTPS

This isn't a complete answer but I don't have enough rep to comment yet. First off, giving us binary data with all the non-printable characters presented as ? doesn't help. Try piping it through xxd (...
user avatar
  • 36
1 vote

How does some application get through the block when mobile data plan is exceeded

One of the ways to block unauthorized internet access in similar kiosks is by implementing a DNS redirection. Responding to any DNS request with the same server, and having that server redirect you to ...
user avatar
  • 11.4k
1 vote
Accepted

XMPP clubs in league of legends

There are two possibilities: The League of Legends client uses an embedded algorithm to injectively map a club name to a club UUID. The League of Legends client sends the club name to the server and ...
user avatar
1 vote
Accepted

Putting an application in between client and server

You may want to have a look at mitmproxy. This allows you to intercept and modify http(s) traffic, which may or may not be what you need, but it also has tools like mitmdump that just dump what's ...
user avatar
1 vote

Putting an application in between client and server

first you need to determine the kind of communication between server and client like if it is TCP or UDP or whatever else in case of TCP I did something similar for TCP once so here some insights: ...
user avatar
  • 1,374

Only top scored, non community-wiki answers of a minimum length are eligible