Hot answers tagged

12 votes
Accepted

How do I work out the Ultranet protocol?

Yes, it's 2xAES3-like. Data is basically PCM, 8 channels per pair. See http://www.diyaudio.com/forums/digital-line-level/261683-suggestions-please-16-channel-24-bit-digital-audio-recorder-3.html ...
user avatar
  • 136
10 votes

Reverse Engineering of a packet encryption function of a game

First I would run some static analysis on the application such as Findcrypt or ProtectID and PEID's Kanal plugin to scan for known static values used in various encryption algorithms. If you find ...
user avatar
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
user avatar
  • 8,579
4 votes
Accepted

Identifying protocol in a pcap file?

Is it possible to identify a protocol in a pcap file? Yes, but this appears to be a proprietary protocol over TCP/IP. The first four bytes of every message is a 32-bit big-endian value that ...
user avatar
3 votes

How to get Packet Structures

There is no automated way (as far as I know) for that. The most common approach is examining sender and receiver processes and their communications. Another thing is packet (or frame) doesn't matter ...
user avatar
3 votes
Accepted

Automated instruction analysis of dynamic memory

Sounds like you want dynamic taint analysis. There is a well-supported, open-source option called Panda. If you have money to spend, check out the commercial offering Reven.
user avatar
  • 7,799
3 votes
Accepted

How to reverse engineer dash cam metadata

Looking at the files distributed with the software, the video playing part is done via Flowplayer, embedded in these files: assets/webthings/local_me.html assets/webthings/local_me_OSM.html assets/...
user avatar
  • 861
3 votes
Accepted

How to analyze packets?

It may be the case that it's CBC-encrypted data, with the first field being a nonce. Or one of many other possibilities. Either way, as Guntram said in his comment above, you'd need to reverse ...
user avatar
2 votes
Accepted

How to translate IDA pseudocode to C/C++ code?

This specific pseudocode is actually regular C code because it doesn't access global variables and stack. You'll probably need to add some typedefs for basic types. Please note that this code should ...
user avatar
  • 7,710
2 votes

Need help to figure out a chksum

unsigned int seed=0x3412; unsigned int len=15; unsigned int vec1[] = { 0x5500,0x534D,0x3434,0x5149,0x0000,0x0000,0x0000,0x4F1F,0xDFF1,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000 // ...
user avatar
2 votes
Accepted

Figuring out the CRC part of a packet

The CRC is, as suspected, a fairly standard CRC16 with the polynomial 0x8005 (reflected: 0xA001). The only online calculators that I could find for this are: BobTech's (clear the 'reverse data bytes' ...
user avatar
  • 1,940
2 votes
Accepted

Help regarding XOR game decryption algorithm

From type == 0 you see that it writes to param_3 and reads from param_4. So those parameters must be pointers to output and input buffers respectively. In fact, if you change them to correct type (...
user avatar
  • 36
1 vote

Analysis of SSL traffic from a Windows 10 application

I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's ...
user avatar
  • 605
1 vote
Accepted

how to calculate a byte value

solution ,first need to reverse imei array (without F in packet1) and need Addition byte by byte and output need to Addition with 31, thanks
user avatar
  • 21
1 vote

Reverse UART communication protocol

From my question: It seems to work :) Is the message length more or less ;) See procedure bellow Still wondering if it's a "common/standard protocol"? Procedure I have removed the module ...
user avatar
  • 121
1 vote
Accepted

Reversing checksum calculation of embedded communication

If you ignore the first constant byte (FC), all the other bytes add up to 00, ignoring overflow. In other words, to calculate the last byte, start with 00, subtract all bytes except the first FC (and ...
user avatar
1 vote

How do I work out the Ultranet protocol?

Others have provided clues about this particular protocol, so I'll just address the general mechanism of decoding a protocol. You have specified "wire" but this generic method can and has been ...
user avatar
  • 2,381
1 vote
Accepted

Reversing checksum algorithm

I'm not sure it's a checksum either. FF may be used as a padding flag. Also I think your "record size" needs to be reevaluated. I see this as a series of bytes that start with 10 02 xx yy yy zz zz x ...
user avatar
1 vote

Interpreting bluetooth string Pebble watch

You have captured the bluetooth RFCOMM frames. These include various control fields which are handled by the bluetooth stack and are transparent to the overlying application layer. (Think serial port ...
user avatar
  • 2,134
1 vote

Interpreting bluetooth string Pebble watch

Because you have 3 of 5 messages absolutely identical, and because the other two differ very little, it seems probable that the first two messages were simply captured incorrectly. The way to try ...
user avatar
  • 2,381
1 vote

Identifying protocol in a pcap file?

Looking at the website for the software vendor, it recommends that the DVR on the other end of the connection be set to "Substream, CIF or QCIF at 6-10 FPS". Those refer to the "Common Intermediate ...
user avatar
  • 2,381

Only top scored, non community-wiki answers of a minimum length are eligible