12
votes
Accepted
How do I work out the Ultranet protocol?
Yes, it's 2xAES3-like. Data is basically PCM, 8 channels per pair.
See http://www.diyaudio.com/forums/digital-line-level/261683-suggestions-please-16-channel-24-bit-digital-audio-recorder-3.html
...
- 136
5
votes
Accepted
Change sending IP of only certain executable
Following OP's other questions, assuming Windows OS
This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs:
Proxifier
Proxifier allows ...
- 8,899
3
votes
How to get Packet Structures
There is no automated way (as far as I know) for that. The most common approach is examining sender and receiver processes and their communications. Another thing is packet (or frame) doesn't matter ...
3
votes
Accepted
Automated instruction analysis of dynamic memory
Sounds like you want dynamic taint analysis. There is a well-supported, open-source option called Panda. If you have money to spend, check out the commercial offering Reven.
- 9,088
3
votes
Accepted
How to reverse engineer dash cam metadata
Looking at the files distributed with the software, the video playing part is done via Flowplayer, embedded in these files:
assets/webthings/local_me.html
assets/webthings/local_me_OSM.html
assets/...
- 901
3
votes
Accepted
How to analyze packets?
It may be the case that it's CBC-encrypted data, with the first field being a nonce. Or one of many other possibilities.
Either way, as Guntram said in his comment above, you'd need to reverse ...
- 20.6k
2
votes
Accepted
How to translate IDA pseudocode to C/C++ code?
This specific pseudocode is actually regular C code because it doesn't access global variables and stack. You'll probably need to add some typedefs for basic types.
Please note that this code should ...
- 8,343
2
votes
Need help to figure out a chksum
unsigned int seed=0x3412;
unsigned int len=15;
unsigned int vec1[] = {
0x5500,0x534D,0x3434,0x5149,0x0000,0x0000,0x0000,0x4F1F,0xDFF1,0x0000,0x0000,0x0000,0x0000,0x0000,0x0000
// ...
2
votes
Accepted
Figuring out the CRC part of a packet
The CRC is, as suspected, a fairly standard CRC16 with the polynomial 0x8005 (reflected: 0xA001). The only online calculators that I could find for this are:
BobTech's (clear the 'reverse data bytes' ...
- 2,010
2
votes
Accepted
Help regarding XOR game decryption algorithm
From type == 0 you see that it writes to param_3 and reads from param_4. So those parameters must be pointers to output and input buffers respectively. In fact, if you change them to correct type (...
- 36
2
votes
Reverse UART communication protocol
From my question:
It seems to work :)
Is the message length
more or less ;)
See procedure bellow
Still wondering if it's a "common/standard protocol"?
Procedure
I have removed the module ...
- 141
1
vote
Accepted
Identifying the source of encryption used by UDP packets in a PCAP file
To your first question, you'd have to look at the code. There may be encryption, but some of the UDP packets have very small payloads, and using encryption would slow down packet processing which is ...
- 786
1
vote
Accepted
how to calculate a byte value
solution ,first need to reverse imei array (without F in packet1) and need Addition byte by byte and output need to Addition with 31, thanks
- 31
1
vote
Analysis of SSL traffic from a Windows 10 application
I'm not sure if this will solve your issue, but have you tried using Charles Proxy with SSL Proxying enabled? Charles can perform a man-in-the-middle attack and get the contents of the applications's ...
- 605
1
vote
Accepted
Reversing checksum calculation of embedded communication
If you ignore the first constant byte (FC), all the other bytes add up to 00, ignoring overflow.
In other words, to calculate the last byte, start with 00, subtract all bytes except the first FC (and ...
- 12.9k
1
vote
How do I work out the Ultranet protocol?
Others have provided clues about this particular protocol, so I'll just address the general mechanism of decoding a protocol. You have specified "wire" but this generic method can and has been ...
- 2,521
Only top scored, non community-wiki answers of a minimum length are eligible