Unanswered Questions
867 questions with no upvoted or accepted answers
11
votes
0answers
342 views
Problems calculating checksum for AirConditioner
I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes.
I discovered that the upper and lower nibbles need to be ...
11
votes
0answers
3k views
Howto clone Android RSA SecurID Software Token
At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already ...
9
votes
0answers
1k views
RE Tplink TD-W8960N V7
I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
9
votes
0answers
649 views
Reverse Engineering 2 byte checksum on RFID card
I am currently researching my studentcard.
Money is stored on this card.
But the vending machine also checks a checksum on the card.
I already did a lot of effort to find it but didn't succeed.
The ...
8
votes
1answer
142 views
SCSI interface through USB
I'm trying to dump the storage of Xiaomi Home camera.
It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device.
I tried mounting the SCSI disc with no ...
8
votes
1answer
776 views
Automated Static Unpacking Binaries
I am reading the paper Automatic Static Unpacking of Malware Binaries (Kevin Coogan et al.) with the goal of trying to reproduce the given experimental results (with Hybris-C, MyDoom.q, tElock, etc), ...
8
votes
0answers
1k views
GDB via JTAG on ARM Hardware target without source code
Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested.
Update: ...
7
votes
1answer
112 views
Radare2 Call $+5 and register-based cross-references not found
I have a library of ~65MB which uses this "technique" as a kind of PIC.
First, it gets some kind of base address (it is always the same):
0x00708497 e800000000 call 0x70849c
0x0070849c ...
7
votes
0answers
165 views
Analyzing a Revit project file
I've been messing around with Revit and trying to understand the internal data structures for its file format. I'm not particularly experienced with this type of work and the processes around reverse ...
7
votes
0answers
744 views
Red Alert 2 Windows 8 DirectDraw compatibility
The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
6
votes
0answers
215 views
Firmware analysis, can't find file system
I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
6
votes
0answers
162 views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
6
votes
0answers
496 views
Generating symbol file for closed-source binary by hand
I have a closed-source binary (minecraft-pi). For a given section of the assembly like so:
a2ed4: e92d45f8 push {r3, r4, r5, r6, r7, r8, sl, lr}
a2ed8: e1a04000 mov ...
6
votes
0answers
510 views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
6
votes
0answers
729 views
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml.
It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:
...
