Unanswered Questions

974 questions with no upvoted or accepted answers
0
votes
0answers
2k views

How can I have IDA replace an offset with the label of the function the offset points to?

I keep seeing the same pattern in the code I'm analyzing. A call instruction is using a label "off_" which is just a pointer to the real address of the call (in this case: GetWindowTextW). It would ...
0
votes
0answers
2k views

How to set a breakpoint on GetProcAddress in IDA Pro?

I'm usibng IDA 6.5.140116 and cannot seem to get a breakpoint to break. My workflow is: Open the Imports subview Double click on the Name column for the row representing GetProcAddress. This jumps ...
0
votes
0answers
439 views

Does malware ever purposely embed resources to thwart resource analysis and extraction

I have been analyzing a Kazy (derp) Ramdo variant that is relatively recent and was surprised to see an access violation in resource hacker when trying to view an embedded bitmap. Is this common or ...
0
votes
0answers
1k views

Emulating a sentinel c-plus security dongle to attach to a virtual machine

My company has an ancient payroll system that we want to virtualise so that it can be preserved for legal reasons. The software runs on an operating system called THEOS http://www.theos-software.com/ ...
0
votes
0answers
1k views

How to hack a digital photo frame to remove JPEG compression?

I have purchased this digital photo frame: http://www.globalshiping.com/en/usb-24-tft-16mb-digital-photo-frame-flash-can-store-32-of-your-favorite-photos.html?language=en&currency=USD[1] I am ...
0
votes
0answers
837 views

How does iOS hash and salt passwords on its secondary-storage?

I bought a used iPhone from someone, but I accidentally got a lock screen on the phone and can't figure out what the passcode is. Long story short, how does iOS hash the passcodes for entry, what kind ...
0
votes
0answers
242 views

Weird self-modify instruction

Trying to finding the main caller of a series of nested function I ended in a switch table (or at least ollydbg says it's so) of address: DD address1 DD address2 DD myfunction DD adress4 .. AND SO ON ...
0
votes
0answers
263 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
0
votes
0answers
117 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
0
votes
0answers
104 views

Detecting and/or converting binary endianness (PPE [CELL] to Intel)

I am by no means a competent programmer in any sense of the word. I've only ever fiddled with .NET building very, very basic applications. If it's possible to be given step-by-step instructions, then ...
0
votes
1answer
2k views

Decode 96 column punch card

I don't know if this is the right place to ask, but I can't seem to find it anywhere on the internet: How do I read a 96 column IBM system/3 punch card? I am doing an exercise but I can't seem to ...
0
votes
1answer
197 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
0
votes
1answer
536 views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
0
votes
1answer
310 views

Newbie unpacking diffculties

I'm trying to unpack a small application I compiled with VS2015 (v140_xp) and packed with UPX 3.93 (option -1). The application checks for IsDebuggerPresent and uses std::cout, nothing fancy. The ...
-1
votes
1answer
44 views

cracking SHA256 if you think you know its original value but don't know which is it

I have a hash and what I think is its original value DRMSoftwareRadio-MERLIN-00000218 20030130 Frank Garnier Frank.Garnier@rnw.nl Witte Kruislaan 55 Hilversum 1217AM Netherlands ...

15 30 50 per page