Questions tagged [reverse-engineering]
Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.
3,589
questions
-3
votes
0
answers
27
views
Cannot unzip APK file
I tried to unzip Apps that are recently published targeting recent android OS versions. But I get the error of
same PNG file existing twice in /res/ folder.which doesn't make any sense. Also they ...
1
vote
1
answer
28
views
frida: Error: a(): argument types do not match any of: overload('int', 'int', 'long', 'java.lang.String', 'java.lang.Object')
I'm trying to call a method with this signature (int, int, long, String, Object)
The problem is the last parameter needs to be a String array
When I hook it and print its last parameters something ...
0
votes
0
answers
10
views
Call a WINAPI Function from a shared object(.so) that is loaded into the wine process
I have a windows program that is run under wine. If i understand correctly, the pe-executable is mapped into the wine process.
I use LD_PRELOAD to load a .so into the wine process. This .so hooks into ...
1
vote
0
answers
18
views
How can i change the entire speed (timing) of a android game made with cocos2dx?
i'm making reverse engineering on a android game made with cocos2dx library, editing the .so file (libcocos2dcpp.so) with ida pro and a hex editor. i've getting success changing small things, like ...
0
votes
0
answers
31
views
EF core Invalid column name after reverse engineering database using EF Power Tools
I have an API using ASP.NET Core 6 & EF6 and I reverse engineered my database (SQL Server) using the EF Core Powers Tool extension.
When I try to insert a Person entity inside, I get the error ...
-1
votes
0
answers
16
views
Trying to get creatureID with Cheat Engine
I am trying to get address of creature in custom client in Tibia. There are 2 actions which can be made to creature: Follow and Attack. Both of them are static addresses. Whenever i do one of the ...
0
votes
1
answer
29
views
VS Reversing FatalExecutionEngineError address
I'm working on very large piece of software that dynamically loads and uses a handful of dlls at runtime.
VS 2022 compiles and runs this software without any issues in Debug. When compiled and ran in ...
0
votes
0
answers
36
views
What may be the reason of false malware alarms on this exe I generate?
my friend who is on windows xp and cant post question
send me a question to post for him:
i wrote an x86 32-bit-windows assembler (named org-asm)
the problem is some antivirs report the output exe as ...
-1
votes
0
answers
26
views
Dongle Reverse Engineering with IDA legally
I want to bypass usb Dongle of a famous embroidery program that I own. I have the Dongle and I try to disassembly .exe file with IDA.
I tried to search error string and I found this function that imho ...
0
votes
0
answers
16
views
Get build version from minified production build with Create React App
We have an app created with Create React App built by a previous developer that no longer works in the company.
We have access to the minified source code, and also the git repository with the ...
-1
votes
0
answers
21
views
decompress a file if you don't know which compression algorithm [closed]
All files .PRX format. they all start with
7E 53 43 45 40 00 00 00 00
I would like to understand how they can be decompressed.
Thank you in advance.
-1
votes
0
answers
32
views
Bomblab Phase 3
I looked at resources and videos on the internet. My results are wrong. I've been dealing with phase 3 for 2 days. Can someone help me? Where should I look and what should I write?
Dump of assembler ...
-1
votes
0
answers
25
views
Is there any way to check text segment or data segment in x86?
When I tested some code by RISC-V, there was a software that showed data segment and text segment and the value of register, but is there any way to check these values in x86?
I am new to x86 assembly,...
0
votes
1
answer
55
views
Trying to run a buffer-overflow with Python/pwntools
I work on a online program in which I should do a buffer Overflow.
When I run the program, I have to complete a sum of two numbers generated randomly) :
>>> 451389913 + 1587598959 =
If I put ...
0
votes
0
answers
24
views
How to unscape bytecode which contains strings
I m new to reverse engineering and I was solving a CTF, I did find the byte code but it seems like I should sanitize it(it contains some strings), and unescape it properly.
Here is a chunk of the byte ...
0
votes
0
answers
11
views
*_pb2.py file not able to recognize the field names and message name in proto file
I created person.proto file and tried to generate pb_2.py file by command
protoc --python_out=generated_files protos/person.proto
file got generated successfully
but person._pb2.py is not able to ...
-2
votes
0
answers
53
views
Initialize the value of registers before start execution of the code
I ran an elf file (arch i386-32-little), in gdb and I wonder if there is a way to take control over the values of the global registers (ebx, edx, ecx, eax...) before execute the first instruction in ...
0
votes
0
answers
13
views
How to reopen apk with jadx without decompiling it every time
I need to open the same apk with jadx quite frequently and would like to keep my renamings etc. but not decompile the apk from scratch every time.
My current alternative workflows, that are not very ...
0
votes
0
answers
28
views
Reverse Engineering For IBM DB2 for i IBMDASQL OLE DB Provider
I am creating a Class Library project to get the data from our AS400 database in .NET 6 VS2022. I found the database first approach in IBM: https://community.ibm.com/community/user/...
0
votes
0
answers
37
views
Can you make an assembly program to speak a sentence?
So far I can make an assembly program to play a song, by telling it what frequency and tempo (how long it should last) each music note should play.
Theoretically, I can output any sound if I know its ...
0
votes
0
answers
23
views
HTTP Error 401 unauthorized when using python requests package with user-agent header
I am trying to reverse engineer a web app. So far, using the inspect tool on my browser, I have managed to log in the website using python and use multiple parts of the application.
Short example:
# ...
0
votes
0
answers
19
views
Gardena Battery Rain Water Tank Pump 2000/2 - UART Interface [migrated]
I have a Garden and would like to water it automatically with rain. For this i buy a «Gardena Battery Rain Water Tank Pump 2000/2» and would like to control via an ESP8266.
After opening the control ...
1
vote
1
answer
41
views
Call functions from data segment
I would like to do a reverse engineering analysis of the "xormadness.exe" executable file from root-me.org (PE x86 format), but i don't understand why functions are called from the data ...
0
votes
0
answers
18
views
mcsema using error,has someone use mcsema successful
I flow the Official website to build mcsema using native build approach.Everything seems OK.Since my ida is on Windows,so I use the command of
%IDA_ROOT%\ida64.exe -S"C:\Users\dkl\Desktop\source\...
-1
votes
0
answers
20
views
how to get build.gradle from an apk without source code
I have converted an app to a jar file using dex2jar and gotten all the source code, but I want build.gradle to know which implementations are used in that app and the minimum SDK and maximum SDK ...
2
votes
0
answers
73
views
reversed DOS game uncompression code: is that maybe a known compression method (RLE,...) or self-invented?
its a file uncompression routine from the 1990 DOS game Alpha Waves game loader (https://www.mobygames.com/game/continuum)
based on my https://github.com/LowLevelMahn/alpha_waves_loader reverse ...
0
votes
0
answers
23
views
Handling illegal monitorexit opcodes in Java deobfuscation
While attempting to deobfuscate some malware I found, Krakatau showed a weird looking while loop with a commented out monexit call. When trying to research what this opcode did, it seemed to be ...
0
votes
0
answers
24
views
Is there a way to skip part of function in IDA?
I'm new to reverse engineering and im trying to edit one function then patch apk. This is an old unsupported apk where i want to enable one function, but it have some fail checks. I think the easiest ...
1
vote
0
answers
43
views
GDB debugging and disassembling i386 executable on aarch64 machine
I'm running ARM Ubuntu on a virtual machine inside a mac M1.
I am doing a series of binary reverse engineering exercises where binaries have been supplied in i386.
At first I couldn't run or open a ...
1
vote
1
answer
37
views
Extracting IDA view-A data or Assembly from IDApython
I'm a newbie in IDApro.
I'd like to save the assembly code or IDA view-A(not a graph view) text through IDApro.
I know the how to save using GUI, but there are so many files i have to change.
So I ...
0
votes
1
answer
78
views
Translating C++ x86 Inline assembly code to C++
I've been struggling trying to convert this assembly code to C++ code.
It's a function from an old game that takes pixel data Stmp, and I believe it places it to destination void* dest
void Function(...
0
votes
1
answer
29
views
How to find specific Resource String given the .rsrc and the identifier of the string to be loaded in IDA?
Given a string identifier (uID) for a string loaded using LoadStringA() (I believe it's found in the resource that's loaded using FindResourceA(), but not sure how to traverse through it), how can I ...
0
votes
0
answers
45
views
How disassembler files with Ghidra in cmd
How disassembler for example .elf file in Ghidra with cmd. I am trying do this with
./analyzeHeadless -import /my/path/file
But in arguments required a Ghidra project. I want to disassembler just ...
0
votes
1
answer
24
views
Windows Reverse Engineering
In the part of my malware analysis. I wish to learn more about windows malware reverse engineering. but I only have a little knowledge of reverse engineering. now I read some books related to reverse ...
0
votes
0
answers
14
views
Python dynamic imports of .so files throws several errors
I have recursively copied a MacOS (11.6.1) app directory into another folder, and inside Contents/Frameworks I have a .dylib file I would like to import into Python for analysis of methods. (I wrote a ...
0
votes
0
answers
30
views
The data is different when a string is stored and when a number is stored in the assembly
I was solving the wargame problem, and there was a phrase that entered serial.
If you type the number 12345 in the serial column, the eax register contains 0x3039, which means the decimal number 12345....
1
vote
0
answers
21
views
original JNI_CreateJavaVM won't continue after DobbyHook
I'm trying hook JNI_CreateJavaVM with Dobby for APP testing.
jint (*originJNI_CreateJavaVM)(JavaVM **p_vm, JNIEnv **p_env, void *vm_args);
jint JNICALL myJNI_CreateJavaVM(JavaVM **p_vm, JNIEnv **p_env,...
0
votes
0
answers
39
views
How to perform deletion, addition or merging operations on Miasm AsmBlocks?
Using Python 3 and the framework Miasm, I am trying to parse a binary and simplify its code. After parsing it, I have a list of AsmBlock objects that prints like this:
loc_401c05
MOV BYTE PTR [...
0
votes
1
answer
69
views
What does *(long *) on a string cause a segmentation fault?
Consider one or both of the following 'data' values:
#include <stdio.h>
#include <stdbool.h>
#include <stdint.h>
#include <string.h>
//char * data = "21st Century Schizoid ...
0
votes
1
answer
56
views
How to modify bytecode on class load JVM no args
I have an exe that is starting a JVM and loading java classes into memory. I was successfully able to dump these classes with a -javaagent from the running JVM by attaching it to the process and ...
0
votes
0
answers
22
views
is there a way to combine two app by includ dex file from app A in app B?
I want to add a .dex file from another app to compiled app how its possible
or how to add a .dex file from another compiled app to my app that i have source code?
I want to combine two apps with ...
1
vote
2
answers
145
views
How to dump classes loaded into memory? Java
I am trying to access a java package loaded into memory and dump it to a file. Here is how the security works: there is an exe packed with Themida that contains the java main class code to be loaded. ...
0
votes
0
answers
75
views
Why does gcc not produce DWARF5 bin even after passing ``-gdwarf-5`` flag?
I am trying to compile a basic c program to get the binary ELF on my Ubuntu x86-64 machine. I want the binary to comply with the DWARF5 format as I am working on writing a .debug_sup section parser.
...
1
vote
1
answer
65
views
Floating Point numbers on VAX machine
I have the source code in RTL/2 program languange of an old application running on a VAX machine.
Unfortunately I don't have the possibility\ability to re-compile the application.
I have to change ...
0
votes
0
answers
55
views
Does inline ASM in C change disassembly?
I tried my best to search for this question before asking, but could not find an answer. Perhaps this question would be better suited to ask on the Reverse Engineering SE.
I am examining a 32-bit C ...
1
vote
0
answers
160
views
Decoding PHP obfuscated payload
Recently I found a malicious PHP payload on my company's server. The code seems to be encoded into two strings claster and x64. The claster string decodes to the following
$svan = "_" . ...
2
votes
1
answer
173
views
How to create a Datasheet for Elden Ring Save-Files
I'd like to find out the offset of certain information like level, equipped items etc. from the ER0000.sl2 save file.
It has been done for Dark Souls here.
And I found out some offset locations in ...
0
votes
1
answer
35
views
How does GitHub encode their graphQL cursors?
GitHub's graphql cursors are intentionally opaque, so they shouldn't ever be decode by a client. However I'd like to know their approach towards pagination, especially when combined with sorting.
-3
votes
1
answer
65
views
Isn't Reverse Engineering That Dangerous?
I spent a couple of hours reading over Reverse Engineering Specifically with relation to C/C++ and Exif file formats.
2 Questions which I couldn't find clear answers for:
Why Exif format at all? what'...
0
votes
1
answer
77
views
half_baddata function in c
**what this part of code means and do in c? I can't understand it!**
What's the return value of the if condition and when it will happened?
LAB_001012c5
if(local_10 != *(long*)(in_FS_OFFSET + ...