2022 Developer Survey is open! Take survey.

Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Malware binaries for the SpySheriff scareware

When I first became interested in malware reverse engineering years ago, the first malicious program I encountered was a scareware called SpySheriff. It had a wide internet presence, as it spread ...
user avatar
-1 votes
2 answers
90 views

Is possible to reverse engineer a AES encryption of a known file format?

If the encrypted file is from one of the known formats, such as doc, jpg, mp3, etc., is it possible to reverse engineer it and decrypt it? I "roughly" know the mechanic behind the AES ...
user avatar
1 vote
1 answer
87 views

Is it possible to crack a 2FA/MFA secret key provided you know enough of the previous generated codes?

I have two accounts that won't show me the 2FA/MFA "Secret Key" used to generate the multifactor codes. Because of this, I am forced to use specific MFA apps rather than my preferred one. If ...
user avatar
  • 13
0 votes
2 answers
69 views

A way for find hard-coded URL/IPs in a dll/exe [closed]

Is there a way to see the URL/IPs that are hard-coded in an exe or dll without installing or running it? I once saw a tool that extracted URLs from dll or exes, but I can't remember what it was.
user avatar
  • 113
-1 votes
1 answer
66 views

What can I do with reverse engineering

I have come across a lot of guides and blogs about reverse engineering where they use labs to teach various techniques and methods to break binaries. My question is what actual use cases does reverse ...
user avatar
1 vote
1 answer
140 views

Heap overflow - strcpy() on x86_64 (64bit)

I'm stuck on the Heap1 challenge from Exploit Education. After compiling the source code in a 64bit system, without any security mechanism, I try to overflow the heap in order to overwrite the main ...
user avatar
  • 21
0 votes
0 answers
27 views

Can't find the sample in this article

I'm trying to find the DoubleFeature’s Rootkit sample in this article, quote Resource 106, once decompressed, is a driver called hidsvc.sys So I first downloaded the EQGRP_Lost_in_Translation repo ...
user avatar
  • 1,675
0 votes
0 answers
83 views

Spoofing a server to intercept my IoT device's data

I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
user avatar
  • 101
0 votes
0 answers
152 views

Hacking MBUX system

I read the report from tencent about MBUX hacking and wonder if it still works? Are there any known countermeasurements to this kind of hacking? What did Mercedes do to prevent this? https://keenlab....
user avatar
1 vote
1 answer
108 views

Some introductory reverse engineering help on finding a string

I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
user avatar
-2 votes
1 answer
142 views

Detect reverse engineering using debugger

Problem: Someone has acquired a copy of Company X's application and is reverse engineering it on his network using a debugger. How can Company X possibly detect this activity? Further Questions: Is ...
user avatar
  • 107
0 votes
0 answers
13 views

I have input text and 2 output of encryption short and long key. How to find algo being used [duplicate]

I know it's hard to find but I am still trying to find it. I have one input and two outputs as "short" and "long" keys. I want to find which algo or encryption is being used. The ...
user avatar
0 votes
1 answer
232 views

How hard is to reverse engineer a signature for a given message?

Given the following situation: User makes a request for temporary access to a video Backend responds with a json file containing timeAllowedInSeconds: 5 Backend also responds with the signature of ...
user avatar
  • 101
-1 votes
1 answer
129 views

Security technologies that implements security through "organic-like" obscurity? [closed]

Are there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy? I'...
user avatar
  • 1
1 vote
1 answer
247 views

Are emulators isolated from the host for malware testing?

I know that virtualization is different from emulation; I was wondering if emulation is isolated from its host and any destruction on it will not affect the host as if it were a virtual machine. I ...
user avatar
1 vote
1 answer
116 views

Is there a way to tell what the file does before opening it?

You have just noticed that an unknown executable file has been downloaded to your machine. Is there a way to tell what the file does before opening it?
user avatar
0 votes
1 answer
163 views

How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]

TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu. I am in junior position at this company, and they figured it would be good if I just test ...
user avatar
1 vote
1 answer
132 views

How to protect conditional 'if' in Android from reverse enginneering

I recently downloaded one apk from a custom apkstore from my country. You can download the app for free but you need to pay to use some functionalities. I cracked the app jumping over all the ...
user avatar
2 votes
0 answers
69 views

How to Get full PLT Entry of a function and not the offset?

I am trying to leak libc's base address by first leaking the address of gets(). However, using Pwntools to get the PLT and GOT (and pretty much anything) entries only gives me their offsets as ...
user avatar
0 votes
1 answer
1k views

What is source of bad characters exist in buffer overflows

I'm new to exploit development and while watching a tutorial I came across the topic of "Bad character identification". I'm referring to the process of sending all possible characters to the ...
user avatar
  • 141
1 vote
1 answer
125 views

ROP on MIPS Doesn't Land Where Calculated

I am working on exploiting an application on MIPS to further my knowledge of ROP chaining. The library I am trying to build a ROP chain is libuClibc-0.9.30.3.so. I found a gadget that I want to use ...
user avatar
  • 121
0 votes
0 answers
152 views

Repackaging Mobile app which resists repackaging

I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately. This is the exception I am getting when I decompile this application using apktool and ...
user avatar
1 vote
1 answer
520 views

Easy way to hardware lock an exe file in windows

Hi I want an easy way to hardware lock an exe file to a specific system so that when a user copies that file to another system it does not open.
user avatar
  • 391
1 vote
1 answer
194 views

How are games and software executables injected with custom code & without breaking offset?

Introduction – Context Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life. These applications inject their own code ...
user avatar
0 votes
1 answer
206 views

what are the best counter measures against reverse engineering of firmware? [closed]

How can I best prevent, that critical commandos (e.g. open garage door) from an IoT device are being reverse engineered from the firmware? Is the following list complete / do you spot any errors? Any ...
user avatar
2 votes
3 answers
2k views

Intercept HTTP Traffic of an android app?

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
user avatar
  • 121
2 votes
3 answers
5k views

Protecting firmware .bin from reverse engineering

I would like to protect my .bin ( squash fs ) file after compiling process in order to avoid reverse engineering techniques ( i.e. binwalk could simply unsquash my .bin firmware and see all the file ...
user avatar
  • 61
0 votes
1 answer
805 views

Overwrite return address in C

It's about a CTF Challenge. I'm trying to execute a buffer overflow attack on a C program. The code is : #include<stdio.h> #include<string.h> #include<stdlib.h> #include <sys/...
user avatar
0 votes
2 answers
131 views

How to find vulnerabilities in a program by looking at it's source code [closed]

Hello I have recently started learning Reverse Engineering. I often hear that it's much easier to find vulnerabilities in a program by looking at it's source code, but i don't know how to find them or ...
user avatar
1 vote
1 answer
133 views

Does the DICOM file header gets lost when transferred over the network?

I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
user avatar
1 vote
1 answer
99 views

How to identify user created vs. external functions in disassembly

I'm new to assembly and have been playing around with it. While i was analyzing malware, I realised that there are multiple functions named sub_xxxxxx. How does one determine if this sub_xxxxxx is ...
user avatar
0 votes
1 answer
140 views

Static detection of PE

I'm doing in static analysis of PE file. Can PE file have two or more executable sections? How can we detect whether it is injected or not?
user avatar
1 vote
0 answers
56 views

static analysis for identifying backdoors in PE [duplicate]

I am doing research in identifying backdoors in Windows .exe files. Currently I found some methods to detect them: String search in .exe Find reference .dll and win32 API calls using import table ...
user avatar
0 votes
0 answers
275 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
user avatar
1 vote
1 answer
105 views

Securing media uploading to the cloud from reverse engineering

I own an RPG multiplayer game written in Java, where players can fight each other in the game. Recently I planned to invent a new feature, where the last 15 seconds of your fight and the "knockout" ...
user avatar
  • 121
0 votes
0 answers
142 views

How to decrypt a rocksdb file from Android?

I have collected an encrypted RocksDB file from an Android application. By reverse engineering the mobile application I have also collected the encryption key. However, for the life of me I cannot ...
user avatar
  • 2,010
0 votes
1 answer
2k views

Strange HTTP request from binaryedge.ninja

I found the following strange HTTP request apparently emanating from binaryedge.ninja: min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-" "-...
user avatar
0 votes
1 answer
296 views

.NET application protection technique against cracking

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market. Info about the software: Built using .NET C# (Framework 4.5.2) ...
user avatar
  • 1
1 vote
0 answers
174 views

How to analyze a USB device of having possibly malicious capabilities?

So I recently ordered a chinese external USB card and I would like to find out whether it has some hidden functionality, which might become malicious. It has buttons integrated in it so Linux using ...
user avatar
0 votes
1 answer
348 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
user avatar
  • 277
-1 votes
3 answers
940 views

ret2libc - why need 4 bytes of garbage

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...
user avatar
2 votes
0 answers
1k views

Ghidra Load Linux Headers [closed]

I'm trying to reverse engineer a linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register etc, but it cannot determinate their exact ...
user avatar
  • 41
1 vote
0 answers
227 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
user avatar
0 votes
1 answer
326 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
user avatar
2 votes
1 answer
243 views

Access to foreign memory address

Modern operating systems like Windows 10 isolate memory addresses for processes so how is it possible that Cheat Engine can get these addressed and change their values? At this forum it has already ...
user avatar
0 votes
1 answer
153 views

Should I complie software after making all the variable and function names "1-2 character"? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
user avatar
0 votes
1 answer
146 views

how to extract binaries from SOHO routers and other devices

I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-...
user avatar
  • 6,797
1 vote
1 answer
108 views

Is there a way to protect a supporting app against changing the REST endpoint?

Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application. Looking for online, I found some articles about this app ...
user avatar
  • 123
4 votes
1 answer
2k views

Program detecting sandboxie present - How to prevent?

I am having issues with a particular game, detecting the presence of the games being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple ...
user avatar
3 votes
0 answers
192 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
user avatar
  • 131k

1
2 3 4 5