Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

How to decrypt a rocksdb file from Android?

I have collected an encrypted RocksDB file from an Android application. By reverse engineering the mobile application I have also collected the encryption key. However, for the life of me I cannot ...
0
votes
0answers
35 views

Reverse Engineering the APK [closed]

which method is better to reverse engineering the APk traditional method(code level change) or using tools like frida?
0
votes
0answers
31 views

Error on WinDBG : Win32 error 0n30 [closed]

I have this error while I am debugging using winDBG : ** Unable to retrieve information, Win32 error 0n30: Lecture impossible sur le périphérique spécifié. **
0
votes
0answers
38 views

Problem while debugging services with WinDBG using GFLAGS

I have a problem when I try to debug services using WinDBG and GFLAGS. Here's some screen shots resuming my problem. First, I configured GFLAGS like this: Then, I launched the service, and used the ...
0
votes
0answers
43 views

Questions about process hollowing

When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
0
votes
1answer
217 views

Strange HTTP request from binaryedge.ninja

I found the following strange HTTP request apparently emanating from binaryedge.ninja: min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-" "-...
0
votes
0answers
80 views

Osx protections binary patch

I'm newbie in reverse engineering field recently I tried my "skill" in real world applications (apple MacOS) , but think that something went wrong during the binary patch. I tried to patch 3 apps (...
0
votes
1answer
64 views

.NET application protection technique against cracking

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market. Info about the software: Built using .NET C# (Framework 4.5.2) ...
1
vote
0answers
77 views

How to analyze a USB device of having possibly malicious capabilities?

So I recently ordered a chinese external USB card and I would like to find out whether it has some hidden functionality, which might become malicious. It has buttons integrated in it so Linux using ...
0
votes
1answer
81 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
0
votes
3answers
197 views

ret2libc - why need 4 bytes of garbage

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...
2
votes
0answers
94 views

Ghidra Load Linux Headers [closed]

I'm trying to reverse engineer a linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register etc, but it cannot determinate their exact ...
1
vote
0answers
95 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
0
votes
1answer
159 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
2
votes
1answer
63 views

Access to foreign memory address

Question is pretty simple. Modern operating system like windows 10 isolates memory addresses for his processes so ... how is possible that Cheat Engine can gets these address and changing their values ...
0
votes
1answer
106 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
0
votes
1answer
60 views

how to extract binaries from SOHO routers and other devices

I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-...
1
vote
1answer
67 views

Is there a way to protect a supporting app against changing the REST endpoint?

Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application. Looking for online, I found some articles about this app ...
4
votes
1answer
437 views

Program detecting sandboxie present - How to prevent?

I am having issues with a particular game, detecting the presence of the games being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple ...
3
votes
0answers
66 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
1
vote
1answer
287 views

Malicious 'specially crafted' MP4 file [closed]

I came across CVE-2019-2107 that says ".... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video (with tiles enabled - ps_pps->...
0
votes
0answers
179 views

Cycript (Killed: 9 error) on jailbroken ios 11.4

I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console. Searching online ...
0
votes
1answer
123 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
0
votes
1answer
117 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
0answers
49 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
0
votes
0answers
77 views

Not able to work ret2text technique for 64 bit system

I am trying to call a dead function using buffer overflow. The binary is compiled on a 64-bit system with -fno-stack-protector and -no-pie. ASLR is turned off. Here is the code: #include<stdio.h&...
0
votes
0answers
35 views

Fixing Corrupted ELF Section Size

I dropped an ELF to IDA, which IDA give me an error that the "Binary data is incorrect". I research a bit and found out that some of the ELF sections dont have a valid section size and their section ...
21
votes
3answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
1
vote
1answer
97 views

how to get address of PE section to jump in while backdooring PE binary

I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named .test) containing some shellcode, changing the first CALL ...
0
votes
2answers
380 views

Is it possible to extract secret key in compiled code automatically?

If we have a program that contains a secret key in its compiled code, is it possible to write a program that can automatically extract the secret key? Let's assume that the program contains a secret ...
2
votes
1answer
252 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
4
votes
2answers
9k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
15
votes
2answers
11k views

What is the difference between Ghidra and Ida?

Is there a comparison between Ghidra and Ida? Are there any specific features and functionality that Ghidra while Ida doesn't? Is there a good source (most preferably book) that explain Ghidra in ...
1
vote
0answers
270 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
7
votes
1answer
553 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
0
votes
0answers
26 views

Unkown encryption type? [duplicate]

200 character long string ...
1
vote
0answers
49 views

Is there a way to refuse Process Hooking on jailbroken iOS devices

I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add -Wl,-sectcreate,...
1
vote
0answers
85 views

Is there a way to refuse Process Hooking on JailBreak IOS devices

I want to find a way to prevent apps from Cycript attaching. So Far I Know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add "-Wl,-sectcreate,...
0
votes
3answers
353 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
1
vote
0answers
65 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
1
vote
0answers
279 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
45 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
3
votes
1answer
63 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
2
votes
2answers
748 views

Why does my stack contain the return address to __libc_csu_init after main is initialised?

I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack. 1 #include<stdio.h> 2 3 int main(int argc, char *argv[]){ 4 char ...
1
vote
2answers
137 views

is it possible to craft exploits for non-open source C/C++ software without fuzzing?

imagine that if i wanted to find a vulnerability in a program that is used by a lot of people in order to exploit it. the program is open source and is written in C/C++ . would this even be possible ...
1
vote
1answer
187 views

Reverse Engineering Unable to identify String encryption [closed]

I'm on an ethical hacking challenge. Which I asked here before. But I need a hint on solving this puzzle. Note: I do not need the problem resolved, just a hint. URI=...
29
votes
4answers
13k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
2
votes
2answers
1k views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
4
votes
3answers
1k views

What assembly should I learn? [closed]

I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn? I have prior experience in programming, and I did a degree in Computer Science but ...
1
vote
2answers
645 views

How to analyze malware to find out where keylogger sent data?

Recently my antivirus detected some keyloggers that infected my network. I have those malware files and I want to analyze them. How can I do this analysis? It is important to find out details like ...

1 2 3 4 5