Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

Looking for tool for searching in file magic numbers [on hold]

There was a tool that gives probable files headers in whole file(like lzma, crc header, aes etc). I can't remeber name ( not binwalk and trid).
0
votes
0answers
30 views

Cycript (Killed: 9 error) on jailbroken ios 11.4

I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console. Searching online ...
0
votes
1answer
108 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
0
votes
1answer
86 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
0answers
38 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
0
votes
0answers
57 views

Not able to work ret2text technique for 64 bit system

I am trying to call a dead function using buffer overflow. The binary is compiled on a 64-bit system with -fno-stack-protector and -no-pie. ASLR is turned off. Here is the code: #include<stdio.h&...
0
votes
0answers
30 views

Fixing Corrupted ELF Section Size

I dropped an ELF to IDA, which IDA give me an error that the "Binary data is incorrect". I research a bit and found out that some of the ELF sections dont have a valid section size and their section ...
21
votes
3answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
1
vote
1answer
55 views

how to get address of PE section to jump in while backdooring PE binary

I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named .test) containing some shellcode, changing the first CALL ...
0
votes
2answers
185 views

Is it possible to extract secret key in compiled code automatically?

If we have a program that contains a secret key in its compiled code, is it possible to write a program that can automatically extract the secret key? Let's assume that the program contains a secret ...
1
vote
0answers
112 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
2
votes
1answer
4k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
14
votes
2answers
5k views

What is the difference between Ghidra and Ida?

Is there a comparison between Ghidra and Ida? Are there any specific features and functionality that Ghidra while Ida doesn't? Is there a good source (most preferably book) that explain Ghidra in ...
1
vote
0answers
110 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
7
votes
1answer
331 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
0
votes
0answers
26 views

Unkown encryption type? [duplicate]

200 character long string ...
1
vote
0answers
44 views

Is there a way to refuse Process Hooking on jailbroken iOS devices

I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add -Wl,-sectcreate,...
1
vote
0answers
42 views

Is there a way to refuse Process Hooking on JailBreak IOS devices

I want to find a way to prevent apps from Cycript attaching. So Far I Know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add "-Wl,-sectcreate,...
0
votes
3answers
284 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
1
vote
0answers
48 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
1
vote
0answers
212 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
40 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
3
votes
1answer
55 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
1
vote
2answers
254 views

Why does my stack contain the return address to __libc_csu_init after main is initialised?

I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack. 1 #include<stdio.h> 2 3 int main(int argc, char *argv[]){ 4 char ...
1
vote
2answers
119 views

is it possible to craft exploits for non-open source C/C++ software without fuzzing?

imagine that if i wanted to find a vulnerability in a program that is used by a lot of people in order to exploit it. the program is open source and is written in C/C++ . would this even be possible ...
1
vote
1answer
184 views

Reverse Engineering Unable to identify String encryption [closed]

I'm on an ethical hacking challenge. Which I asked here before. But I need a hint on solving this puzzle. Note: I do not need the problem resolved, just a hint. URI=...
29
votes
4answers
10k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
2
votes
2answers
630 views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
4
votes
3answers
952 views

What assembly should I learn? [closed]

I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn? I have prior experience in programming, and I did a degree in Computer Science but ...
1
vote
2answers
489 views

How to analyze malware to find out where keylogger sent data?

Recently my antivirus detected some keyloggers that infected my network. I have those malware files and I want to analyze them. How can I do this analysis? It is important to find out details like ...
3
votes
1answer
463 views

How do security experts benefit from reverse-engineering?

How can reverse engineering (RE) help a security expert? I've participated in CTF challenges and I have seen RE as an important part of CTFs. Can anyone explain or show me a real scenario that shows ...
1
vote
0answers
343 views

Help with breaking SSL pinning of this app [closed]

I need help removing SSL pinning of this original Android app. I've tried different techniques like hooking the app with Objection, re-pinning with Frida, using the SSLUnpinning app from the Xposed ...
1
vote
2answers
372 views

My ISP blocks incoming ports so I can't even run webserver let alone 'reverse shell', any ideas? [closed]

I'm looking for ideas on how to run lab environment from "victim" test PC at work and "attacker" - my home PC. Both are on separate ISPs, but it seems that my ISP at home blocks anyone trying to ...
1
vote
0answers
283 views

Security of SQRC QR codes

I'm currently testing an application which uses QR codes to identify products. Now if I scan the QR code with any reader and generate a new QR code with the read text, it differs from the original QR ...
18
votes
1answer
859 views

Skype opens base64-encoded JavaScript. What does it do?

I just came across a rather unusual problem, and I cannot figure out if it actually is a problem (or even security issue) or not. Upon opening Skype on MacOS, a popup window appears (multiple times, ...
2
votes
1answer
1k views

Does Java anti-decompiler software really work as claimed?

BIS Guard's Java Antidecompiler is an application that you can purchase that claims: Java Antidecompiler protects java byte-code against decompilers, any binary viewers/editors, prevents reverse ...
1
vote
1answer
2k views

How to edit a Hex code without corrupting the file [in bypassing av]?

I recently started studying on bypassing AV by finding a AV signature on "nc.exe (NetCat)" and changing it to see how it works. I have already found the place of signature with splitting method then i ...
0
votes
1answer
78 views

Reverse a key diversification algorithm

What are the possible ways of reversing a key diversification algorithm? This is used to generate a different key for each user. I know the operands involved (three 4 bytes values) and the result (...
-3
votes
1answer
396 views

x86 vs x64 exploitation [closed]

A lot of the texts I’ve looked at seems to be based on 32 bit processors. How different is reversing 32 bit and 64 bit? Is it easy to pick up the 64 bit stuff if I learn the 32 bit stuff?
1
vote
1answer
138 views

How does malware connect to FTP servers without revealing credentials to the victim?

Let’s take an FTP based passwords stealer, or some keylogger, that uploads the details of our victims to our FTP server. How do they connect back to our FTP server? As far as I know that for ...
4
votes
2answers
1k views

Preventing users from bypassing root/jailbreak detection measures

A pentest was made to our mobile app (Android and iOS version) and we received feedback stating that jailbreak/root detection was ineffective because it was relatively easy to reverse engineer the ...
12
votes
2answers
1k views

Malware sandbox detection

I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from ...
3
votes
1answer
141 views

Printer Driver Threats

In an environment where users connect their devices to printers through USB, the device will be prompted to install its driver if it's the first time. As far as I'm aware for OSX, the drivers are ...
1
vote
1answer
61 views

Can an unloaded malicous.dll placed on the “drive by download ” directory be remotly exploited?

Some programs can be downloaded to the drive-by download directory through the browser , the easy way is to unpack the program on the /download directory (It is the default path if the user doesn't ...
1
vote
1answer
1k views

Is there some way to protect apk file from being decompiled?

I'd like to know if there's something to help with that that isn't over complicated as I'd like to protect an Android application against that at least a bit. I'd like to make clear that I'm talking ...
1
vote
0answers
79 views

Become master in two different infosec fields [closed]

I need career advice. I'm deeply,insanely interested in two fields of cyber security: Malware Analysis Web/System/Network Penetration Testing I have lots of learning resources about pentesting and ...
3
votes
1answer
913 views

How find the hash creation method knowing password, salt, and resulting hash?

If I know the password, the salt (supposed salt actually) and the output hash (sha1 format). How can I find the hash creation method ? I tried basic stuff like sha1(salt+password) sha1(...
1
vote
0answers
580 views

Bypassing Certificate/SSL Pinning using AppMon

I'm trying to reverse engineer an app that has Native layer certificate pinning, I can't go that deep in to patching so I've been looking in to other available options, one i came accross was appmon, ...
0
votes
2answers
187 views

Legality of sniffing own traffic between mobile app and server

Recently I found a bug on a mobile app which claims to protect their users' privacy, however after connecting my phone with burp and installing a certificate I noticed that this app was sending a ...
0
votes
3answers
4k views

Android app man-in-the-middle attack

Let's suppose I have an Android app that after strong authentication pulls sensitive data from server A and sends it to server B without storing it. The data appears only in the network traffic (...