Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Mnemonic Seed Phrase Generation For Private Key Truncation

The below code block is capable of generating a mnemonic seed phrase. If I want to generate a mnemonic seed for a private key, is it then correctly understood that I should input the private key as ...
0
votes
1answer
47 views

Overwrite return address in C

It's about a CTF Challenge. I'm trying to execute a buffer overflow attack on a C program. The code is : #include<stdio.h> #include<string.h> #include<stdlib.h> #include <sys/...
0
votes
2answers
42 views

How to find vulnerabilities in a program by looking at it's source code [closed]

Hello I have recently started learning Reverse Engineering. I often hear that it's much easier to find vulnerabilities in a program by looking at it's source code, but i don't know how to find them or ...
1
vote
1answer
92 views

Does the DICOM file header gets lost when transferred over the network?

I am currently investigating the PEDICOM vulnerability CVE-2019-11687 where I am trying to reassemble the P-DATA DICOM fragments from a PCAP. Since the vulnerability takes advantage of writing bytes ...
0
votes
1answer
48 views

How to identify user created vs. external functions in disassembly

I'm new to assembly and have been playing around with it. While i was analyzing malware, I realised that there are multiple functions named sub_xxxxxx. How does one determine if this sub_xxxxxx is ...
0
votes
1answer
40 views

Static detection of PE

I'm doing in static analysis of PE file. Can PE file have two or more executable sections? How can we detect whether it is injected or not?
1
vote
0answers
56 views

static analysis for identifying backdoors in PE [duplicate]

I am doing research in identifying backdoors in Windows .exe files. Currently I found some methods to detect them: String search in .exe Find reference .dll and win32 API calls using import table ...
0
votes
0answers
45 views

Disassemble a release version of an Electron App via LLDB

I am trying to disassemble of an electron app in my OSX (Mac os catalina 10.15.3) via LLDB. lldb path/to/Electron.app >>> Current executable set to 'path/to/Electron.app' (x86_64). After ...
0
votes
0answers
71 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
1
vote
1answer
58 views

Securing media uploading to the cloud from reverse engineering

I own an RPG multiplayer game written in Java, where players can fight each other in the game. Recently I planned to invent a new feature, where the last 15 seconds of your fight and the "knockout" ...
0
votes
0answers
52 views

How to decrypt a rocksdb file from Android?

I have collected an encrypted RocksDB file from an Android application. By reverse engineering the mobile application I have also collected the encryption key. However, for the life of me I cannot ...
0
votes
0answers
79 views

Questions about process hollowing

When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
0
votes
1answer
438 views

Strange HTTP request from binaryedge.ninja

I found the following strange HTTP request apparently emanating from binaryedge.ninja: min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-" "-...
0
votes
0answers
86 views

Osx protections binary patch

I'm newbie in reverse engineering field recently I tried my "skill" in real world applications (apple MacOS) , but think that something went wrong during the binary patch. I tried to patch 3 apps (...
0
votes
1answer
81 views

.NET application protection technique against cracking

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market. Info about the software: Built using .NET C# (Framework 4.5.2) ...
1
vote
0answers
83 views

How to analyze a USB device of having possibly malicious capabilities?

So I recently ordered a chinese external USB card and I would like to find out whether it has some hidden functionality, which might become malicious. It has buttons integrated in it so Linux using ...
0
votes
1answer
121 views

Reverse engineering and buffer overflows: zero to hero [closed]

When I do CTFs, I can usually cope well with and understanding everything pretty much apart from buffer overflows, binary exploitation and reverse engineering Almost to the point that I would ...
0
votes
3answers
368 views

ret2libc - why need 4 bytes of garbage

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...
2
votes
0answers
266 views

Ghidra Load Linux Headers [closed]

I'm trying to reverse engineer a linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register etc, but it cannot determinate their exact ...
1
vote
0answers
122 views

Passively read key from process memory without invoking kernel (windows 10)

I have a process that loads into memory like any other process. It contains a special key. Our goal is to read this key inside memory...or while it is in transit across the data bus from cpu. The ...
0
votes
1answer
175 views

Exploiting vulnerabilities in the C code

I'm preparing for an introductory information security examination in university and this is one of the examination questions on Secure Programming. In such questions, I would usually catch for ...
2
votes
1answer
92 views

Access to foreign memory address

Modern operating systems like Windows 10 isolate memory addresses for processes so how is it possible that Cheat Engine can get these addressed and change their values? At this forum it has already ...
0
votes
1answer
109 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
0
votes
1answer
62 views

how to extract binaries from SOHO routers and other devices

I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-...
1
vote
1answer
69 views

Is there a way to protect a supporting app against changing the REST endpoint?

Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application. Looking for online, I found some articles about this app ...
4
votes
1answer
638 views

Program detecting sandboxie present - How to prevent?

I am having issues with a particular game, detecting the presence of the games being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple ...
3
votes
0answers
81 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
1
vote
1answer
424 views

Malicious 'specially crafted' MP4 file [closed]

I came across CVE-2019-2107 that says ".... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video (with tiles enabled - ps_pps->...
0
votes
0answers
228 views

Cycript (Killed: 9 error) on jailbroken ios 11.4

I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console. Searching online ...
0
votes
1answer
127 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
0
votes
1answer
124 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
0answers
55 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
0
votes
0answers
92 views

Not able to work ret2text technique for 64 bit system

I am trying to call a dead function using buffer overflow. The binary is compiled on a 64-bit system with -fno-stack-protector and -no-pie. ASLR is turned off. Here is the code: #include<stdio.h&...
21
votes
3answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
1
vote
1answer
172 views

how to get address of PE section to jump in while backdooring PE binary

I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named .test) containing some shellcode, changing the first CALL ...
0
votes
2answers
519 views

Is it possible to extract secret key in compiled code automatically?

If we have a program that contains a secret key in its compiled code, is it possible to write a program that can automatically extract the secret key? Let's assume that the program contains a secret ...
2
votes
1answer
421 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
6
votes
2answers
13k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
17
votes
2answers
15k views

What is the difference between Ghidra and Ida?

Is there a comparison between Ghidra and Ida? Are there any specific features and functionality that Ghidra while Ida doesn't? Is there a good source (most preferably book) that explain Ghidra in ...
1
vote
0answers
331 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
7
votes
1answer
667 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
0
votes
0answers
28 views

Unkown encryption type? [duplicate]

200 character long string ...
1
vote
0answers
52 views

Is there a way to refuse Process Hooking on jailbroken iOS devices

I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add -Wl,-sectcreate,...
1
vote
0answers
120 views

Is there a way to refuse Process Hooking on JailBreak IOS devices

I want to find a way to prevent apps from Cycript attaching. So Far I Know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add "-Wl,-sectcreate,...
0
votes
3answers
393 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
1
vote
0answers
77 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
1
vote
0answers
307 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
46 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
3
votes
1answer
65 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
2
votes
2answers
1k views

Why does my stack contain the return address to __libc_csu_init after main is initialised?

I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack. 1 #include<stdio.h> 2 3 int main(int argc, char *argv[]){ 4 char ...

1
2 3 4 5