Questions tagged [reverse-engineering]

Reverse engineering is the process of discovering the technological principles of a human made device, object or system through analysis of its structure, function and operation.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

How to determine encryption type?

What type of encryption is this? l��� $�a&e;u��K��9��d���6�m�j�� Fh3� g\拡b��8o;��6�=S�[�^e�tGB�ʪ�o�Q}p��`��k�9/����A�FA �Va���H�hjvǺH4�/c# ��7 %��$�yO���VS����/g/u�<�{�o> Z&y�����z��a�C&...
0
votes
1answer
73 views

Should I complie software after making all the variable and function names “1-2 character”? [duplicate]

In JavaScript, it seems common for the official release of the code to use only single-character variable and function names (of course, after converting the original code which uses clearer names) in ...
0
votes
1answer
49 views

how to extract binaries from SOHO routers and other devices

I read this excellent article about vulnerability research into a DLINK wireless router. The researcher explains clearly the coding mistake that leads to the vulnerability. He obviously reverse-...
0
votes
0answers
53 views

Find a regex pattern from a secret [closed]

I have a secret that looks like as follow c2b47f2d-4b5d-3a4c-a337-5d2a41212dc3 My goal is to find any algorithm or any pattern which is used to generate such a secret. Could someone give some hints ...
3
votes
1answer
201 views

Program detecting sandboxie present - How to prevent?

I am having issues with a particular game, detecting the presence of the games being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple ...
1
vote
1answer
63 views

Is there a way to protect a supporting app against changing the REST endpoint?

Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application. Looking for online, I found some articles about this app ...
3
votes
0answers
49 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
1
vote
1answer
124 views

Malicious 'specially crafted' MP4 file [closed]

I came across CVE-2019-2107 that says ".... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video (with tiles enabled - ps_pps->...
0
votes
0answers
94 views

Cycript (Killed: 9 error) on jailbroken ios 11.4

I am doing security research on a jailbroken ios 11.4 using cycript. When attempting to attach to a process using cycript -p <pid>, I get a Killed: 9 error in the console. Searching online ...
15
votes
2answers
7k views

What is the difference between Ghidra and Ida?

Is there a comparison between Ghidra and Ida? Are there any specific features and functionality that Ghidra while Ida doesn't? Is there a good source (most preferably book) that explain Ghidra in ...
1
vote
2answers
127 views

is it possible to craft exploits for non-open source C/C++ software without fuzzing?

imagine that if i wanted to find a vulnerability in a program that is used by a lot of people in order to exploit it. the program is open source and is written in C/C++ . would this even be possible ...
0
votes
1answer
115 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
0
votes
1answer
95 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
7
votes
1answer
436 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
1
vote
0answers
42 views

puts(address of stack) does not print the string pointed by the address

I am trying to do ROP using gadget chaining technique on a 64-bit machine. This is the source code: #include<stdio.h> int main(){ char * str = "Hello World!"; char buf[4]; puts(str)...
0
votes
0answers
63 views

Not able to work ret2text technique for 64 bit system

I am trying to call a dead function using buffer overflow. The binary is compiled on a 64-bit system with -fno-stack-protector and -no-pie. ASLR is turned off. Here is the code: #include<stdio.h&...
3
votes
1answer
6k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
0
votes
2answers
264 views

Is it possible to extract secret key in compiled code automatically?

If we have a program that contains a secret key in its compiled code, is it possible to write a program that can automatically extract the secret key? Let's assume that the program contains a secret ...
1
vote
3answers
17k views

How to set reverse tcp connection when doing pentesting in VMs?

msfconsole is a cool opensource pentesting tool from metasploit. Once the exploit is valid, we can set payload to the victim. For persistent connection, we may need meterpreter. But we often test ...
0
votes
0answers
30 views

Fixing Corrupted ELF Section Size

I dropped an ELF to IDA, which IDA give me an error that the "Binary data is incorrect". I research a bit and found out that some of the ELF sections dont have a valid section size and their section ...
21
votes
3answers
8k views

Can I rely on these GitHub repository files?

I recently found the GitHub repository https://github.com/userEn1gm4/HLuna, but after I cloned it I noted that the comparison between the file compiled (using g++) from source, HLuna.cxx, and the ...
1
vote
1answer
68 views

how to get address of PE section to jump in while backdooring PE binary

I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named .test) containing some shellcode, changing the first CALL ...
1
vote
0answers
159 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
1
vote
0answers
183 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
1
vote
2answers
372 views

Why does my stack contain the return address to __libc_csu_init after main is initialised?

I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack. 1 #include<stdio.h> 2 3 int main(int argc, char *argv[]){ 4 char ...
1
vote
0answers
64 views

Is there a way to refuse Process Hooking on JailBreak IOS devices

I want to find a way to prevent apps from Cycript attaching. So Far I Know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add "-Wl,-sectcreate,...
0
votes
0answers
26 views
4
votes
3answers
3k views

how to make software reverse engineering difficult

In software reverse engineering, we use a dissembler, a debugger, and a code patcher. OllyDbg includes all. One of the differences between actual execution of a program and debugging through using ...
1
vote
0answers
47 views

Is there a way to refuse Process Hooking on jailbroken iOS devices

I want to find a way to prevent apps from Cycript attaching. So far I know Cycript works as below, but I can not find a way to stop Cycript. One method to stop injection is to add -Wl,-sectcreate,...
5
votes
1answer
443 views

A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?

VMProtect Software (found at http://vmpsoft.com/) claims that it: "allows the generation and verification of serial numbers. Both manual and automatic generation are supported. Serial numbers can be ...
0
votes
3answers
319 views

Does exploit development have a future? [closed]

Does exploit development have a future? I mean there are a lot of fuzzers and they can find bugs better and with less time than humans. And today's there are lots of great fuzzers. I love exploit ...
1
vote
0answers
53 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
1
vote
0answers
231 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
42 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
3
votes
1answer
56 views

Running a brief asm script inline for dynamic analysis

Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop? There's only one system call to time, and at ...
18
votes
1answer
893 views

Skype opens base64-encoded JavaScript. What does it do?

I just came across a rather unusual problem, and I cannot figure out if it actually is a problem (or even security issue) or not. Upon opening Skype on MacOS, a popup window appears (multiple times, ...
-2
votes
2answers
448 views

Olly Debugger Linux not functioning

In Kali Linux whenever I open a binary in Olly Debugger after compiling the c source file, it gives an error: "The file is not a valid PE file." No debugging takes place thereafter. Is there any ...
30
votes
8answers
7k views

Is there a way to prevent someone from making his own client app for my webservice? [duplicate]

Say I have a RESTful web service and a commercial Android app on the front end which is used to interact with it. I may use SSL so that the endpoints are not visible, but someone could still do some ...
3
votes
1answer
143 views

Printer Driver Threats

In an environment where users connect their devices to printers through USB, the device will be prompted to install its driver if it's the first time. As far as I'm aware for OSX, the drivers are ...
1
vote
1answer
185 views

Reverse Engineering Unable to identify String encryption [closed]

I'm on an ethical hacking challenge. Which I asked here before. But I need a hint on solving this puzzle. Note: I do not need the problem resolved, just a hint. URI=...
2
votes
2answers
853 views

Overflowing the buffer yet not jumping to address

I am a beginner at buffer overflows been studying this subject from a few days and i found this exercise (code from: here) I think understand the basic concept i write more than 64 bytes characters ...
29
votes
4answers
11k views

I feel like it's impossible to learn reverse engineering [closed]

I know how to use most of the tools in Kali like msfvenom and msfconsole and I can safely call myself a script kiddie. I learned the basics of C# and that helps me understand some of the things in C, ...
4
votes
3answers
981 views

What assembly should I learn? [closed]

I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn? I have prior experience in programming, and I did a degree in Computer Science but ...
1
vote
2answers
574 views

How to analyze malware to find out where keylogger sent data?

Recently my antivirus detected some keyloggers that infected my network. I have those malware files and I want to analyze them. How can I do this analysis? It is important to find out details like ...
7
votes
2answers
7k views

Where is the PE loader in Windows?

I have read that the PE loader is responsible for loading executable images from disk. When and where is the control flow exactly transferred to the loader? The PE format is well documented but there ...
3
votes
1answer
498 views

How do security experts benefit from reverse-engineering?

How can reverse engineering (RE) help a security expert? I've participated in CTF challenges and I have seen RE as an important part of CTFs. Can anyone explain or show me a real scenario that shows ...
14
votes
2answers
4k views

Viewing the stack

I recently started learning about buffer overflows and how they work. Someone shared a binary to practice on (in a vm, don't worry). I've been feeding strings to the socket that the binary opens, and ...
1
vote
0answers
364 views

Help with breaking SSL pinning of this app [closed]

I need help removing SSL pinning of this original Android app. I've tried different techniques like hooking the app with Objection, re-pinning with Frida, using the SSLUnpinning app from the Xposed ...
1
vote
2answers
424 views

My ISP blocks incoming ports so I can't even run webserver let alone 'reverse shell', any ideas? [closed]

I'm looking for ideas on how to run lab environment from "victim" test PC at work and "attacker" - my home PC. Both are on separate ISPs, but it seems that my ISP at home blocks anyone trying to ...
1
vote
0answers
331 views

Security of SQRC QR codes

I'm currently testing an application which uses QR codes to identify products. Now if I scan the QR code with any reader and generate a new QR code with the read text, it differs from the original QR ...