Reverse Engineering Questions, Problems & Solutions : TransWikia.com ~ Page 34

Reverse engineering a partially known binary format

I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by...

Asked on 01/06/2021 by S. Kalabukha

3 answer

What does this custom piece of frame manipulation code from a router binary do?

I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining){ uint16_t *remaininga; //...

Asked on 01/06/2021

1 answer

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already...

Asked on 01/05/2021 by quickgame

1 answer

trying to understand this mov memory[register] instruction

Windows 10, IDA Home, 64bit application compiled with Visual Studio. I'm reverse engineering a crackme and i found this instruction : mov cl, byte_51B000[eax]...

Asked on 01/04/2021 by ker2x

0 answer

Unpack old DLink DIR-855 firmware

I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614.zip A quick binwalk showls the following:$...

Asked on 01/04/2021

0 answer

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is...

Asked on 01/03/2021 by Meryy

1 answer

Is there an event log to check when WinDbg kernel debugger fails to attach on OS load?

I'm using the latest WinDbg (Preview) to do kernel debugging on a Windows 10 client (v 1909) via a network connection in a VM. And I'm wondering if there's a...

Asked on 01/02/2021

0 answer

Tracing all (or most of) function calls in a specific Android app

I'm having a problem, where I'm trying to trace some function calls in an Android app, that uses JNI for about all of its work. More specifically, a function call,...

Asked on 01/02/2021 by Timotej Leginus

0 answer

LPC2378FBD144 Arm7 hex file

I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3im little confused about memory organization values i should put in the memory organization...

Asked on 01/01/2021 by Kamil Amin

1 answer

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information :...

Asked on 01/01/2021

2 answer

Ask a Question

Get help from others!

Reverse Engineering : Recent Questions and Answers (Page 34)

Ask a Question