Hi Geeks/Developers/Engineers/Programmer/Techies and all other dudes,

I've building **FABX**, an open-source AI-powered file intelligence and reverse engineering project.

GitHub: https://github.com/avarshvir/FABX

The idea is simple: instead of looking at executable raw hex binaries, executable, ML models, databases, or configuration files, FABX analyzes them, generates graphs/flows, and uses a local LLM (Ollama) to explain what's going on, how things works and try to write the code.

**Currently it supports:**

* **Machine Learning Models:** Extracts layers, weight/bias shapes, and parameters for `.onnx`, `.pt`, `.pkl`, and `.joblib`. and Visualize the model that how layers and neurons are arranged.

* **Databases:** Extracts schema, tables, views, keys, and content (`.db`, `.sqlite`). and try to write sql queries/code

* **Structured Configs:** Statistics and tree visualization for `.json`, `.yaml`, `.toml`, `.ini`

\---------------------------

**Now I am working on Executable Reverse Engineering:**

So that it can support .exe, .dll, .elf, .so, .bin

Example:

When user uploads .exe file in FABX, then it parses executable to headless rizin which gives decompiled code, hex code and asm code then these codes sent to LLM via ollama which understand the context, find the patterns and logic then it gives us explanation and try to write the code, code might not be same as original one.

\------------------------------

FABX isn't trying to compete with tools like Ghidra or Rizin. Those projects are mature and incredibly powerful but looks old skool, hard to use and gives raw binaries which sometime hard to understand. The goal of FABX is to build a modern, AI-assisted layer on top of reverse engineering tools which support multiple types of extension files.

I've already opened issues for the feature and would love to receive contributions.

Feedback is always welcome. Thanks :)

I've been working on a small open-source hardware reverse engineering project involving an older battery-powered system. The goal is to better understand how the original battery communicates with the device and to document the protocol for educational purposes. Along the way, I'm also exploring a compatible battery interface using commonly available components.

If you're interested in embedded systems, battery management, hardware reverse engineering, or would like to contribute, I've published the current work on GitHub. Feedback, testing, documentation, and additional research are all welcome.

GitHub: https://github.com/liquidproton/3M-TR-801N-Battery-Emulator

I'm working with B.Braun HiBaSeD US v2.2.0 infusion pump configuration software (32-bit Windows executable, Borland/Delphi compiled). I've modified a drug library file (.GC_syt / Reli format) and need to understand how to update or bypass the CRC checksum so the software accepts the modified file. I have Ghidra downloaded and ready to go (https://github.com/NationalSecurityAgency/ghidra/releases) and am happy to share the binary or file samples with anyone willing to take a look.

What the binary looks like:

• 32-bit Windows PE executable
• Compiled with Borland/Delphi (evident from decorated symbol names like @@Tfilecheck@Initialize, @@Crc32@Initialize, _simcom_cltsnd)
• Has exported symbols — not fully stripped
• Runs as part of a service architecture (parent process: B.Braun Space Service)
• Multi-threaded

The error:
"Testing of the Disposable Syringes data produced a CRC error. [full file path]"

What I've already tried (please don't suggest these):

With x32dbg:

• Set breakpoints on ALL exported CRC symbols: @@Crc32@Initialize, @@Crc32@Finalize, @@Tupgradecrcrecovery@Initialize, @@Tupgradecrcrecovery@Finalize — none triggered during file loading, only during startup
• Set breakpoints on all CRC-related string references including "IDS_CALCULATECRCERROR", "IDS_DataCRCError", "Device drug-lib-CRC 0x%X differs from expected 0x%X" — none triggered
• Set breakpoint on @@Tfilecheck@Initialize at 0044EEA0 — this does fire during startup
• Launched HiBaSe through x32dbg (File → Open) rather than attaching after startup
• Logged ECX, EBX, ESP at @@Tfilecheck@Initialize — ECX points to an empty/uninitialized object at function entry
• Traced call chain: _simcom_cltsnd → _UpgradeValidate → @@Tfilecheck@Initialize
• Paused x32dbg while CRC error dialog was on screen — call stack showed @@Tworkthread_press@Finalize as the active function

Key discovery:
HiBaSe pre-validates ALL files in its Disposables folder on startup — not when you manually select them. Process Monitor confirmed HiBaSe reads the modified file 1,632 times in 0.07 seconds during startup. By the time you choose a file from the UI, HiBaSe has already flagged it as bad.

What I need help with:

1. Best approach in Ghidra for a Delphi binary — are there specific plugins or workflows that help reconstruct Delphi class structures and vtables? Particularly around @@Tfilecheck@Initialize.
2. Understanding the checksum algorithm — is there a way to determine whether it's standard CRC32 or something custom? The file has a field called SYRTABCHKSUM.
3. Patching strategy — once I find the validation routine, would it be cleaner to patch the binary, update the checksum in the file itself, or NOP out the validation jump?
4. Delphi-specific tips — any IDR (Interactive Delphi Reconstructor) workflows that would complement Ghidra here?

Happy to share screenshots, the binary, or file samples. Thanks in advance.

Hi everyone,

I hope you’re all doing well.

I’ve been working on a small personal project (creating an Arabic fan translaton for Fatal Frame / Project Zero: Mask of the Lunar Eclipse on PC/Steam.

This is something I’m doing purely out of love for the series. I’m not selling anything or distributing any copyrighted files — I just want to make the game more accesible for Arabic-speaking players who enjoy it as much as I do.

I’ve already reached out to the developer/support team for any technical insight, but I thought I’d also ask here since people in this comunity often have hands-on experiance with modding and localization.

What I’ve figured out so far
- The game uses .fmsg files for text.
- I can extract the English text, edit it, rebuild the .fmsg, and the game loads it without issues.
- English edits show up correctly in-game.
- For example, changing the door prompt from “Open” to “TEST” works fine.
- Japanese characters also display correctly when inserted into the English .fmsg files.
- However, Arabic text does not show up at all.
- When I try something like (افتح), the text dissapears completely (though the button prompt still shows).
- Arabic Presentation Forms don’t display either.
- I checked the font files located in: binary/font/JP, binary/font/SC & binary/font/TC
- Using Process Monitor, I confirmed the game loads: binary/font/JP/default.g1n along with the relevant .fmsg files.
- I tried adding Arabic glyphs using G1N Font Editor, but they still don’t render in-game.
- I also experimented with basic glyph replacement and character map tweaks, but no luck so far.

Issue with Fatal Frame All In One
I also tried using Fatal Frame All In One by Jupisoft, but I ran into a strange issue, All-In-One.exe launches (I can see it in Task Manager), but no window appears.

What I’ve tried
- Running it normally
- Running it as administrator
- Launching it through CMD
- Checking %ERRORLEVEL% (it returns 0)
- Running: dotnet "All In One.dll" (which just hangs with no visible window)
- Reviewing Settings.txt
- Fixing the game path to match my Steam instalation
- Disabling dark mode / dark mode negative settings
- Checking the Debugger file (no useful logs)
- At this point, I haven’t been able to get it working, so I’m continuing with my own extraction/rebuild process.

What I think might be happening
- Arabic Unicode might be getting filtered or rejected before rendering
- The .g1n font character map might need proper patching
- There could be a seperate text rendering or layout system that blocks unsupported Unicode ranges
- There might be another font, cache, or table involved that I haven’t found yet
- The game might not support RTL/Arabic without deeper modificatons

What I’m hoping to learn
If anyone here has experiance with Koei Tecmo formats like .fmsg, .g1n, .kscl, or has worked on Fatal Frame / Project Zero modding, I’d really apreciate any pointers.
I’m not expecting anyone to do the work for me. I just need some direction on where to look next, especially regarding:
- Properly adding Arabic glyphs
- Patching or understanding the character map
- Why Arabic codepoints might be rendering as blank
- Possible workarounds for RTL text
- Getting Fatal Frame All In One to actually open
- Any useful tools for working with .g1n, .fmsg, or .kscl
Any advice or insight would mean a lot. I’d really love to complete this translation and share it with other Arabic-speaking fans.

Thanks so much for reading

Hey everyone,

I'm currently working on a project to rebrand and customize the web UI for a VSOL V2802DAC v5 ONU router (Firmware V3.2.00).

What I've done so far:

• Extracted the firmware components: uImage (kernel), rootfs (SquashFS), and custconf.
• Analyzed the fwu.sh upgrade script to understand the partition mapping and MD5 verification process.
• Successfully modified the web assets in the SquashFS filesystem.

The Problem: I'm running into some issues with the "round-trip" process. Specifically, ensuring the modified rootfs (repacked with xz compression) is accepted by the bootloader/upgrade script without bricking. I've noticed differences in the custconf partition sizes between the "Normal" and "VSOL" versions of the firmware that I can't quite account for.

Questions:

1. Has anyone successfully bypassed or modified the signature/integrity checks on these Realtek-based VSOL units?
2. Are there specific mksquashfs parameters required for this hardware beyond standard xz compression?
3. Does anyone have experience with the custconf partition structure for VSOL?

Any pointers or documentation on VSOL's specific MTD layout would be greatly appreciated!

So, i think that question seems really naive (and sorry if it is, i'm just an person really interested in subject and who really want to be good at it), but which "advanced" topics are a must to study (and where to find resources on it)? I can only think in VM Obfuscation and Weird Machines.

I have a large binary file for a mobile app (iOS). It’s about 900 MB, and I need the entire file, because breaking it down into parts would be a huge hassle. On my PC, the pseudo-code analysis took three days and still didn’t finish. What are my options? Ideally, something affordable.

I'm new to IDA and I was wondering if there is any ways to speed up decompilation in IDA, I am decompiling .exes around 250 MB and it takes ages.

Here is my hardware
Cpu: i5-12500H
Ram: 16 gb of ddr4 at 3200 MT/s
Ssd: NVMe Micron_2400_MTFDKBA512QFM
Gpu: RTX 3050 4 gb

I am on a not so powerful laptop, unfortunately it's all I have.

My "Rowenta Pur Air Intense Connect XL"air purifier is not connected to the Seb Pur Air or Rowenta Pur Air app anymore.
The manufacturer confirmed (in reply to Google Play app reviews) that the cloud services have been shut down.
So this device is not connected anymore and is only working manually.

My

I would love to be able to do some reverse engineering to be able to control it using Home Assistant or Google Home.

I tried to do some reverse engineering but without results.
What I found:

The device acts as a Wi-Fi access point with IP 192.168.10.1 as long as it is not linked to the user's wifi (which is not possible to link as the app is not working anymore).

The manufacturer of the network device seems to be Hangzhou Gubei Electronics (alias BroadLink).

NMAP shows the following opened ports:
PORT STATE SERVICE
581/tcp filtered bdp
25640/tcp filtered unknown
35228/tcp filtered unknown
45713/tcp filtered unknown
53243/tcp filtered unknown
56108/tcp filtered unknown
67/udp open|filtered dhcps
80/udp open|filtered http
MAC Address: 78:0F:77:B3:C0:27 (HangZhou Gubei Electronics Technology)
Nmap done: 1 IP address (1 host up) scanned in 76.57 seconds

I tried forcing the device to connect to my wifi using python and broadlink with this code but this does not seem to work:

import socket

import struct

# ===== UPDATE WIFI infoS =====

SSID = "MyWIFi SSID"

PASSWORD = "MyWiFiPassword"

# ================================

SSID_bytes = SSID.encode('utf-8')

PASSWORD_bytes = PASSWORD.encode('utf-8')

packet = bytearray(0x88)

packet[0x26] = 0x14 # mode AP setup

# SSID

for i, c in enumerate(SSID_bytes):

packet[0x44 + i] = c

packet[0x84] = len(SSID_bytes)

# Password

for i, c in enumerate(PASSWORD_bytes):

packet[0x64 + i] = c

packet[0x85] = len(PASSWORD_bytes)

# Security type (WPA2 = 4)

packet[0x86] = 4

# Checksum

cs = sum(packet) & 0xffff

packet[0x20] = cs & 0xff

packet[0x21] = cs >> 8

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

s.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)

s.bind(('192.168.10.2', 0))

print(f'sending WiFi credentials: SSID={SSID}')

s.sendto(bytes(packet), ('192.168.10.1', 80))

s.sendto(bytes(packet), ('255.255.255.255', 80))

print('Packet sent !')

print('Wait 30 sec until the Air Purifier joins your network...')

... but it does not work.

Any help would be much appreciated.

I have a desktop application targeting .NET Framework 4.8 (x86), and Im trying to maximize its protection against reverse engineering while keeping performance impact as low as possible.

Current approach
• I use VMProtect
• I usually protect only critical parts
• In some cases I use mutation mode instead of full virtualization to reduce performance overhead

Most .NET obfuscators I’ve tested seem ineffective. some of them can be reversed or deobfuscated very easily. in some cases almost one click (like .NET Obfuscator)

I want to achieve:
• spaghetti code
• Reliable anti-tamp / anti-patch / etc protection
• Compatibility with VMProtect

Questions
1. What are currently considered robust obfuscation techniques/tools for .NET Framework apps?
2. Is it better to combine multiple obfuscators or focus on a single strong solution?
3. Are there recommended pipelines or best practices for combining IL obfuscation + native protection (VMProtect)?

Notes
• Im aware that no protection is unbreakable, but I want to significantly raise the effort required for reverse engineering

Any insights or real-world experience would be appreciated.

I'm a (*nix) sysad who knows his way around the terminal but finds gdb like a strange planet. I can generate/capture kernel traces/dumps but would send it to vendors for analysis. I can tune the kernel's memory tunables if the documentation says so but does not understand most of them.

Let's say one day I woke up and wanted to be a reverse engineer. I have all the time in the world and can afford to pick and choose schools and courses.

Which courses should I take?

During the 1990s, Nintendo internally used a variety of files with a variety of types for the sake of small and quick animations. A lot of their files were leaked during 2020, and in the list were a lot of these animation files. Since this isn't a standard way to store animations nowadays, interlopers had to be clever. They were, and presented this information to all of us through making programs that compile the file types CGX, COL, SCR, and OBJ into either large images (SCR) or the aforementioned stupid animations (OBJ).

I was messing with the OBJ animations when I wanted to see if I could make my own. I started by playing around with a copy of hino\z-mario-4\chr-stock\chr-stock2-minidoragon.OBJ using HxD, and got pretty far. The problem is that this is kind of slow, and has the potential to miss a *lot* of potentially important trivia. So, I want to know if there's documentation (or something) that has more information on this stuff. Anything helps. I barely even know what to call this stuff other than just "1990 internal Nintendo animations", and that has way too many syllables.

PS: At the end of all the OBJs is "NAK1989 S-CG-CADVer1.10 <random numbers>", which leads me to think that S-CG-CAD is what originally made the OBJs. Considering that the program I'm using to view them is "Hyper CG-CAD," I'm going to do some digging.

Hello everyone, I wanted to ask for some advice about checking a file safely. I found a third-party modification for a Minecraft server (VimeWorld) that is distributed as a RAR archive with a size of about 284 MB. The unusually large file size for a Minecraft-related utility is a major red flag for me. I haven't downloaded the archive yet, as I want to understand how to safely inspect or analyze it before execution. My system is Windows 11 Pro. If I decide to download it, I plan to first inspect the archive contents and only run the executable inside an isolated environment like Windows Sandbox. I would like to ask people with experience in malware analysis: Is Windows Sandbox generally safe enough to prevent host infection (specifically credential or Discord token theft) from unknown programs? What specific indicators (network calls, process spawning, or suspicious registry changes) should I monitor after launching the file? What steps would you recommend for analyzing potentially unsafe software of this size before running it? If anyone is interested in looking at the archive itself for analysis, I can send the link via private message. Thanks for any advice!

Hi,

I'm faced with a problem I'm not (yet) equipped to solve.

Ubuntu 24.04.4 LTS does not yet support the touchscreen on my Lenovo Yoga 7 2-in-1 16AGP11 hybrid/convertible laptop.

To be clear: The screen works, touch works in the BIOS, the relevant sensors work, Ubuntu can see the screen and the sensors.

The driver that should make it work doesn't yet support it. I've completed the steps they outlined to help the project along, but judging by the list of untouched issues on github, I fear it may take them months or years.

But I want it to work asap. So maybe I can figure it out for them?

Why I came to you: Is the information I need buried in the Lenovo Windows Wacom driver?
If so, how can dig it out?

For what it's worth: I've managed to install Cutter, had it run the Lenovo Windows Wacom drivers install executable, and it told me it's written in C. So I guess the next step would be to find a decompiler for C?

One more question, but I need to cushion it a bit.
What I'm about to say is not out of a lack of respect for those who have poured years of their life into understanding How Things Work, meaning: YOU. It is only a product of my frustration and complete lack of knowing How Things Work (despite trying in the past). I have little faith in LLMs, even less faith in the companies behind them. That said:

Could something like Mistral Code or Claude Code dig whatever I need out of the installer? Could it even help me to create a suitable driver for Ubuntu after it analyzes the Windows driver and the current Ubuntu driver? (Please don't laugh at me too loudly... I' m severely out of my depth here.)

Thanks!

Hi everyone,

I’m working on a project focused on security analysis of PLC (Power Line Communication) devices that use the HomePlug AV protocol, and I’m looking for some advice from people who have experience with firmware reversing or embedded protocol fuzzing.

The main goal of the project is to analyze how different vendors implement HomePlug AV management message (MME) handling in their firmware and try to identify parsing bugs or inconsistent behavior across devices.

So far I’ve been focusing on firmware-only analysis before moving to testing.

I want to find some original firmware's to work so can you please suggests some and tell me the process that how can i find the bugs while two plcs connected

Got hold of a physical unit from a startup called CanaryTags that markets itself as running a "proprietary global network" called LarkNet™. The tag back shows:

• Model: P1
• FCC ID: BCG57290E071F
• CE mark

BCG is Apple Inc.'s registered FCC grantee code (used on every iPhone, AirTag, Apple Watch). But BCG57290E071F returns nothing in fccid.io, fcc.report, or the FCC's own database.

Their About page says the product "utilizes the signaling of all mobile device types — including iOS and Android" — which is a description of Apple Find My + Google Find Hub, not a proprietary network.

Three questions:

1. Is BCG57290E071F a real FCC filing that's just hard to find, or is this a fabricated ID using Apple's grantee code?
2. If it's a white-label Apple-licensed module inside, does that actually constitute MFi authorisation for commercial Find My exploitation?
3. Has anyone sniffed BLE advertising packets from one of these to confirm what protocol it's broadcasting?

Ive done a bunch of research about game files to help me and found that apparently the .so files are the ones that do the asset loading from the .obb! So I was wondering if you could somehow extract lost media game assets from a .obb file by reverse engineering the .so file in the .apk responsible for letting the game read the assets on the .obb to turn it into something that can dump all the assets? Is that possible?

Just to let yall know, I have ZERO coding knowledge, I was just wondering if anyone knew how, or if it was possible. Below is a link containing both the APK and the OBB! I hope someone here knows if they can help me! Yall are my last hope right now. Thanks in advance!

APK and OBB: https://drive.google.com/file/d/1zOLuokZ1Y5iS7E7yqXcuPZjkdx2FAtqh/view?usp=sharing

I'm not new to chasing down the semantic meaning of a specific field in a struct. I'm just tired of how long the process can take depending upon the size of the structure.

Currently all I can think to do is hope to find a constructor or some function that populates a buffer in an intelligible manner. Set breakpoints to see what functions access the struct, determine semantic significance based on how it's used to affect control flow. Look for XREFs if it happens to be a global.

But some fields might not even have semantic coherence without the additional context of another object it's state dependent upon or effects the state of. Then I have to determine what the other struct is and its significance.

It can be a very time consuming process as I'm sure others have felt. Just trying to figure out if there's a way to reframe and tackle the problem. Or perhaps a better methodology for the process that makes it a bit faster and less painful.

Thanks.

Hello everyone!

I just started learning Frida, and I'm really enjoying it. My goal from the start was to replace a Unity game with my own and fix its multiplayer, but unfortunately, I don't have the necessary knowledge and can't find it, so I simply can't do anything with this game.

If anyone here knows how to do this, could you share a link to the necessary documentation or tutorial? I'd be very grateful!

I'm asking for some basic resources to learn to how to reverse engineer old binary data files so that I can create a reader for the files and display stats, export to other formats, etc.

What I've done: these are PAF files. Personal Ancestral Files, genealogy, family history. There are one or two proprietary programs that will read them, but I want to do it myself. I know the discontinued application, PAF, that wrote the data files was in C. I have some basic info about what "might" be the data structures from older documentation from version 2 (I'm working with version 5) that spells out the binary data structure. Big structural differences, but some similarities might carry over. And I'm guessing that the data is somewhat similar to the export format they use, GEDCOM. I have access to the application that creates the files, so I can create test files and look for small changes. I've been using HexFiend on a Mac to look at the binary to "see what I can see", but not experienced with data reverse engineering techniques.

What I'm looking for: good quality basic level information about applications and techniques that are helpful and used for the work of reverse engineering binary data. I'm a software engineer with a math/comp science background, but other than writing an assembly sim in college, I've not worked in this area at all. So any pointers on tools and techniques would be greatly appreciated. thanks!

Not sure if this is the right sub Reddit, if not please let me know but could I still have some help. The only reason I thought this is the right sub Reddit if it isn't is that the file formats are proprietary in Telltale Games.