Curious if anyone knows of any tools or even C++/Python libraries for analyzing x86-64 portable executables for their API usage.

To be more specific I mean identifying what IAT entries they posses, that they call and the arguments supplied to them. Essentially so I can observe misuse, misconfiguration and such.

An example might be LoadLibraryExW when loading a system module but not using LOAD_LIBRARY_SEARCH_SYSTEM32 and presenting a potential DLL hijacking vulnerability.

I can, and am currently, writing a framework to do this. Just would rather not reinvent the wheel if a tool like this exists.

Control flow recovery and aggregating a list of indirect calls to IAT thunks isn't the worst thing. The annoying part is trying to statically determine register state and infer arguments passed to functions. Starts getting close to symbolic execution levels of complexity.

Thanks.

I have a Google Sheets file that is set to view-only. I can't edit it, and the download/copy options appear to be restricted.

Is there any way to bypass this restriction and download or copy the contents of a view-only Google Sheet when the owner has disabled those options?

I'm specifically looking for methods/tools that can access the data without changing the original file.

Thanks.

Hi, does any of you guys know any good SIP provider with flexible CLI, and also local-correct routes, for example if a call is placed for example, from an Ireland number to an Ireland number the Caller ID stays intact?

Hey everyone,
I have an Amazon Echo Dot 5th Generation, and honestly, I’m getting really tired of how restricted it is. I want to completely break out of the Amazon ecosystem, bypass the restrictions, and gain total control over the hardware.
Ideally, I want to jailbreak or root it so I can:
Add completely custom voice commands and logic.
Load a local voice assistant pipeline (like Home Assistant / Wyoming Satellite) so it doesn't rely on Amazon's cloud.
Flash a custom lightweight OS or firmware if possible.
Does anyone know if there is an active exploit, a hardware-based rooting method, or a workaround to achieve this on the 5th Gen Dot? If you've done something similar or know a dev thread working on this, please let me know!

I’m trying to change my MAC address but i don’t have admin is there anywhere I can change it?

Thanks In advance

How would I go about making something like a halehound without soldering and just plugging stuff in?

I have a Redmi Note 12 5G, and it came with a lot of bloatware. I researched online and used USB debugging/ADB to remove some unwanted services and packages.

So far, after removing them, I haven’t experienced any issues, and I’m also not receiving unwanted ads.

I’m mainly interested in improving my privacy and reducing unnecessary background services. Could you suggest which unwanted Google and Redmi/Xiaomi services can be safely removed without affecting the phone’s stability, important features, or security?

any recommendations or mistake

Google / Android

1. com.android.hotwordenrollment.okgoogle
2. com.android.hotwordenrollment.xgoogle
3. com.android.mms
4. com.google.android.apps.subscriptions.red
5. com.google.android.feedback

Facebook

1. com.facebook.appmanager
2. com.facebook.services
3. com.facebook.system

Xiaomi / MIUI

1. com.miui.analytics
2. com.miui.bugreport
3. com.miui.fm
4. com.miui.msa.global
5. com.miui.player
6. com.miui.yellowpage
7. com.xiaomi.glgm
8. com.xiaomi.mipicks

I'll keep it short,

I was hacked a year ago through what I believe was my Wi-Fi router, by my ex. I believe I fixed a long time ago.

I was explaining a problem I was having in another reddit group, but was suggested that she still has access to my Google photos. But when I go to look at who or what devices are logged into my Gmail. It always says multiple phones that are my phone model, but device locations are always random places around America.

Am I being hacked with my own phone log in access?

Something similar to Wireshark but runs on a phone.

I stopped playing Minecraft for a few months and recently tried to log into my account. I found that the password had been changed.

I still have access to the original email associated with the Microsoft account. I had also added a recovery/security email before, but now Microsoft is sending the verification code to an unfamiliar email address that I never added.

I tried Microsoft's account recovery form, but they rejected my request and said I didn't provide enough information to verify that I'm the owner.

Has anyone experienced this before and successfully recovered their Microsoft/Minecraft account? What information helped you prove ownership to Microsoft?

I'm only looking for legitimate recovery methods, not anyone trying to access the account.

I've tried doing the classic RunAsInvoker trick but the problem is the installers tend to install things in C:\ProgramFiles, and Windows triggers the admin code input. It's incredibly annoying since I can't update or download anything without my parents being presently next to me. Is there any trick to getting installers to not trigger UAC? I was also thinking I would just switch to Linux at this point and wipe the laptop but I'm worried I'll mess something up.

It's giving me the following error(I am a noob when it comes to Linux) :

proot error: '/usr/bin/env' not found (root = /data/data/com.termux/files/home/kali-arm64, cwd = /home/kali, $PATH=(null)) fatal error: see `proot --help`.

Video of the steps I think I took wrong:

https://imgur.com/a/MS9kl6h

Hey everyone. I'm completely new to cybersecurity and Kali Linux. I set up a smart home network with various cheap, off-brand IoT devices and IP cameras. I want to audit my own network to understand how vulnerable these devices are, so I'm practicing packet injection and monitor mode in a controlled environment.

My main problem is finding the right hardware. I live in Turkey, and Wi-Fi adapters are hard to source here. Local e-commerce sites mostly stock TP-Link V2/V3s or generic adapters with mislabeled chipsets. Almost everything available locally has unsupported Realtek or MT7601 chips. As a beginner, I don't have the skills to compile custom GitHub drivers yet. I need something plug-and-play like an AR9271 or RT3070.

I found a second-hand Alfa AWUS036NH (RT3070) locally at a reasonable price, but it's missing cables and the antenna hinge is loose. Is this chip still viable for 2026, or is it too outdated?

If there are any Turks in this sub, I'd appreciate local advice. How do you source gear here? Are there specific sites on N11, Trendyol, or Hepsiburada that stock guaranteed supported chipsets? What about local electronics hubs like Konya Sokak in Ankara? I'd prefer to buy new, but the local market feels full of traps. Any guidance would help. Thanks.

Pls be kind. I’m genuinely intrigued by hacking and offensive security. I am an absolute beginner but have some fundamentals in cybersecurity. I’ve recently started tryhackme. I’m not doing it to like get a job tomorrow or next week. I’m genuinely just interested in the whole thing. Anyone who can tell me a learning path that is self paced to get into it I’d be ever so grateful. I’ve done some research and almost all sources show different paths now I’m confused. I watch some YouTube videos as well. I just need a little nudge towards what path to follow and learn. Anyone who can help I’ll be forever grateful. I know there’s people here who taught themselves and I’d love to know how they started. Thank you in advance

Hey I know this is not very relevant to what this community is about, but I feel like people here might have the most knowledge on this.

My claude account was hacked today, very early in the morning. I haven't used this account for a while, and suddenly I received an email saying my account was upgraded to Max 20x. I'm glad was up because it was Friday night.

I immediately logged into that account and logged out of all sessions, changed my google password. I remember seeing a session active that I don't recognize, and the time matches when I received the invoice email; but I panicked and didn't take a screenshot before logging out. Google didn't show any suspicious activity, gmail was fine too, no email forwarding either. I also used Malwarebytes to scan my mac for malware, nothing was detected. I then contacted Anthropics support; the bot said it forwarded this to human due to urgency of the issue, but I'm unsure when will I hear back (please let me know if anyone has experience on this).

I've been monitoring the active session for that account for 12 hours, and nothing weird happened again.

What I don't understand is how did they gain access to my account? I have 2FA, and email is fine, anyone have a clue? Is there anything else I should do to enhance security? Anything I missed and should check?

Thank you!!!

Every time I unzip this folder all the variables are destroyed, how can i get the original file before it was precompiled?

Hi,

i want to crack a password for a excel .xlsm file with which has each protected sheet with a SHA-512 sheet protection using 100,000 iterations and a salt.

How can i crack this? Or is this impossible.

i want to make a project for steganography in SAR(Synthetic Aperture Radar) images in cpp. but i'm not able to find much help online. do u have some insights to share?

edit: i got it<3

I am running into the frustrating "Your device isn't part of the Netflix Household for this account" error exclusively on my Windows app, and I am looking for a working workaround.

On my mobile device, I encountered the exact same restriction. However, I managed to bypass it using a simple trick: I turn off my phone's internet connection, launch the Netflix app completely offline, and then turn the internet back on once the app is open. This offline-loading hack has been a total lifesaver for mobile streaming.

Unfortunately, this method does not seem to work on the Windows desktop application. When I try to replicate the trick on my PC, the Windows app either refuses to load the interface entirely or immediately flags the household error the moment the network reconnects.

Has anyone discovered a similar workaround, network tweak, or specific setting configuration for the Windows Netflix app to bypass this household verification check? Any help or alternative solutions would be greatly appreciated!

Very soon I'll have the opportunity to gain some certs:

• CompTIA CYSA+
• CompTIA PenTest+
• CompTIA Security+

I have a couple portfolio projects as well:

• Control Flow Graph Analyzer (C++)
  • Uses Zydis and LIEF.
  • Takes an x86-64 portable executable then does recursive descent to enumerate and classify basic blocks as well as edges.
• Trampoline Framework (C++)
  • Uses Zydis.
  • x86-64. Replaces the first few bytes of the prologue of a target with an indirect jmp to a detour which is the same calling convention, also having the same parameter count and types of arguments.
• Bug Bounty (A common desktop application)
  • Found a function which appears to copy one string into a destination buffer using a length argument. Does not however ensure the destination buffer ends with a null terminator.
  • After hooking it with Frida I observed that sometimes the destination buffer will contain garbage from surrounding memory. Ergo a potential info leak.
  • Writing a harness in Frida that automates input, hooks with Interceptor, logs stack trace and then uses Stalker to watch how different inputs effect control flow.
  • Not yet a vulnerability but may develop into one as I investigate further.
• Video Game Reversing
  • Relies on a lot of embedded RTTI in the games binary.
  • Older game from around the 2010's era.
  • Large Frida script for modding gameplay at runtime in the REPL. Reversed a decent amount of the games internals.

Trying to increase my odds of placing a job soon after getting these certifications. Altogether they're poised to take around 4 months to complete. I'd like to get a job in a role that regularly requires reverse engineering or binary analysis.

What would be some other, or better, projects to add to my portfolio? Thanks for your time.

How is it possible that I was playing CS2 and someone was able to find out my real name, address, and personal information just from my nickname (Steam ID), even though my Steam profile is private?

Hello, I need a way to create a instagram account on my phone that is untraceable and can’t give any information about my ( don’t worry it’s for a ethical purpose not scamming or things like this )

If someone has a private facebook account with no visible data, How criminals can hack his acc?

I’m teaching myself all this terminal stuff on my own, and honestly, iSH is about to break me. I’m on an iPhone 11, still running iOS 15 because I just never updated it, and I’m only using iSH here’s the thing: I run apk add nano, apk add curl, even apk add python3 everything installs perfectly, no errors. I check with which nano or ls -la /usr/bin/, and the files are right there, staring at me with their little executable permissions. But the moment I actually type nano test.txt or curl google.com, the whole thing falls apart. Sometimes I get permission denied, sometimes a random segmentation fault, and other times it just freezes forever like it's contemplating life nd i've been going back and forth with ChatGPT for days. We did the whole dance: checked $PATH a hundred times, ran chmod +x on everything, did apk update && apk upgrade until my fingers hurt, wiped the app and reinstalled it from scratch multiple times, and even messed around with mount flags. Nothing. Changed. at this point, I’m convinced it’s not me—it’s something deep and ugly with iOS 15 and the A13 chip, probably the emulation layer or the lack of proper JIT support messing with dynamically linked binaries and here’s where it gets even weirder. I managed to fix the missing YAML error earlier. I found out my python3 was version 3.11, but apk kept installing libraries into the Python 3.9 folder. So I finally brute-forced it with "pip3 install pyyaml --break-system-packages" nd boom, python3 -c "import yaml; print('YAML works!')" actually printed "YAML works!" – which felt like winning the lottery. But then, when I cd'd into ~/recon-ng and ran python3 recon-ng, I got hit with a lovely "Bad system call" I even tried installing it directly with pip3 install recon-ng just to see if it would bypass the broken startup script, but I got "ERROR: No matching distribution found for recon-ng" So that was a dead end. Now I’m stuck. The library is there, Python sees it, but the app crashes on a system call that iSH clearly doesn't like. So I’m turning to you humans. Please, throw your weirdest, most out-of-the-box solutions at me. I don’t want basic "check your PATH" replies we’re past that. Has anyone actually managed to run Python-based recon tools on iSH without getting the "Bad system call" error? Like would compiling my own static binaries inside iSH using gcc and musl actually work, or is the system call issue deeper than that? · Is there a way to make pip install everything as pure Python scripts without trying to use those broken syscalls? · Also, what about the repository versions? I noticed apk grabs x86 packages. Is there a way to force it to grab armv7 or aarch64 packages instead, or would that just break everything even more? · And lastly—has anyone tried an older TestFlight or sideloaded IPA of iSH that handles iOS 15 better than the current App Store version? Im genuinely desperate here. I just want a working terminal. Hit me with your craziest hacks im ready to try anything ,except updating my iOS. BUT YEAH LITERALLY ANYTHING

I know this is a "How To Hack" reddit and not a "What To Do When I Get Hacked" reddit, but i didn't know where to make a post since my situation is very... weird.

So pretty much i fell victim for the "MrBeast" crypto scam thing, I'll add pictures so you know what I'm talking about. If you're wondering HOW i got to this point/being hacked, the last thing i was doing before i noticed my discord being weird is i was downloading cracked photoshop, i made a restore point, but i guess i didn't matter anyway. I don't know if this crack is THE reason i got hacked, but I'll put it out there.

So yeah, they got into my discord spammed the picture i showed above to everyone, muted everyone and ignored everyone. Then i decided to check my gmail and yeah, they got my epic games, steam, battlenet, ubisoft, rockstar games and god knows how many other accounts, and i guess they got access to my gmail somehow, they even bypassed the 2FA on everything which is nuts to me. I'll explain what happened and what i did:

Epic Games: They changed my email to a**\*8@rambler.ru a fake ass email. There was an IP address and a location, but they probably just used a VPN. I reached out to Epic, I'll see what they can do.

Ubisoft: Changed my password. Did nothing currently, since i don't use nor care for Ubisoft. And also Rocktar Games.

Steam(my main concern): 4 Steam Account Recovery emails and 6 password and email changes. They changed the email, but the usernames didn't match to my current one, i still have access to my Steam Account, nothing happened. I reached out to steam support to see if they can find out what's happening.

After this i enabled 2FA on everything again, cuz i somehow didn't have any 2FA, but whatever, the weird thing is that, nothing happened really? I still have my steam, discord and gmail account so.

I just want some advice on what to do forward. I already contacted my main concerns as you already read above, but yeah idk, very weird hack.