Community Digest

Top new questions this week:

WinDBG Hung on Shellcode Execution

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...

ida debugging windbg shellcode metasploit  
asked by rustam Shirinov 4 votes
answered by blabb 1 vote

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...

disassembly debugging  
asked by Sofiane Djerbi 3 votes
answered by Sofiane Djerbi -1 votes

Ghidra + IDA cant detect a string but Radare2 can

Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...

ida radare2 ghidra  
asked by RedZ 3 votes
answered by R4444 5 votes

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...

ida pe hexrays  
asked by unc4nny 2 votes
answered by Rolf Rolles 4 votes

QEMU with GDB: Stepping Instruction causes Windows VM BSOD

I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing. I have ...

debugging qemu  
asked by Coburn64 2 votes

reverse a RF rolling code

I have the following codes from a rolling code RF garage fob I want to duplicate. There is a duplicator remote that able to get one code and learn the sequrence from it:

crc remote unknown-data  
asked by user35420 2 votes
answered by pythonpython 2 votes

Adding my own assembly code to x64 .exe

I have assembly code like this: 142cccc0c c7 43 18 MOV dword ptr [RBX + 0x18],0x4000 00 40 00 00 142cccc13 e8 a8 79 CALL FUN_141a845c0 ...

asked by StackOverflow 1 vote

Greatest hits from previous weeks:

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...

binary-analysis firmware arm hex binary  
asked by Light123 14 votes
answered by julian 30 votes

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?

decompilation dll .net pe  
asked by APerson 39 votes
answered by Mick 49 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...

debugging gdb elf mips qemu  
asked by creuchmeuch 25 votes
answered by Zach Riggle 50 votes

How can DLL injection be detected?

In this question on DLL injection multiple answers mention that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. It seems desirable to be able to detect DLL ...

dll dll-injection  
asked by user2142 17 votes
answered by peter ferrie 15 votes

Binwalk alternative

When examining bin firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data. Are there any ...

asked by pzirkind 9 votes
answered by julian 15 votes

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...

disassembly binary-analysis obfuscation android deobfuscation  
asked by Pervy Sage 67 votes
answered by Guntram Blohm 84 votes

What is the meaning of movabs in gas/x86 AT&T syntax?

I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture. The original amd64 assembly code is: mov 0x89abcdef, %al And, after gas ...

x86 amd64  
asked by perror 30 votes
answered by 0xC0000022L 26 votes

Can you answer these questions?

Detecting and reading embedded filesystems on desktop Linux

I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device. This is the device information: The NAND chip is 128MiB ...

file-format embedded memory-dump flash router  
asked by Mark 1 vote
answered by Robert Larsen 0 votes

Disassembler with pixel/bitmap view

I am looking for an ARM disassembler that runs on Linux that has a graphic "pixel" or "bitmap" view like the one shown in the pictures below: I am reverse engineering some old ...

asked by PJMOR 1 vote
You're receiving this message because you subscribed to the Reverse Engineering community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038