Community Digest

Top new questions this week:

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...

ida windows dll  
asked by jony 3 votes
answered by blabb 2 votes

Finding AddressOfEntryPoint for a 64-bit process

Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...

c++ winapi  
asked by upayansaha 3 votes
answered by morsisko 6 votes

Modifying (adding new logic) decompiled apk to log different kind of data causing problems (crash/bluetooth connection)

I have separately decompiled apk to smali/dalvik and to java classes. As apk is not obfuscated java code is pretty good to read and I can pretty easily see corresponding smali code. So far I was able ...

android apk dalvik  
asked by matt 3 votes
answered by morsisko 2 votes

X86 access to global strings pattern

While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it. .text:00002560 ...

ida disassembly x86  
asked by macro_controller 2 votes
answered by Igor Skochinsky 1 vote

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...

firmware linux firmware-analysis  
asked by Wobelaar 1 vote
answered by Igor Skochinsky 0 votes

IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?

I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself. Unedited function: Corrected ...

ida disassembly stack-variables  
asked by James 1 vote

Find the caption of VB5/6 Form Object in Memory Dump

I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make ...

windbg vb6  
asked by chentiangemalc 1 vote

Greatest hits from previous weeks:

How do I work out the Ultranet protocol?

Ultranet is a audio protocol that allows low latency audio with many channels to be transmitted over standard Ethernet cables. For instance you might have a Midas sound desk transmitting audio packets ...

packet  
asked by fret 14 votes
answered by tuck1s 12 votes

Binwalk alternative

When examining bin firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data. Are there any ...

firmware  
asked by pzirkind 8 votes
answered by julian 14 votes

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. ...

malware javascript deobfuscation sandbox  
asked by Adam Caudill 68 votes
answered by svent 36 votes

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...

linux exploit binary  
asked by perror 8 votes
answered by perror 17 votes

Is reverse engineering and using parts of a closed source application legal?

Is it legal to reverse engineer certain features of a closed source application and then integrate those features into a closed or open source application that may be either a commercial or ...

law  
asked by asheeshr 37 votes
answered by JMcAfreak 25 votes

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.

disassembly windows binary-analysis static-analysis executable  
asked by Pranit Kothari 47 votes
answered by Igor Skochinsky 39 votes

How difficult is to decompile C++ file?

I am writing an Android app with AES encryption and I am going to save AES key as a string to a C++ file with extension .cpp. I am also going to create an iOS app which will use the same AES key. Is ...

c++ android ios  
asked by Daniel Foo 9 votes
answered by Amirag 20 votes

Can you answer these questions?

Display open handle ids in IDA Pro

Is there a way to display all the open handles of a process in IDA Pro while debugging it? I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server. I want to ...

ida debugging  
asked by Neon Flash 1 vote

Reverse engineering old mmo

I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...

ida c++  
asked by Zorb29 1 vote

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...

ida debugging idapython remote  
asked by saiwa 1 vote
You're receiving this message because you subscribed to the Reverse Engineering community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038

<3