I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do.

It turns out that I have an idea of how I could find out in which addresses I need to search: the software behaves differently if I add some lines in its config files.

So, I'd like to output a text file which contains all the addresses the RIP was set to.

Then I'll be able to diff the files and have an idea of when the execution flow diverged...

However, in order to do that I need to use Windows and not Linux because this software doesn't work well with Wine.

How could I do, to create such a script, on Windows?

  • 1
    That log would be huge. I suspect your only options would be to run it in an emulator, and modify that to output registers as it went, or find a debugger that you can modify (gdb?) to keep single stepping execution and logging as it goes. – Rup May 5 '19 at 18:37
  • Use a coverage engine like dynamorio's drrun to calculate basic blocks covered for each file. Then use something like lighthouse to visualise instructions covered in both files. – sudhackar May 5 '19 at 20:58
  • I might have found the solution here. But I still need to try it...! – Drarig29 May 5 '19 at 21:34
  • 1
    That sounds like a classic use case for PIN, the dynamic instrumentation tool from Intel. The solution you linked might do the same but I'd assume it to be orders of magnitude slower because it's effectively single stepping. This is a typical use case for PIN though, creating a run trace and then diffing. I don't have a tutorial handy though. – Johann Aydinbas May 5 '19 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.