All Questions
12 questions
0
votes
1
answer
189
views
How to convert variable to struct member in IDA?
I'm working on a windows program which is walking PEB Ldr list. the related types are as follows:
struct LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10
...
- 3
2
votes
1
answer
158
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
0
votes
0
answers
278
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 518
0
votes
1
answer
2k
views
idb file and IDA
I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
- 115
0
votes
2
answers
724
views
Pe file code starting address
When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
- 115
2
votes
0
answers
273
views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
And there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
- 518
1
vote
0
answers
78
views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
- 169
-1
votes
2
answers
452
views
How to add a message box to a PE [closed]
So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
1
vote
0
answers
103
views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
- 1,267
1
vote
1
answer
884
views
Suppress IDA welcome dialog in batch mode
I try to disassemble a bunch of PE files with the free version of IDA.
However, I can't figure out how to suppress the beginning welcome message:
My batch command looks like this:
"C:\Program Files (...
- 1,257
0
votes
1
answer
445
views
Create unprotected executable for program that decrypts itself at run-time dynamically? [closed]
Say i have Windows executable that looks like normal one, but actually has encrypted segments or blocks of code, and the way it calculates key to decrypt itself at run-time way hard for me.
I'd like ...
- 163
7
votes
2
answers
5k
views
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.
Now fixing the sections headers is fairly easy - i just ...
- 668