All Questions
42 questions
2
votes
0
answers
220
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
1
vote
0
answers
289
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to solve this?
I have seen sandbox reports in those the ...
- 31
1
vote
1
answer
287
views
Does opening a crash dump run a file in memory?
I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
- 11
0
votes
0
answers
278
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 518
0
votes
1
answer
303
views
Is there any way to STOP the loop of the IDApython?
Is there any way to STOP the loop of the IDApython ?
I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
2
votes
1
answer
510
views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
- 323
2
votes
1
answer
225
views
Using windows 10 for malware analysis
I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
- 323
0
votes
2
answers
659
views
cdecl calling convention
Hello best people, my question is this example is telling me about cdecl calling convention. I have confusion that when analyzing the code in disassembly how would I recognize that this is the cdecl ...
- 323
6
votes
4
answers
3k
views
Is Null in Windows equal to zero?
(This question refers to assembly language.) I'm a little bit confused. I've encountered many times Windows functions that are supposed to return a Handle, and if they don't they return NULL. Why ...
1
vote
1
answer
594
views
what is Off in IDA Pro?
probably silly question, what does Off ... means in IDA Pro?
i markered the snapshot as an example.
2
votes
1
answer
125
views
Structure of operand bytes in .NET call and data access IL instructions?
I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions
for example based on experience, the last byte of API/...
- 518
0
votes
2
answers
223
views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
- 27
0
votes
2
answers
1k
views
Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?
So lets say i have these type of instructions in functions :
x == constant value
x = constant value
x > constant value
no matter if its just an assignment or compare or anything, i want to get the ...
- 176
0
votes
1
answer
166
views
Malware attempting to move a value into $zero in MIPS?
Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times.
addiu $zero, 0xA
as well as move $at, $at
...
1
vote
2
answers
2k
views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
- 61
1
vote
3
answers
809
views
What is the difference between malware that is 'dumped' and one that is 'unpacked'?
On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
- 233
0
votes
1
answer
183
views
What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?
Sorry if this is a stupid question but couldnt find the answer by googling
Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
- 232
2
votes
1
answer
300
views
Unable to properly analyze a very simple C-compiled program
I'm a RE beginner and I decided to start writing my own simple code for practice.
I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
- 21
2
votes
1
answer
904
views
Start vs WinMain()
I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
- 141
0
votes
0
answers
678
views
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
I'm in a case where some portions of my code contain this type of anti-...
- 709
0
votes
0
answers
114
views
idapython - Scan all possible code paths between start and end addresses
I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
- 203
0
votes
1
answer
980
views
ida pro issue debugging issues with ntdll [closed]
I am using IDA pro to follow along a youtube video of RE from OALabs. https://www.youtube.com/watch?v=kdNQhfgoQoU&t=1575s
I am facing a problem when i try to put a break point on functions in ...
- 3
1
vote
1
answer
4k
views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
- 11
1
vote
1
answer
325
views
De-obfuscation - Emulation-oriented vs Script-oriented
What are the advantages of each method when employing de-obsfucation of potentially malicious code?
I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
- 437
0
votes
2
answers
85
views
Composition of a Binary File trouble [closed]
I am working with some malware samples and I need to determine if one of them is primarily composed of 32-bit Intel Code. This would seem easy as I can just check the metadata describing it as a 32-...
3
votes
1
answer
2k
views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
- 395
0
votes
1
answer
460
views
Getting Xrefs to Windows Library Functions in IDA Pro
Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
- 395
0
votes
1
answer
2k
views
Can't debug a service
I am working on Lab11-03 in "Practical Malware Analysis" book.
The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP.
After that the malware ...
- 583
1
vote
1
answer
154
views
IDA pro can not resolved section after unpacking procedure
I had a sample which was packed by a packer and I unpacked it using OllyDbg but after unpacking still IDA can not resolve the section and show most of instructions as DD.
Is this sample still packed ...
- 11
2
votes
2
answers
2k
views
Unable To break TLS callback function using ollydbg
while trying to debug a binary which have TLS callback functionality,i am not getting any result.i have put "System entry breakpoint" as in ollydbg Event option.Binary breaks as system breakpoint ...
- 119
2
votes
1
answer
2k
views
How to search sequence of API call using IDA Pro?
I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
- 141
0
votes
2
answers
1k
views
Is it dangerous to disassemble malware in IDA?
If I were to disassemble a malware sample in IDA without being in a VM, is there any way I can infect my machine?
- 111
2
votes
2
answers
3k
views
How can I extend a memory of an analysed executable in IDA Pro?
I'm analysing some malware executable with ImmDBG and IDA Pro.
The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides ...
- 426
1
vote
0
answers
105
views
How do I become a Malware Analyst? [duplicate]
Sorry if this is posted in the wrong section.
A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in ...
- 11
1
vote
3
answers
1k
views
Best and smarter way to improve unpacking skills
I want to find a way to improve my unpacking skills, i am not a noob but i miss steps from simple to hard packers.
I saw lot of video tutorials, the most of the time i see "click F9 x times to reach ...
- 319
4
votes
1
answer
2k
views
What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?
I know that
Dynamic program analysis is the analysis of computer software that
is performed by executing programs on a real or virtual processor.
while
Static program analysis is the ...
7
votes
2
answers
2k
views
Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE
As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
- 113
5
votes
3
answers
3k
views
How to break on not-yet-loaded kernel driver
I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
- 413
18
votes
3
answers
15k
views
Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?
I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
- 191
4
votes
0
answers
362
views
How to add xrefs to indirect call targets in IDA? [duplicate]
I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information ...
- 685
5
votes
2
answers
4k
views
How to load a dumped process and several accompanied memory pages in IDA?
I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?
- 3,072
4
votes
1
answer
250
views
How did/would you analyze OSX-Crisis
I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered ...
user1743