Questions tagged [operating-systems]

Software managing the hardware part of the computer and providing an API for user-space software to access various services provided by hardware devices.

Filter by
Sorted by
Tagged with
5 votes
1 answer
331 views

How to reverse engineer a setjmp/longjmp sequence?

I'm trying to reverse engineer the GNU libc x86 (32 bit) setjmp / longjmp (re a vuln which may allow arbitrary overwrite of the jmp_buf env. There's a great writeup of the musl setjmp but I can find ...
SRobertJames's user avatar
0 votes
2 answers
886 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
unc4nny's user avatar
  • 69
1 vote
1 answer
577 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
Arthur's user avatar
  • 13
0 votes
1 answer
128 views

Where are the intel manual x86-16?

I was studying the code for x86-16 operating systems(como DOS),with a desassembler, but I can't find the intel manual on the intel website: Searching on google, only unofficial sources. Perhaps the ...
Loliconaoquadrado's user avatar
0 votes
1 answer
128 views

Can relative offsets in instructions like call and jmp change after recompiling the same code, or running it in another computer?

So let's say we want to use some instructions as signature for a malware, and it includes some call instructions or jmp instructions. Now, as far as I have seen, they always contain relative offsets ...
OneAndOnly's user avatar
1 vote
1 answer
2k views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
the_endian's user avatar
  • 1,830
0 votes
2 answers
647 views

Is relocation table only used for absolute addresses?

I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me: is the relocation table used before ...
Mery Ted's user avatar
  • 232
1 vote
1 answer
914 views

Windows 10 will not run hex edited application

I'm in a reverse engineering class. Our current assignment is to edit a notepad.exe application. Just to start out, I opened my notepad.exe in FlexHex, went to the end of the.rsrc section, changed a ...
lll's user avatar
  • 135
4 votes
1 answer
2k views

How to dump firmware from car head-unit (VW Radio)

I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole ...
Andrei Bucur's user avatar
2 votes
1 answer
666 views

Is there any ready-to-go malware analysis/reverse engineering OS? (That is capable of installing on hard disk, preferably)

I just wanted to know if there's any ready-to-go OS for malware analysis/reverse engineering? I prefer OS that is capable of installing on real hardware, not a VM.
Jozef Nagy's user avatar
2 votes
0 answers
759 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
78dtat78da's user avatar
10 votes
3 answers
8k views

Struggling between syscall or sysenter ( Windows )

As I understand, from windows XP, there is a sysenter instruction introduced, instead of int 2e interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
PastaAlaCarbonara's user avatar
1 vote
3 answers
304 views

System programming and reverse engineering

Do I need to learn system programming (e.g. WinAPI and Linux API) to be really good in reverse engineering? Or should I treat it as a reference so that whenever I encounter a system call, I go learn ...
user3737182917381's user avatar
1 vote
1 answer
146 views

Get bindiff of operating system or modified files post upgrade [duplicate]

I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
LUser's user avatar
  • 783
1 vote
3 answers
169 views

Taking up reverse engineering as a research topic, need advice [closed]

I'm currently a computer sciences undergrad who'd like to do some basic research work in reverse engineering as my premier project (for completion of my bachelor's degree). So far, I've studied ...
user2841250's user avatar
0 votes
1 answer
462 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
Richard's user avatar
  • 101
1 vote
1 answer
586 views

Patch driver loading process [closed]

Introduction Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog ...
kub0x's user avatar
  • 121
3 votes
1 answer
3k views

Why/how is GDB allowed to attach to a process and read/write to attached process' address space?

The fact that GDB can attach to any process without having su rights is terrifying to me. For example, what prevents me from writing a malware/virus(/whatever the correct term is) that uses same ...
sinan's user avatar
  • 233
2 votes
1 answer
108 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
brandbir's user avatar
  • 123
1 vote
1 answer
544 views

pintool to intercept writes and VirtualProtect

On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...
user avatar
11 votes
1 answer
19k views

Setting a breakpoint at system call

I want to modify my teamspeak server (linux), I'm particulary interested in the connection with clients (UDP), so I figured I need to set a breakpoint at the linux socket function to start reversing. ...
Hugo Kiiski's user avatar
3 votes
2 answers
3k views

Dump TEB/PEB in immunitydbg

I am trying to learn actually how to get to the PEB inside of TEB. I have tried this with windbg but could not manage to dump the PEB with stuff like: !peb or dt nt!_PEB_LDR_DATA And others. But, ...
Dirk's user avatar
  • 443
0 votes
1 answer
762 views

How does WinLoad.exe load the rest of the operating system?

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for: call 0x00408b6d <--- test al,al je 0x0040109f lea ...
ba-sle's user avatar
  • 27
5 votes
1 answer
5k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
m4524t's user avatar
  • 53
-2 votes
2 answers
181 views

Is it not just simple to view private source code of an OS by disassembling it? [closed]

I know OSes like Mac OS X and Windows hide their source code from their users, although I've just wondered that would it not be possible to still find a way to alter a Window or Mac OS&...
83457's user avatar
  • 97
4 votes
2 answers
5k views

What is an effective way to debug a 32 bits application within a 64 bits OS?

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. ...
NaNcat's user avatar
  • 49
11 votes
1 answer
662 views

Tracing message passing instead of a call stack

In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities. Is there a structure that OS ...
Daniel W. Steinbrook's user avatar
9 votes
3 answers
303 views

How to manage/revert to specific OS versions for effective patch diffing?

For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now ...
ixje's user avatar
  • 1,733