Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [operating-systems]

Software managing the hardware part of the computer and providing an API for user-space software to access various services provided by hardware devices.

3
votes
1answer
79 views

How to dump firmware from car head-unit (VW Radio)

I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole ...
2
votes
1answer
86 views

Is there any ready-to-go malware analysis/reverse engineering OS? (That is capable of installing on hard disk, preferably)

I just wanted to know if there's any ready-to-go OS for malware analysis/reverse engineering? I prefer OS that is capable of installing on real hardware, not a VM.
2
votes
0answers
133 views

Obscure router refuses to flash OpenWrt

This is a very obscure Chinese router from a brand called Wavlink. It's the Model: WN529R2/WN529R2P. It's web interface was pretty limited and wouldn't allow firmware modifications. I found GND/Tx/Rx/...
5
votes
2answers
1k views

Struggling between syscall or sysenter ( Windows )

As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
0
votes
0answers
95 views

Identification of an Unknown File System in an ITRON OS

I am attempting to reverse an unknown file system found in an ITRON based operating system (circa 2003), but have not been able to figure this out. Any clues to identifying or reversing this file ...
1
vote
3answers
211 views

System programming and reverse engineering

Do I need to learn system programming (e.g. WinAPI and Linux API) to be really good in reverse engineering? Or should I treat it as a reference so that whenever I encounter a system call, I go learn ...
1
vote
1answer
80 views

Get bindiff of operating system or modified files post upgrade [duplicate]

I am wanting to examine changes made to Windows after an update is made. I would like to see the actually files that were patched and see what in the code might have been changed and see what the ...
1
vote
3answers
136 views

Taking up reverse engineering as a research topic, need advice [closed]

I'm currently a computer sciences undergrad who'd like to do some basic research work in reverse engineering as my premier project (for completion of my bachelor's degree). So far, I've studied ...
0
votes
1answer
236 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
1
vote
1answer
430 views

Patch driver loading process [closed]

Introduction Since Windows Vista and higher versions a non-boot kernel-mode driver is installed by validating the certificate issued to sign the catalog file and each file associated with the catalog ...
2
votes
1answer
2k views

Why/how is GDB allowed to attach to a process and read/write to attached process' address space?

The fact that GDB can attach to any process without having su rights is terrifying to me. For example, what prevents me from writing a malware/virus(/whatever the correct term is) that uses same ...
2
votes
1answer
79 views

Extra bytes between clusters in FAT12

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need ...
1
vote
1answer
350 views

pintool to intercept writes and VirtualProtect

On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...
4
votes
1answer
6k views

Setting a breakpoint at system call

I want to modify my teamspeak server (linux), I'm particulary interested in the connection with clients (UDP), so I figured I need to set a breakpoint at the linux socket function to start reversing. ...
3
votes
2answers
2k views

Dump TEB/PEB in immunitydbg

I am trying to learn actually how to get to the PEB inside of TEB. I have tried this with windbg but could not manage to dump the PEB with stuff like: !peb or dt nt!_PEB_LDR_DATA And others. But, ...
0
votes
1answer
517 views

How does WinLoad.exe load the rest of the operating system?

I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for: call 0x00408b6d <--- test al,al je 0x0040109f lea ...
5
votes
1answer
3k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
-2
votes
2answers
169 views

Is it not just simple to view private source code of an OS by disassembling it? [closed]

I know OSes like Mac OS X and Windows hide their source code from their users, although I've just wondered that would it not be possible to still find a way to alter a Window or Mac OS&...
3
votes
2answers
2k views

What is an effective way to debug a 32 bits application within a 64 bits OS?

Currently I am on an x64-based system and have been doing some reverse engineering for a while. However I'm still a newbie, and the biggest issue I keep running into is the memory layout differences. ...
10
votes
1answer
476 views

Tracing message passing instead of a call stack

In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities. Is there a structure that OS ...
9
votes
3answers
230 views

How to manage/revert to specific OS versions for effective patch diffing?

For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now ...