Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

A chain of characters, usually used to store text messages lying statically in the program or to receive dynamically messages from the user.

1
vote
2answers
48 views

How can I view in-memory strings of a process on Linux (Ubuntu)?

On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?
2
votes
1answer
74 views

Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?

I found the executable in question using VirusTotal "hunting" feature, where one can run Yara rules for the files existing in VT database and match the strings. I downloaded the file, opened it with ...
2
votes
1answer
42 views

How do you print fixed width strings with radare's print format `pf`?

Let's say I have a byte sequence where U is an unsigned int (4 bytes), and ccccccccccccccc is a 15 byte character array UcccccccccccccccU Is it possible to print this structure using pf? I can print ...
2
votes
1answer
112 views

IDA 7 does not recognize/reference Delphi 16bits Strings correctly

I am dabbling with a XE3 Delphi application in IDA 7.0, and can't get Strings representation to work correctly: While selecting Delphi (16 bits) in the Strings Window yield correct results: ...
1
vote
1answer
55 views

Build Graph Printable String Information in ELF

I'm new in the field of reverse engineering to detect malicious code in ELF file. I used IDA Pro to retrieve a list of strings in an elf file. But I wonder if IDA can build a graph showing the link ...
2
votes
1answer
116 views

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

I'm attempting to use a legacy systems recovery feature that typically required calling/faxing a company that is no longer around. Basically, the system was designed to go into a recovery mode and ...
-1
votes
1answer
79 views

how to find the strings values in a comparision using ollydbg

In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings The program compare if a user input string is equal a internal string. When I debug the program, I can't find the ...
2
votes
1answer
155 views

Hex-Rays function signature does not match demangled name

From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
3
votes
1answer
90 views

What other methods can be used to find file paths in an executable?

I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
0
votes
1answer
119 views

I'm would like to view this malicious payload, but am having trouble decoding it

This is a gzip compressed base64 string. I tried decoding it with an online converter but it said the data was corrupt. Can anyone decode this? H4sIAAAAAAAAAL1X6W6jyBb+...
0
votes
0answers
63 views

Decoding this value & What encryption is it?

I've got this value, which I think it may contain date, that I want to decode ( decrypt ) and to know what encryption type is it. 3zsWFYXd1Eg= At first, I thought it's a base64 encoded string, But ...
1
vote
1answer
210 views

Dolphin Emulator Android port modifications

I am modifying the Dolphin Emulator Alpha for android, but I'm having some trouble with a string in it's smali code. The value I am having trouble with is dolphin-emu, it is the name of the folder ...
2
votes
2answers
138 views

How can I identify how this string is being encoded so I can replicate it?

A friends company uses an old VB6 application to generate encoded strings to then use in their also old and out of date database system. They have the application running in standalone mode so I can ...
1
vote
1answer
115 views

Is it possible to make a string bigger on an executable without breaking it?

I am a new reverse enigneerer. I know I can patch strings using a hex editor, but I obviously can't add or remove a single byte. Is there any workaround that will let me make a... let's say, 10 byte ...
4
votes
2answers
145 views

Problem with converting hex values to decimal

I'm reverse-engineering custom binary file format. I'm using 010 Editor to check this file. I found data structure to represent UTF-8 strings, which has header section of one or two bytes in length ...
4
votes
0answers
284 views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
5
votes
2answers
242 views

Cannot locate a variable on the stack

I am unable to locate a variable on the stack. I'm using Fedora 25 x64 but with a 32 bit program, btw. C program: #include <stdlib.h> #include <unistd.h> #include <stdio.h> #...
1
vote
2answers
4k views

OllyDbg: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX references a specific Unicode string, e.g. "Enter". In Ollydbg there is usually right beside the EAX value a string that says "ASCII: Enter ". I read ...
0
votes
2answers
139 views

Identifying a very weak hash algorithm

I'm reverse-engineering a string translation file format for a particular game. It's ultimately just an ID-to-string map, where the IDs are four-byte integers. There are 1935 IDs in total; you can see ...
0
votes
1answer
84 views

Using HEX editor and making 4 chars from 3 chars [closed]

I need to replace a single string in a bin. The actual string has 3 chars and the new one must have 4.If I use a hex editor this will make the exe useless.So is there any way to add bytes there to ...
4
votes
1answer
333 views

How to find address of more complicated, unknown data structures

I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory ...
1
vote
4answers
724 views

XMPP clubs in league of legends

Hopefully I'm asking this at the right place. League of legends recently added the option to join a club. Clubs still use the XMPP protocol just like before for their public chat rooms: XMPP for ...
1
vote
0answers
58 views

Modyfying PE file data section [duplicate]

I am a bit new to RE, so forgive me any weird or stupid questions. The app that I am currently working on has strings I need to modify in .data section. That's why Ollydbg doesn't allow me to copy ...
1
vote
1answer
663 views

Need help with searching for reference for a string in IDA Pro [closed]

I have a little problem, i have loaded some firmware to IDA and it didn't analyze it correctly so i did located and tagged all the strings manyaly but it didn't helped me to find the references to ...
3
votes
1answer
206 views

Is this a known encoding or cipher? (multiplayer game network traffic)

I'm trying to decode chat strings in a multiplayer game's network traffic; the way it encodes them is seemingly some arbitrary encoding. I've been analyzing the UDP traffic to the server with ...
3
votes
2answers
158 views

What compression algorithm could have generated these strings?

To what kind of compression algorithm could the following sentences belong to? AxFWR:YRCtIPns<_o%p_=Q>LELBM AxFWRPA:cXe#<InM=L:Mthwekblc AxFWREFEp`f?PU`;K;M:;P?MDMCL AxFWRW%VK>Hk]...
0
votes
0answers
95 views

Hex-editing string in OpenVPN ELF binary breaks its commandline parsing

I'm trying to make OpenVPN (MIPS binary from Entware package repository) to use custom ifconfig instead of hardcoded /sbin/ifconfig. To do this, I've created symlink to custom ifconfig and modified ...
3
votes
2answers
2k views

Can't find “referenced string” in OllyDBG

So I am trying to reverse a program but I am not able to find any of the Strings through searching for "referenced Strings" or "binary Strings", I am new to OllyDBG and I don't know a lot about it, ...
1
vote
2answers
646 views

Find a string in an object file

I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/...
0
votes
1answer
69 views

Is there a website that hosts the strings application?

Is there website where you can submit an executable and it will run it through strings and give you the output?
1
vote
0answers
41 views

How to store a string securely inside your app? [duplicate]

Let's say you have an Android or iOS app, how can you store a web API key (a string) in your app securely, making it impossible or harder to reverse engineer. Some solutions I have thought about : ...
2
votes
3answers
913 views

Declaring block as a string in IDA

I'm reverse engineering a binary that has very generic, standard xor+math encryption on every string. I've written IDAPython to find each one(they're used in a generic way) and decrypt them, then add ...
12
votes
2answers
2k views

How can I find the source of a string in an old DOS game?

I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players. In the past it hasn't been too hard to pull off such a task on post-DOS games ...
2
votes
1answer
295 views

Search through compressed/binary plist files in an IPA

I'm working on an iOS target. I'm effectively interested in running the program and its metadata through strings. I've noticed a simple grep does not return expected results and I suspect its because ...
2
votes
2answers
6k views

Looking for the specific text in EXE file

I want to find specific string in the EXE file but when I open the EXE file with OllyDBG and search for the All Referenced Strings I get bunch of texts in the comment area which are like this : ...
0
votes
1answer
265 views

Strange repeating string “FeTFeTFeTFeTFeTFe…” in binaries

Sometime, when doing reverse in some binaries I get this kind of ASCII strings: 00000000: 4665 5446 6554 4665 5446 6554 4665 5446 FeTFeTFeTFeTFeTF 00000010: 6554 4665 5446 6554 4665 5446 6554 4665 ...
4
votes
1answer
4k views

How can a format string vulnerability be used to write a specific string into memory?

I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer. Can format string vulnerability also be used to ...
1
vote
2answers
685 views

Replace strings in object file

I have an object file under Linux with a lot of strings in it. I would like to replace all strings that represent a specific path in this object. I can see all the strings I need to change using the ...
4
votes
2answers
796 views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
7
votes
1answer
2k views

String extraction from an iNES ROM dump

I want to extract the strings in Shadowgate for NES. I ran file on the image and then strings, no luck. I found some information about the NES cartridge file format. The docs mention the use of “Name ...
4
votes
2answers
12k views

How can I make IDA see a string reference?

IDA has disassembled the following code: seg019:C0292548 loc_C0292548 ; CODE XREF: sub_C0292414+11Cj seg019:C0292548 02 00 54 E3 CMP R4, #2 ...
5
votes
1answer
2k views

Printing Unicode strings in Gdb in OSX

Are there any useful snippets or Gdb functions that you guys normally use to print out Unicode strings? I'm trying to debug Mach-O binaries and x/s seems to be printing out junk. I believe the default ...
28
votes
1answer
5k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...