Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tools]

Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag.

1
vote
0answers
44 views

Reverse engineering a bar code's check digit

I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...
1
vote
0answers
34 views

Difference between Proxmark3 rdv4 & Proxmark3 evo

I am an advanced beginner in RFID/NFC reversing / hacking. For now, I have a mifare reader and I want to buy a better reader to able to perform advanced stuffs on both HF and LF (especially emulation ...
0
votes
0answers
51 views

What software should I use to view process memory (changes) in real time?

I'm looking for a way to view memory of a process as it changes, instead of just snapshots of the memory. I'm aware that this would demand more resources than your average hex editor. So I'm probably ...
2
votes
1answer
81 views

What's a decompiler that can be extended to new architecture, and how can I do it?

I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
1
vote
1answer
23 views

Find schema and info of MS SQL Server to which I have access to

I have access to an MS SQL Server DB and I'm able to run queries on the databases. But the since the database is too big, with multiple tables and each table having many columns (whose names aren't ...
1
vote
0answers
67 views

Binary Analysis Tool (BAT) no longer maintained - alternatives? [closed]

I read on the BAT github page that BAT is no longer actively maintained. Why did the project come to an end? What alternatives are there to unpack all kinds of archives / firmwares / binary ...
3
votes
2answers
153 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
48 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
6
votes
1answer
408 views

What is the info displayed by radare2's afl?

I can't figure out what afl actually outputs. The docs are surprisingly uninformative. So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns? ...
-3
votes
1answer
162 views

Please edit this .exe file. I beg you. At least tell me what can be done(No general answers) Specific please [closed]

There is this game called Mafia 2 and since its release modders hve been trying to access encrypted files in the game. It was not until the years 2013 and 2014 that a Russian modder that goes by the ...
10
votes
1answer
223 views

What is the meaning of single letters in IDA's functions window?

IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture. The characters are: ...
0
votes
1answer
205 views

Binwalk extracted images corrupt?

I ran: $> binwalk --dd='jpeg:jpg' file.bin The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
1
vote
1answer
146 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
0
votes
0answers
26 views

Identify headerless audio encoding

I have this musical clock that has a removable memory card which contains the music, on the card is a unbranded SPI flash chip. Using a BitScope I was able the figure out some of the flash commands ...
1
vote
0answers
941 views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
0
votes
1answer
223 views

Tomb Raider I Add Subtitle [closed]

I want to translate Tomb Raider 1 into my language. I am able to change texts in the menu but I also want to add subtitles to cutscenes. Is it possible to add subtitles to cutscene.phd files? ...
4
votes
2answers
575 views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
1
vote
1answer
316 views

How do reverse engineers commonly detect the format of binary data?

Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
2
votes
1answer
140 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
0answers
309 views

binwalk show zlib format without any size

I'm going to do reverse engineering, So I have extracted a .bin file from a flash and use Binwalk to analyze it. but binwalk just show me some zlip compression format without any size as shown in ...
1
vote
1answer
71 views

Change sending IP of only certain executable

An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without ...
2
votes
2answers
126 views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
0
votes
0answers
105 views

Closed-Source Binary Code Coverage Library in Python

I would like to know if there exists tool(s)/librar[y/ies] built using Python that would show me edge coverage by modules as I run a certain closed-source binary (ELF, PE) using these tool(s)/librar[y/...
1
vote
2answers
258 views

How to programatically extract function names, function arguments and strings from a .NET binary?

My goal is to extract function names, the libraries they come from (if the functions were imported), function arguments, and strings from a .NET binary. How can I do this? Is this possible using ...
2
votes
2answers
445 views

Bindiff matching algorithm

I've started using bindiff recently and struggle to understand matching algorithm. I've read several articles like: T. Dullien and R. Rolles. Graph-based comparison of executable objects, BinSlayer, ...
2
votes
1answer
978 views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
0
votes
1answer
208 views

How to capture Data from OllyDbg window?

I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, ...
0
votes
1answer
181 views

How to copy API calls names to clipboard on OllyDBG v2.01?

I'm trying to figure out how to copy API function names to clipboard to analize the asm listing properly on my own editor. I can see OllyDBG gives you the ability to mouse over a call and seeing the ...
1
vote
1answer
85 views

Extract an image out of a application and customize after edited

I was wondering if you guys could help me.I have an application for OSX it is called Traktor..I want to extract an image of a vinyl and edit it than reassign it back to the application... I want to ...
4
votes
1answer
323 views

Tools for RE OpenCL Kernel

I have an OpenCL 2.0 program with various .bin files that I would like to reverse. file shows: $> file k.bin k.bin: ELF 64-bit LSB executable, *unknown arch 0x40c* version 1 (SYSV), corrupted ...
3
votes
3answers
887 views

Trying to decompress a hello world program using OllyDbg v201

I'm trying to learn how to unpack a simple executable which has been compressed with crinkler, let be the nasm listing here compressed with crinkler. example1.asm: global start ; kernel32.lib ...
0
votes
1answer
299 views

How to copy memory strings on OllyDBG v2.01?

I'm trying to figure out how to copy "properly" strings from memory, I see there are very few plugins available for ollydbg2.x.x and the one I've tried, called BinaryCopyEx didn't work ok, for ...
4
votes
2answers
278 views

Is there a tool for proxying a dll that doesn't require IDA Pro?

I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything'...
0
votes
1answer
96 views

Advice on creating a reverse engineering introduction course? [closed]

I'm organizing an introduction to reverse engineering weekend class in my city and wanted to get some feedback and advice on how to structure it. I'm considering two 5 hour sessions. The objective is ...
3
votes
1answer
1k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
2
votes
0answers
595 views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
0
votes
1answer
63 views

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]

So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits. By, default, it doesn't allow keybind ...
1
vote
0answers
92 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
-1
votes
1answer
187 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: screenshot ...
0
votes
0answers
60 views

BinNavi running very slowly

I was trying to load a 16mb dll module(whose idb file is around 100mb), and can initialize and load in BinNavi. However, if I want to open native callgraph, it will take forever. Anyone had the same ...
1
vote
0answers
441 views

Reverse Engineering a whole project desktop application

Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create ...
13
votes
1answer
1k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
12
votes
4answers
2k views

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader. ...
0
votes
1answer
3k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
2
votes
0answers
143 views

I need a tool to assist decompiling C++

I am trying to reverse engineer some C++ code that was made by "architecture astronaut", having multiple layers, lots of virtual functions, lots of polymorphism, metaprogramming, inlined stuff, and so ...
3
votes
1answer
510 views

Using multilevel pointers obtained via cheat engine in own application

So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The ...
2
votes
1answer
6k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
3
votes
1answer
6k views

When to use OllyDgb over Immunity Debugger

I have always been curious when I should use OllyDbg over Immunity Debugger. Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python. Interestingly enough, ...
1
vote
1answer
800 views

Tools to find base64 strings in binary dumps

When looking at raw binary dumps are there any tools to help identify and decode base64 strings contained within? Essentially "strings", but taking into account base64.
1
vote
2answers
2k views

Tools to get started with reading memory during runtime

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic ...