Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tools]

Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag.

2
votes
1answer
65 views

What's a decompiler that can be extended to new architecture, and how can I do it?

I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
1
vote
1answer
22 views

Find schema and info of MS SQL Server to which I have access to

I have access to an MS SQL Server DB and I'm able to run queries on the databases. But the since the database is too big, with multiple tables and each table having many columns (whose names aren't ...
1
vote
0answers
63 views

Binary Analysis Tool (BAT) no longer maintained - alternatives?

I read on the BAT github page that BAT is no longer actively maintained. Why did the project come to an end? What alternatives are there to unpack all kinds of archives / firmwares / binary ...
3
votes
2answers
139 views

Hybrid binary analysis tool

I have an idea to merge static and dynamic analysis into a visualization through the IDA python scripting interface. The concept involves automatically setting breakpoints at each function or basic ...
3
votes
2answers
46 views

Finding a particular call to an offset within a vtable using pattern matching

Let's say I have a very simple pattern I'm looking for. E.g. the following regex, mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\] Now, I'm also looking for references to this in which the ...
6
votes
1answer
319 views

What is the info displayed by radare2's afl?

I can't figure out what afl actually outputs. The docs are surprisingly uninformative. So, I've got address on the first column and symbol on the last. What is on the 2nd, 3rd and 4th columns? ...
-3
votes
1answer
159 views

Please edit this .exe file. I beg you. At least tell me what can be done(No general answers) Specific please [closed]

There is this game called Mafia 2 and since its release modders hve been trying to access encrypted files in the game. It was not until the years 2013 and 2014 that a Russian modder that goes by the ...
10
votes
1answer
218 views

What is the meaning of single letters in IDA's functions window?

IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture. The characters are: ...
0
votes
1answer
142 views

Binwalk extracted images corrupt?

I ran: $> binwalk --dd='jpeg:jpg' file.bin The JPGs (there are hundreds of them) are extracted but all of the JPGs experience varying levels of "corruption". Here's an example of what most of the ...
1
vote
1answer
144 views

Which RE tool is missing?

I am analyzing a malware at the moment which scans for a lot of filenames and ClassNames to recognize if it is under supervision or not. My problem is, that all the filenames and ClassNames are ...
0
votes
0answers
26 views

Identify headerless audio encoding

I have this musical clock that has a removable memory card which contains the music, on the card is a unbranded SPI flash chip. Using a BitScope I was able the figure out some of the flash commands ...
1
vote
0answers
769 views

Tool for JavaScript deobfuscation

I'd like to reverse engineer a JavaScript program by manually renaming minimified variable, parameter and function names. However, updating my reverse-engineered code to a newer version would be very ...
0
votes
1answer
212 views

Tomb Raider I Add Subtitle [closed]

I want to translate Tomb Raider 1 into my language. I am able to change texts in the menu but I also want to add subtitles to cutscenes. Is it possible to add subtitles to cutscene.phd files? ...
4
votes
2answers
501 views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
1
vote
1answer
246 views

How do reverse engineers commonly detect the format of binary data?

Say I have the byte array c1 83 2a 9e f9 ff ff ff (just an example) and I have no idea what the format is. It could be characters in ASCII, UTF-8, could be WORD/DWORD integers in Little or Big Endian, ...
2
votes
1answer
138 views

How to detect overlay data in RTF files?

How to detect overlay data in RTF files? When officemalscanner says it detected overlay data, what does that mean ? Is overlay data specific to malicious files ?
0
votes
0answers
266 views

binwalk show zlib format without any size

I'm going to do reverse engineering, So I have extracted a .bin file from a flash and use Binwalk to analyze it. but binwalk just show me some zlip compression format without any size as shown in ...
1
vote
1answer
67 views

Change sending IP of only certain executable

An executable that access the Internet uses my IP to do so. Is it be possible, with the help of a software or something like that, to change what IP an executable uses to access the Internet? Without ...
2
votes
2answers
116 views

Any tool for finding IP that a process use/access?

I need to extract the IP that a certain application is using to receive and/or send data, is there any tool or software that would do this for me ? or any simple way without needing to dig into the ...
0
votes
0answers
95 views

Closed-Source Binary Code Coverage Library in Python

I would like to know if there exists tool(s)/librar[y/ies] built using Python that would show me edge coverage by modules as I run a certain closed-source binary (ELF, PE) using these tool(s)/librar[y/...
1
vote
2answers
243 views

How to programatically extract function names, function arguments and strings from a .NET binary?

My goal is to extract function names, the libraries they come from (if the functions were imported), function arguments, and strings from a .NET binary. How can I do this? Is this possible using ...
2
votes
2answers
387 views

Bindiff matching algorithm

I've started using bindiff recently and struggle to understand matching algorithm. I've read several articles like: T. Dullien and R. Rolles. Graph-based comparison of executable objects, BinSlayer, ...
2
votes
1answer
930 views

How to unpack kkrunchy executables?

I'm trying to figure out how to unpack kkruncy executable, sources here and binaries here, anyone knows how to do it? My main idea was testing out some little hello world exes compressed with ...
0
votes
1answer
196 views

How to capture Data from OllyDbg window?

I'm trying to capture data from OllyDbg's info window (PWM_INFO), to do that I've captured that particular window using winspy++, how could i use the info provided by winspy++ with the WinAPI? I mean, ...
0
votes
1answer
176 views

How to copy API calls names to clipboard on OllyDBG v2.01?

I'm trying to figure out how to copy API function names to clipboard to analize the asm listing properly on my own editor. I can see OllyDBG gives you the ability to mouse over a call and seeing the ...
1
vote
1answer
85 views

Extract an image out of a application and customize after edited

I was wondering if you guys could help me.I have an application for OSX it is called Traktor..I want to extract an image of a vinyl and edit it than reassign it back to the application... I want to ...
4
votes
1answer
307 views

Tools for RE OpenCL Kernel

I have an OpenCL 2.0 program with various .bin files that I would like to reverse. file shows: $> file k.bin k.bin: ELF 64-bit LSB executable, *unknown arch 0x40c* version 1 (SYSV), corrupted ...
3
votes
3answers
844 views

Trying to decompress a hello world program using OllyDbg v201

I'm trying to learn how to unpack a simple executable which has been compressed with crinkler, let be the nasm listing here compressed with crinkler. example1.asm: global start ; kernel32.lib ...
0
votes
1answer
282 views

How to copy memory strings on OllyDBG v2.01?

I'm trying to figure out how to copy "properly" strings from memory, I see there are very few plugins available for ollydbg2.x.x and the one I've tried, called BinaryCopyEx didn't work ok, for ...
4
votes
2answers
259 views

Is there a tool for proxying a dll that doesn't require IDA Pro?

I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything'...
0
votes
1answer
96 views

Advice on creating a reverse engineering introduction course? [closed]

I'm organizing an introduction to reverse engineering weekend class in my city and wanted to get some feedback and advice on how to structure it. I'm considering two 5 hour sessions. The objective is ...
3
votes
1answer
957 views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
2
votes
0answers
551 views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
0
votes
1answer
61 views

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]

So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits. By, default, it doesn't allow keybind ...
1
vote
0answers
92 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
-1
votes
1answer
183 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: screenshot ...
0
votes
0answers
59 views

BinNavi running very slowly

I was trying to load a 16mb dll module(whose idb file is around 100mb), and can initialize and load in BinNavi. However, if I want to open native callgraph, it will take forever. Anyone had the same ...
1
vote
0answers
424 views

Reverse Engineering a whole project desktop application

Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create ...
13
votes
1answer
1k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
10
votes
4answers
2k views

best alternatives to IDA, Immunity and Ollydbg for a blind user

I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA, Immunity and Ollydbg are all not accessible to a blind person using a screenreader. Are ...
0
votes
1answer
3k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
2
votes
0answers
143 views

I need a tool to assist decompiling C++

I am trying to reverse engineer some C++ code that was made by "architecture astronaut", having multiple layers, lots of virtual functions, lots of polymorphism, metaprogramming, inlined stuff, and so ...
3
votes
1answer
497 views

Using multilevel pointers obtained via cheat engine in own application

So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The ...
2
votes
1answer
6k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
3
votes
1answer
6k views

When to use OllyDgb over Immunity Debugger

I have always been curious when I should use OllyDbg over Immunity Debugger. Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python. Interestingly enough, ...
1
vote
1answer
766 views

Tools to find base64 strings in binary dumps

When looking at raw binary dumps are there any tools to help identify and decode base64 strings contained within? Essentially "strings", but taking into account base64.
1
vote
2answers
2k views

Tools to get started with reading memory during runtime

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic ...
0
votes
1answer
86 views

How to log every memory read/write action and the registers of the action? [closed]

During runtime. With minimal performance impact on the target. Platform is Windows 7. Objective is to gather a lot of data for clustering and ML. To ultimately assist with protocol reversing. All ...
2
votes
1answer
676 views

How to reverse engineer a database file format?

It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
0
votes
1answer
126 views

“Incompatible saved desktop has been ignored” in IDA

When I launch IDA for the first time, I move my windows to reflect my perfect window setup. Then I save the desktop and set it as default, plus I additionally save a named backup. After this, I close ...