Questions tagged [tools]

Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag.

Filter by
Sorted by
Tagged with
56
votes
8answers
31k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
3
votes
1answer
143 views

Review a collection of executable binaries to determine similarity

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different ...
0
votes
2answers
693 views

Need help with ZTE router config.bin file decryption and encryption

bin file extracted from a ZXHN H168N V3.1. RouterPassView is able to decrypt the file successfully but the tool can't re-encrypt the file, it gave me some info about the method used to decrypt here ...
3
votes
1answer
441 views

Difference between Proxmark3 rdv4 & Proxmark3 evo

I am an advanced beginner in RFID/NFC reversing / hacking. For now, I have a mifare reader and I want to buy a better reader to able to perform advanced stuffs on both HF and LF (especially emulation ...
0
votes
0answers
14 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
11
votes
3answers
5k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
0
votes
0answers
54 views

Decoding a ZTE H188A config. file

I got this router from my ISP it's fairly good but most of the config options are grayed out. I wanted to decrypt the config file and change those options form there. after some research I found this ...
16
votes
2answers
2k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
0
votes
1answer
528 views

Stop synchronizing hex view with disassembly view in IDA

Recently IDA started to synchronize the hex dump with disassembly view. Even if I disable this through right click, it gets reseted every debug session. I also tried to save the desktop with the ...
0
votes
1answer
8k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
1
vote
0answers
42 views

Reversing Logitech G933 Battery Charge Values

I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
1
vote
1answer
2k views

Decompiling Python Files: ValueError

So I have this python file and I successfully unpacked its content inside of it we have our file.pyc I appended the magic bytes to it so it went from: E3 00 00 00 00 00 00 00 00 00 00 00 00 to ...
33
votes
5answers
26k views

Open source GUI tool for decomposing a PDF

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
0
votes
0answers
1k views

Need Help with decryption backup config.bin file "ZTE ZXHN H267N v1.1"

hi i'm trying to decrypt config.bin file from new router I got from my company, I tried a tool found on github "https://github.com/mkst/zte-config-utility" I got this ERROR: python3 examples/...
24
votes
7answers
76k views

Decompiling .pyc files

Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files? Everything I've found seems to break...
1
vote
1answer
63 views

IDA Pro - How to remove multi-line bit definitions for register

I've just started reversing some microcontroller code and have the RAM, ROM, and SFR (Special Function Registers) segments set up. I've selected my processor architecture and it has named most of the ...
18
votes
8answers
6k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
319
votes
16answers
382k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
1
vote
0answers
198 views

Miasm VS Triton - which to choose? [closed]

Hello and thank you for reading my question, I was wondering, which is the right tool for me to choose according to the following: I will be using it mainly for Malware analysis and for exploit ...
0
votes
1answer
120 views

modern instrumentation for reversing and researching [closed]

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue: i have been doing malware analysis and researching for a few years, and i want to learn ...
2
votes
3answers
398 views

Reverse engineering a partially known binary format

I have files with binary data, the format description of them is very vague and incomplete. E.g., it states that records start with header byte, like (hex) FA, followed by datetime (accurate down to ...
0
votes
2answers
241 views

How to find what code created some data?

I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?
55
votes
7answers
121k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
0
votes
0answers
627 views

IDA Flair all functions skipped when creating .pat file

I'm trying to create .pat file with IDA Flair tools, but it skips all the functions. Here is what I did: pelf.exe tier0.lib tier0.pat tier0.lib: skipped 395, total 395 I also tried other tools like ...
30
votes
5answers
52k views

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
27
votes
3answers
3k views

Why are special tools required to ascertain the differences between two related binary code files?

How comes that text diffing tools like diff, kdiff3 or even more complex ones usually fail at highlighting the differences between two disassemblies in textual form - in particular two related binary ...
25
votes
6answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
1
vote
2answers
78 views

Gui disabled program functionality

Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality. Right now there's one button remaining labeled "Encrypt", which is greyed ...
-1
votes
1answer
601 views

De-obfuscate JS code [closed]

I came across a script that converts font files from one type to another (i.e. WOFF to TTF, etc). I would like to understand it and incorporate some of the code into a personal project. The script ...
0
votes
0answers
103 views

Tools for statistical analysis of binary streams

I'm in the process of decoding the semantics of an unknown binary stream1. I've come to a point where I understand the overall structure: A tag byte, followed by a size field, and a blob of bytes of ...
1
vote
0answers
124 views

Alternative for Wireshark for USB packet sniffing

I'm looking for alternative for Wireshark, with this requirements: Cross-platform (Windows and Linux) USB packet sniffing Easy creation of dissectors Wireshark is great, but Lua API for writing ...
1
vote
2answers
247 views

Can I decompile a file if I have a compiler? [closed]

Is it possible to reverse the compiled code using a compiler? I have a compiler in the form of exe and using it I can compile the file. But there is no possible instruction I got to decompile a file. ...
2
votes
1answer
206 views

APK static analysis tools - frameworks used, vulnerability checks, etc? [closed]

I'm familiar with tools for unpacking/decompiling APKs - JADX, apktool, dex2jar, JD-GUI, and the like. I'm curious if there are tools which automate other useful tasks when reversing an APK, such as: ...
9
votes
5answers
19k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
3
votes
0answers
518 views

Is there an existing tool to reverse engineer Xamarin AOTDATA files?

I am currently examining a xamarin application. It has used the "ahead of time compilation" feature, which has left some of the associated .net assemblies (.dlls) as lists of function signatures ...
0
votes
2answers
758 views

How to monitor APK files in Android System

Is there a monitoring tool for Android except logcat which works like Process Monitor in Windows ? Thanks
1
vote
0answers
71 views

How to speed up panda?

When looking for a reversing tool I discovered PANDA. Unfortunately, its performance is too slow. When I run some large programs in a virtual machine, the whole system becomes very slow and I can't ...
0
votes
1answer
233 views

Automatically detecting and carving images from .doc, .docx and spreadsheets

I'm looking for a tool that can extract detect and extract any image format from word documents in both .doc and .docx formats for an automatic document classification use case. It is nice to just ...
-1
votes
1answer
74 views

Logging the Instruction Pointer Register

Is there a tool that logs the value the IP register of a specific process running? I am trying to compare the instruction excution before and after a file modification.
3
votes
2answers
3k views

Can Machine Learning be used to develop better reverse engineering tools? [duplicate]

So i googled this but other than some papers i couldnt find any reverse engineering tool that was built using machine learning I'm not an expert in machine learning and deep learning but it seems ...
1
vote
2answers
468 views

fakenet for apps using SSL

With great hopes I have tried to use fakenet-ng for testing spoofing or MITM type vulnerabilities. The android app I am testing uses HTTPS POST, and with fakenet it stops short of sending any data ...
3
votes
1answer
1k views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
4
votes
2answers
552 views

What's a decompiler that can be extended to new architecture, and how can I do it?

I was reverse engineering a binary file. Details does not matter. The important part is that it is written in an architecture that is very unpopular, and there is no existing disassembler or ...
3
votes
2answers
4k views

Alternative to CaptureBAT on Windows 7?

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there ...
3
votes
0answers
148 views

Tools and techniques for analyzing NaCL binaries?

Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly ...
17
votes
7answers
7k views

Are there ready-to-go reverse engineering VMs?

In computer forensics & pentesting, there are live CDs that have a bunch of tools installed. This makes it easy to boot a machine and have a variety of tools for examining the HDD (for example). ...
-1
votes
1answer
259 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: Any ideas ...
3
votes
1answer
342 views

Documenting reversed application

I've been reversing a regularly updated application with various tools (mosty IDA, Olly) for a while now, and I always wondered how to document my findings. For example function names, static ...
1
vote
0answers
199 views

Reverse engineering a bar code's check digit

I'm looking for a tool to reverse engineer a checksum character. Just something to brute force through most commonly used checksum char algorithms without the needing to implement every single one of ...
16
votes
4answers
8k views

USB Dongle Traffic Monitoring

How can I monitor a usb dongle's traffic? I would like to see how a program and its usb dongle talk to each other, if it is possible replay this traffic? Since I am new to this type of thing, any ...