Questions tagged [tools]

Use this tag for questions regarding recommendations of frameworks, libraries, programs or hardware tools used during the process of reverse engineering. Please avoid using this tag for tool-specific questions that do not have their own tag.

Filter by
Sorted by
Tagged with
2
votes
1answer
2k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
2
votes
0answers
1k views

open a non-standard compression .tar.lzma file extracted from firmware download

We are trying to examine a firmware download for a product we have running on our local network. Using the command binwalk -Me filename we generated a folder that contains the following content: ...
0
votes
1answer
118 views

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]

So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits. By, default, it doesn't allow keybind ...
1
vote
0answers
106 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
-1
votes
1answer
242 views

Using x86dbg valid opcodes produce '??? invalid instruction' output

Using the most recent ( as of today ) version of x86dbg I have a problem that follow every executable I have tried. The disassembler in the CPU window, look at the 5th line from the top: Any ideas ...
1
vote
0answers
651 views

Reverse Engineering a whole project desktop application

Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create ...
16
votes
2answers
1k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
11
votes
4answers
4k views

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader. ...
0
votes
1answer
7k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
2
votes
0answers
199 views

I need a tool to assist decompiling C++

I am trying to reverse engineer some C++ code that was made by "architecture astronaut", having multiple layers, lots of virtual functions, lots of polymorphism, metaprogramming, inlined stuff, and so ...
3
votes
1answer
676 views

Using multilevel pointers obtained via cheat engine in own application

So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The ...
2
votes
1answer
9k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
5
votes
1answer
10k views

When to use OllyDgb over Immunity Debugger

I have always been curious when I should use OllyDbg over Immunity Debugger. Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python. Interestingly enough, ...
3
votes
0answers
144 views

Tools and techniques for analyzing NaCL binaries?

Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly ...
1
vote
1answer
2k views

Tools to find base64 strings in binary dumps

When looking at raw binary dumps are there any tools to help identify and decode base64 strings contained within? Essentially "strings", but taking into account base64.
2
votes
2answers
7k views

Tools to get started with reading memory during runtime

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic ...
0
votes
1answer
93 views

How to log every memory read/write action and the registers of the action? [closed]

During runtime. With minimal performance impact on the target. Platform is Windows 7. Objective is to gather a lot of data for clustering and ML. To ultimately assist with protocol reversing. All ...
2
votes
1answer
1k views

How to reverse engineer a database file format?

It is an accounting database whose database file format is proprietary data. But the problem is the database is highly unreliable, corruption go unnoticed for years after which it becomes unbearably ...
0
votes
1answer
152 views

“Incompatible saved desktop has been ignored” in IDA

When I launch IDA for the first time, I move my windows to reflect my perfect window setup. Then I save the desktop and set it as default, plus I additionally save a named backup. After this, I close ...
0
votes
0answers
479 views

Stop synchronizing hex view with disassembly view in IDA

Recently IDA started to synchronize the hex dump with disassembly view. Even if I disable this through right click, it gets reseted every debug session. I also tried to save the desktop with the ...
3
votes
1answer
2k views

Unable to dump a process

I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda. Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
0
votes
0answers
605 views

IDA Flair all functions skipped when creating .pat file

I'm trying to create .pat file with IDA Flair tools, but it skips all the functions. Here is what I did: pelf.exe tier0.lib tier0.pat tier0.lib: skipped 395, total 395 I also tried other tools like ...
1
vote
1answer
4k views

Tools for automated deobfuscation

To evaluate different Java obfuscators, I want also consider if the obfuscators use preventive techniques against common tools used for automated deobfuscation. Therefore I plan to obfuscate a test ...
2
votes
1answer
142 views

How to connect to embedded device via charge-only USB?

For research purposes (vulnerability-analysis), I would like to connect to an embedded Linux-based device via USB. The USB is only intended for the (re)charging (according to the manufacturer of ...
5
votes
1answer
4k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
0
votes
1answer
1k views

How to disassemble using metasm?

I just can't figure out how to disassemble an .exe file using metasm. As far as I know the command should look something like: ruby disassemble.rb [path-to-my-exe-file] > [path-to-output.asm] But,...
0
votes
2answers
241 views

How to find what code created some data?

I'd like to be able to point to a buffer in memory likely on the heap and have a tool tell me which part of the binary created the data in the file. What tools can do that for me?
3
votes
1answer
856 views

Where to find a full analysis of the encryption scheme of CTB-Locker?

CTB-Locker is a currently active ransomware that encrypts files to lock users out. Here are a few links about this malware: A new generation of ransomware: Elliptic curve cryptography + Tor + ...
2
votes
2answers
859 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
3
votes
1answer
2k views

Check if binary was compiled with security checks (/GS)

I have to check massive amount of binaries whether they were compiled with the /GS option. I assume a good indicator would be to check if they have stack cookie or not. Do you know any tool that can ...
4
votes
1answer
882 views

What is a FAT header?

Today I saw a command line option in the output of otool (this is a MacOS X program, offering similar functionality as objdump) that is named: -f -- print the fat headers So, what are the fat ...
0
votes
2answers
674 views

How to monitor APK files in Android System

Is there a monitoring tool for Android except logcat which works like Process Monitor in Windows ? Thanks
3
votes
1answer
4k views

Are there any Windows alternatives to INetSim?

I found a tool for Linux called INetSim which emulates services such as HTTP HTTPS IRC and many other. It is often used to trick malware. The problem is that INetSim works only on Linux. So I want ...
2
votes
1answer
785 views

How to identify HTML5 geolocation protocol of a browser? [closed]

I've been trying to figure how a html5 browser like chrome or firefox performs geolocation under the hood but I'm running into some difficulties. Difficulties To be more precise, I want to know what ...
0
votes
0answers
126 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
-5
votes
1answer
212 views

Virtualization software for Reversing [closed]

What is the best virtualization software for Reverse engineering and exploit development?
0
votes
4answers
4k views

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

I am thinking of buying IDA Pro for my Linux programming environment after reverse engineering a bit with OllyDBG (under WINE)... But before I endorse into such a costly purchase I ask the following ...
4
votes
2answers
976 views

Corpus Distillation

Anyone know of any tools or scripts that can help in corpus distillation ? I know of Peach Minset, but not other than that. Appreciate if anyone could share.
2
votes
3answers
2k views

Find the instruction matching an opcode

I have two bytes '\x74\x06' and I want a list of all instructions that start with this opcode. What tools would you use for this? I am trying to do it with Immunity Debugger but so far no luck. The ...
-1
votes
3answers
141 views

Any programs that can convert textual ones and zeroes to full comparison bytes?

since the byte is the lowest addressable datum and bit rotating/flipping can come in to play here, are there any programs that can enable you to write ones and zeroes (binary), and after every 8 of ...
3
votes
2answers
4k views

Alternative to CaptureBAT on Windows 7?

I am working on some malware that currently only runs with Windows 7 is detected. I would like to use CaptureBAT, but it doesn't work on Windows 7 (with the exception of network monitoring). Is there ...
3
votes
3answers
5k views

IDA Xrefs from - how to?

I want to generate all xrefs from function just to check what api it uses in its call-tree. I know I can generate call tree graph by right clicking on function name and "Xrefs from", but I would like ...
1
vote
1answer
251 views

Binary file search tools [closed]

Is there a open-source Linux tool / utility for Linux platform that would recursively search for binary files (executable, shared / static objects, etc), in a folder and display?
8
votes
3answers
2k views

Re-engineering to create UML Diagrams from Source and Binary

Are there tools that would create: UML Structural Diagrams from Source Code. UML Behavioral Diagrams from Binary executing on a arm / x86 system. Sources would be in C &/ C++ &/ Python. ...
11
votes
5answers
10k views

Decompilation techniques for DOS .COM files

I've found a binary copy of a DOS freeware game I was fond of back in the day (Firefighter, downloadable as FIRE.COM) but the source code is not available. I'd like to re-implement it in C or Python ...
3
votes
2answers
18k views

64 bit Pseudocode decompiler

I have a 64 bit program im debugging. I found the function i need to learn more about to potentially "fix" the problem (there is no source code available for the program). To speed things up, i ...
6
votes
1answer
870 views

How to get IDA Pro Free to automatically change segment on retf?

I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be. There's a simple set of ...
21
votes
5answers
8k views

What tools exist for excavating data structures from flat binary files?

Problem Statement I have a file composed entirely of data structures; I've been trying to find a tool that will enable me to open this file, and declare (perhaps) a type and offset such that i may ...
13
votes
2answers
3k views

Should I switch from WinDbg to OllyDbg?

I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
3
votes
0answers
302 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....