Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Reverse-engineering focused on the detection, and possibly the exploitation, of security vulnerabilities in software and computer systems.

-1
votes
1answer
166 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
0
votes
1answer
317 views

Understanding the variables in stack layout

i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
5
votes
2answers
242 views

Cannot locate a variable on the stack

I am unable to locate a variable on the stack. I'm using Fedora 25 x64 but with a 32 bit program, btw. C program: #include <stdlib.h> #include <unistd.h> #include <stdio.h> #...
1
vote
3answers
389 views

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Here's the attached image: The CA-50 was used by Nokia to program newer phones. Nokia phones from around 2008-2011 feature this port for flashing. I noticed the USB side is unusually longer. It is ...
1
vote
0answers
230 views

Analyzing stack trace for vulnerability analysis using WIndbg [closed]

While analyzing root cause analysis of a vulnerability using windbg we use to put a command kb to view the stack trace. But after viewing the stack trace how to analyze or confirm the presence of ...
-2
votes
1answer
438 views

What kind of fuzzer can i use? [closed]

I studied reverse engineering for 6 months. And I wanna discover Adobe Reader vulnerability for bughunting. But i have lack knowlege of this branch. Anyone help me plz? My question is what kind of ...
0
votes
0answers
351 views

How to get a shell on a remote server?

Hello guys, I explain my problem, i recently learn about socket programming and i want to do a simple "exploit" maybe the easiest shellcode exercise. In order to be precise i'll put below the source ...
5
votes
2answers
1k views

Need advice : Reverse engineering a pdf with shellcode

Problem : I try to find the plaintext which was hidden at pdf inbuilt with shellcode What i tried : I received a pdf which contains javascript with it ,i dig the pdf as follows : Exploring ...
2
votes
1answer
106 views

How to connect to embedded device via charge-only USB?

For research purposes (vulnerability-analysis), I would like to connect to an embedded Linux-based device via USB. The USB is only intended for the (re)charging (according to the manufacturer of ...
3
votes
1answer
511 views

Analyzing a use-after-free bug (taint analysis?)

I'm analyzing a use-after-free bug in IDA Pro by hand. Basically, I control the content of an object (pointed by a register) and I want to force a write at an arbitrary address. For instance, I might ...
2
votes
2answers
6k views

When to use Windbg and Ollydbg?

According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
0
votes
2answers
374 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
3
votes
2answers
169 views

blackbox vulnerability assessment

I wonder if the tools like AddressSanitizer exist for blackbox analysis. For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some ...
1
vote
1answer
178 views

Run multiple instances of same application - Adobe Reader

I have been fuzzing Adobe Reader for a while now. One of the issue that I face is running multiple instances of same application. If I'm able to run multiple instances of same application, I will be ...
3
votes
1answer
1k views

Use After Free - Example

Use After Free bugs a getting more severe these days. I'm planning to demonstrate Use After Free bug exploitation using VTable overwrite. So, I'm trying to create a ATL ActiveX Control which is ...
4
votes
1answer
4k views

How can a format string vulnerability be used to write a specific string into memory?

I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer. Can format string vulnerability also be used to ...
3
votes
2answers
394 views

Reading Memory to bypass ASLR

Modern exploits use different techniques to bypass ASLR. One of the technique used in some IE exploits is to leak memory using a BSTR overwrite. How can an attacker leak memory, and how can he use it ...
6
votes
3answers
2k views

Fuzzing Adobe Reader - Exploit Development

I have been fuzzing Adobe Reader lately. I found couple of bugs. One of the major issues that I'm facing are listed below. How to identify the root cause of the issue? I mean, the PoC has a large ...
1
vote
1answer
327 views

Help with identifying race condition in wargame

I've been trying for the past week to solve a wargame - where I am given a program and need to find the correct input (usually malformed, malicious, or otherwise) to get it to execute code that I want....
5
votes
1answer
318 views

Do you have tips analyzing reported PoC(exploit) files?

My daily job is analyzing reported proof of concept files that exploits document viewers. People who report vulnerabilities in document viewers just give me the PoC and vulnerable version number. They ...
5
votes
3answers
3k views

Is learning assembly enough to become a malware analyst? [closed]

I am a C/C++ developer and I have started learning assembly language programming with the goal to become a malware analyst. I know it is not enough to just know how to read assembly to become a ...
14
votes
3answers
2k views

How exploit writers find bugs in Java Machine?

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/) The victimn should visit the ...
9
votes
2answers
1k views

mathematical background behind exploit development and vulnerabilities

I would like more information about the mathematical foundations of vulnerability and exploit development.online sources or books in the right direction will be helpful.
8
votes
1answer
705 views

What is your vulnerability discovery process? [closed]

I myself am a static analysis guy; I mostly gave up dynamic reverse engineering ten years ago. So these days, my process is usually to locate where my input enters the module that I am interested in, ...