All Questions

15
votes
4answers
13k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
15
votes
4answers
2k views

Obfuscating JavaScript with zero-width characters - pros and cons?

This comes from comments on a question on StackOverflow about JavaScript Variables: Why aren't ◎ܫ◎ and ☺ valid JavaScript variable names? JavaScript accepts zero-width characters as valid variable ...
21
votes
3answers
10k views

Can I create an object file using gcc that cannot be reverse engineered?

Is it possible to create an object file using gcc that cannot be reverse engineered to its source code ?
9
votes
3answers
347 views

Usage of FHE in obfuscation?

FHE (Fully Homomorphic Encryption) is a cryptographic encryption schema in which it is possible to perform arithmetic operations on the ciphered text without deciphering it. Though there is no really ...
18
votes
2answers
3k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
29
votes
6answers
11k views

Decompiling Android application

The Android java code is compiled into Dalvik byte code, which is quite readable. I wonder, is it possible in theory and in practice to write a decompilation software for Dalvik byte code?
7
votes
1answer
241 views

What safety steps are to be followed when opening up an unknown piece of hardware?

I recently found a plastic box with various dials and unknown sockets on it, in my Grandfather's attic. It is around 12"x8"x4". From the plastic, it appears to be of 1980's vintage. I asked around, ...
16
votes
4answers
11k views

Checking if an .exe is actually a .jar wrapped in an .exe

Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth. Would it be possible to tell, given just the .exe, if it was generated using one such ...
5
votes
1answer
413 views

Reverse engineering a Solaris driver

I have several Solaris 2.6 era drivers I would like to reverse engineer. I have a Sparc disassembler which provides some info but it isn't maintained anymore so I think it may not give me all the ...
62
votes
4answers
4k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
34
votes
7answers
10k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
21
votes
7answers
3k views

How are x86 CPU instructions encoded?

I'm writing a small utility library for hooking functions at run time. I need to find out the length of the first few instructions because I don't want to assume anything or require the developer to ...
20
votes
7answers
5k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
14
votes
2answers
337 views

Is there a good reference for COM object signatures?

When doing RE on some Microsoft binaries I run across COM object references all the time. Is there a good central place to translate some of the GUID's that I find to some sort of object type without ...
22
votes
4answers
3k views

When is applying reverse engineering techniques acceptable? [closed]

You all know there are people out there that use reverse engineering techniques to do bad things; this ranges from being able to use paid software for free (cracker) to finding vulnerabilities that ...
32
votes
2answers
710 views

What is the current state of the art for platform modeling?

When we're doing reverse engineering, we have a few levels of models. One of them is the instruction semantics model, which tells us what every native instruction does to modify instruction state. We'...

15 30 50 per page