All Questions

Filter by
Sorted by
Tagged with
3
votes
2answers
11k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
5
votes
4answers
2k views

Is BinNavi available? If not, can I get the source from anywhere?

BinNavi is originally a Zynamics product. But, since the company has been bought by Google, it seems to be difficult to get the library. I tried to look in the BinNavi manual in the installation ...
7
votes
2answers
1k views

Does a Motorola SREC file give me any additional information over a binary ROM image?

When working with embedded systems, it is often easiest to use a downloadable firmware file rather than recover the firmware from the device. Mostly these are ROM images in the form of a .bin file. ...
10
votes
1answer
852 views

Re-run autoanalysis in Hopper?

I have loaded a raw binary (ARM firmware image) into Hopper, and manually marked the entry point as code. But now I'd like to have Hopper do auto-analysis (recursive traversal) starting from that code ...
6
votes
2answers
2k views

How to prevent automatic padding by IDA?

I defined a struct in a header file, similar to this one: struct STRUCT { char a; int b; }; This is parsed successfully by IDA, however it adds padding bytes after the char: 00000000 STRUCT ...
10
votes
1answer
6k views

Where can I find tools for reverse engineering Lua

Since Lua is an interpreted/compiled language that its own compilers and isn't usually translated/compiled with a C compiler. What tools should be used to reverse engineer an application written in ...
9
votes
1answer
1k views

Common Lisp bytecode or machine code decompiler

Does anyone know of a decompiler for Common Lisp? I know most lisp environments include a disassembler. But I don't know of any decompilers. I would think it should be possible to make a decompiler ...
7
votes
1answer
129 views

No apparent effect after editing some JSON in the memory of a Flash process

I was trying to change the values of a Flash game which loads the SWF and some JSON over a HTTPS site. So changing the values of JSON was not possible using browser cache. I changed the values of ...
9
votes
1answer
4k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
11
votes
3answers
3k views

Wanted: Java bytecode disassembler that shows addresses, opcodes, operands, in hex

I am after a java bytecode disassembler whose output includes the bytecodes themselves, their operands, and their addresses in the .class file, and which displays numbers in hex, not decimal. To show ...
3
votes
1answer
434 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
2
votes
0answers
410 views

MITRE MAEC (Malware Attribute Enumeration and Characterization) opinions and usage [closed]

I was looking at some MITRE projects and was wondering what you thought about, and if anyone was using or contributing to, the MITRE Malware Attribute Enumeration and Characterization project: https://...
9
votes
3answers
2k views

How to reverse engineer an ATM?

This question is using ATMs as an example, but it could apply to any number of 'secure' devices such as poker machines, E-voting machines, payphones etc. Given that ATMs are relatively hardened (in ...
13
votes
4answers
3k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
7
votes
2answers
7k views

How can one extract the appended data of a Portable Executable?

How do you reliably extract appended data in a Portable Executable?
60
votes
3answers
90k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
8
votes
3answers
3k views

Unable to set breakpoints in keygen

I like security as a hobby and I not so often I read and play with a few simple KeyGen games and I enjoy it. Reversing and KeyGen is very interesting but I'm a beginner and my questions are probably ...
4
votes
1answer
734 views

SQL Server not downloading symbols from the symbol server, even though SymInitialize has the symserver in its path

EDIT Clarified, I meant the extended exent ringbugger stacktraces described by Jonathan Kehayias. I recently discovered it was possible to get link.exe, dumpbin.exe, etc to download symbols from a ...
7
votes
2answers
1k views

How can one extract resources from a New Executable?

I'm trying to extract menus and other stuff from a New Executable (NE), i.e. the ones from Windows' 16-bit times. The tools I find (e. g. ResourceTuner) work for PEs only. Any idea for tools to ...
22
votes
5answers
7k views

What are the tools to analyze Python (obfuscated) bytecode?

Recently on Reddit ReverseEngineering I stumbled on a self-modifying code in Python. Looking at the Github repository was quite instructive and I found picture of the Python bytecode program exposed ...
9
votes
2answers
11k views

Better explanation of different x86 CALL variations

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am ...
7
votes
2answers
4k views

Base address of shared objects from ldd output

I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result : linux-gate.so.1 => (0xb7fe1000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000) /lib/...
73
votes
2answers
56k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
6
votes
1answer
3k views

What does %reg:value mean in ATT assembly?

When I disassemble a function, I encounter from time to time an expression of the form %reg:value. Typically, I encounter this syntax when I activate the canaries in GCC (-fstack-protector), as in the ...
9
votes
2answers
590 views

What does the text in angle brackets refer to (From objdump)

I constantly see the text (<perror@plt+0x2008e0>) as seen in the snippet below, but I am not sure if its making a call to perror of if the disassembler was having issues. Since it would be odd ...
1
vote
2answers
402 views

API for LockState Wireless Internet Thermostat

I want to develop a web-based API in Rails for some LockState wifi programmable thermostats, so that other different application can control these thermostats. But I'm cannot find any resource about ...
6
votes
1answer
644 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
8
votes
5answers
5k views

How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?

I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is: Unable to enumerate locals, HRESULT 0x80004005 ...
13
votes
1answer
3k views

How can I debug or monitor a Windows Phone 8 application?

I'm interested in debugging and monitoring a Windows Phone 8 application for which I do not have the source code. Android and iOS can both be rooted/jailbroken, which allows me to use tools like GDB (...
4
votes
3answers
3k views

How to change a large section of bytes to words in IDA Pro

I have a large section in IDA that is a data lookup table of word length data. I want to change them all to word length rather than byte length. I know you can make an array but when I do it becomes ...
6
votes
1answer
2k views

Any idea how to decode this binary data?

I have binary data representing a table. Here's the data when I print it with Python's repr(): \xff\xff\x05\x04test\x02A\x05test1@\x04\x03@@\x04\x05@0\x00\x00@\x05\x05test2\x03\x05\x05test1\x06@0\x00\...
19
votes
3answers
34k views

Sniffing TCP traffic for specific process using Wireshark

Is it possible to sniff TCP traffic for a specific process using Wireshark, even through a plugin to filter TCP traffic based on process ID? I'm working on Windows 7, but I would like to hear about ...
5
votes
1answer
3k views

How to compile Hex-Rays decompiler generated code?

I need help to compile Pseudo-C code generated with IDA Pro and the Hex-Rays decompiler plugin. It shows an error on this line: int (__thiscall *off_401F14)(void *, char); // weak Error: error ...
5
votes
2answers
3k views

How to break on an Android JNI function with IDA Pro Debugger

I have an android application that uses a shared library which I would like to step through with a debugger. I've had success using IDA 6.3 to debug executables with the android_server debug server ...
4
votes
1answer
554 views

On SPARC, what happens when a branch is placed in the branch-delay slot of another branch?

Our team recently had to look at SPARC assembly specifications, the problem is that I do not have a SPARC processor to try things on it (I should set up a simulator or get one of these old Sparc ...
5
votes
1answer
224 views

Strange GDB behavior in OSX

I'm reversing some malware on an OSX VM when I noticed something peculiar. While stepping through the instructions, the instruction just after a int 0x80 gets skipped i.e. gets executed without me ...
8
votes
1answer
753 views

How to get notified about IDA database events not covered in the IDA SDK?

In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately. There are certain events apparently ...
13
votes
2answers
484 views

Any way to represent the file-memory relation in a Portable Executable (PE) file?

I am looking for a way to automatically represent the relation between the content of a PE file and how it would be loaded in memory - either an IDA plugin, a combination of pefile script+R/SVG... ...
7
votes
2answers
1k views

FEEDFACE in OSX malware

I was reverse engineering a piece of code in "Crisis" for fun and I encountered the following :- __INIT_STUB_hidden:00004B8F mov eax, 8FE00000h __INIT_STUB_hidden:00004B94 ...
8
votes
3answers
1k views

Trying to reverse engineer C code that is 64bit assembly

This is the code I am looking at 0x0000000000401048 <+70>: mov 0x401ba0(,%rax,4),%eax This is an array of 15 integers. Just wondering how I can access indices 0 to 15 in gdb Thanks
9
votes
5answers
17k views

What are the techniques and tools to obfuscate Python programs?

This question is related to this other one. I just wonder what are the techniques applicable and which can be found in the real world to obfuscate Python program (similar questions can be found on ...
13
votes
5answers
998 views

How do you store your data about a binary while performing analysis?

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
82
votes
1answer
63k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
17
votes
2answers
5k views

Is it possible to get python bytecode without using co_code?

I posted this a while back on stackoverflow (too old to migrate though). Say I am in the python interpreter and define a function as follows: def h(a): return a If I want to look at the bytecode (...
18
votes
3answers
14k views

Detecting tracing in Linux

Under Linux it's possible to trace exactly the kernel system calls with strace. ltrace can be used also to trace library calls. I wonder if it's possible to detect if my executable is running under ...
8
votes
1answer
5k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
12
votes
3answers
8k views

Locating Linux Kernel Symbols on ARM

Igor posted a great answer previously on SO about the format of the Linux kernel image on ARM. Assuming I can't boot my kernel image, can someone give me pointers on finding this compressed symbol ...
3
votes
1answer
394 views

How to avoid the load file dialog in IDA GUI

I would like IDA to remember my default load file settings instead of presenting the load file dialog on every start. The documentation says there is a -T command line switch that should take a 'file ...
19
votes
1answer
7k views

What's 'fs:[0]' doing and how can I execute it step by step?

In a 32 bits Windows binary, I see this code: push next push fs:[0] mov fs:[0], esp int3 ... next: I see that something happens on the int3 (an error), but I don't understand why,...
10
votes
2answers
10k views

How to display memory zones content on IDA Pro?

This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format)....

15 30 50 per page