All Questions

Filter by
Sorted by
Tagged with
125 votes
14 answers
124k views

Where can I, as an individual, get malware samples to analyze?

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users. The bottleneck here for people aspiring to break ...
41 votes
3 answers
26k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
user avatar
  • 2,908
72 votes
9 answers
80k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
user avatar
30 votes
5 answers
10k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
user avatar
29 votes
2 answers
10k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
user avatar
  • 7,814
323 votes
16 answers
395k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
user avatar
  • 4,028
21 votes
1 answer
4k views

Windows Wiki : Books and Tutorials [closed]

This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
11 votes
3 answers
19k views

ZTE encrypted backup config file

I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI. I found out ...
user avatar
  • 271
62 votes
6 answers
30k views

Where to find (free) training in reverse engineering? [closed]

Can someone give a list of websites with good (and free) reverse engineering training exercises ?
user avatar
  • 18k
64 votes
4 answers
5k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
user avatar
  • 1,425
10 votes
1 answer
5k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
user avatar
  • 2,279
6 votes
2 answers
9k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
user avatar
12 votes
3 answers
2k views

How to prevent use of Resource editors

There are variety of tools that allow editing the resources of Windows executables. These tools allow a very easy interface for changing the programs look and feel. Replacing icons, text, menus can be ...
user avatar
  • 4,465
8 votes
1 answer
839 views

Why are values passed through useless copies?

So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values. mov QWORD PTR [rbp-0x18],rdi mov rdx,QWORD PTR [rbp-0x18] lea rax,[...
user avatar
  • 255
64 votes
7 answers
128k views

What are the possibilities for reverse engineering an IPA file to its source?

I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
user avatar
81 votes
3 answers
121k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
user avatar
  • 18k
66 votes
2 answers
42k views

What is DLL Injection and how is it used for reversing?

I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
user avatar
  • 1,387
21 votes
3 answers
37k views

Crack Me Material

I'd like to get started with reverse engineering. Some years ago I've seen many many program, so called "crack mes" to crack. When I searched for some this week I've found none. My Question is, can ...
user avatar
  • 219
83 votes
9 answers
262k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
user avatar
  • 1,105
45 votes
8 answers
32k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
user avatar
  • 2,275
28 votes
1 answer
92k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
user avatar
  • 433
16 votes
1 answer
22k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
user avatar
  • 175
13 votes
1 answer
29k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
user avatar
  • 18k
5 votes
1 answer
2k views

Intro to reverse engineering [closed]

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
user avatar
  • 93
31 votes
5 answers
4k views

Why is disassembly not an exact science?

Newbie here. From Wikipedia Disassembly is not an exact science: on CISC platforms with variable-width instructions, or in the presence of self-modifying code, it is possible for a single ...
user avatar
  • 411
13 votes
3 answers
10k views

Which calling convention to use for EAX/EDX in IDA

I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
user avatar
  • 853
15 votes
2 answers
6k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
user avatar
  • 319
11 votes
3 answers
6k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
user avatar
  • 18k
9 votes
1 answer
3k views

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a Watlow EZ-Zone PM of which I have not been able to find any documentation of the protocol. I have managed ...
user avatar
  • 193
8 votes
1 answer
8k views

Decompile and recompile C?

What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
user avatar
  • 101
119 votes
2 answers
104k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
user avatar
  • 18k
56 votes
8 answers
33k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
user avatar
  • 4,465
47 votes
4 answers
43k views

Is reverse engineering and using parts of a closed source application legal?

Is it legal to reverse engineer certain features of a closed source application and then integrate those features into a closed or open source application that may be either a commercial or non-...
user avatar
  • 2,275
35 votes
3 answers
11k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
user avatar
  • 1,729
40 votes
8 answers
78k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
user avatar
  • 877
19 votes
3 answers
17k views

Detecting tracing in Linux

Under Linux it's possible to trace exactly the kernel system calls with strace. ltrace can be used also to trace library calls. I wonder if it's possible to detect if my executable is running under ...
user avatar
  • 4,465
25 votes
2 answers
15k views

What is a "control-flow flattening" obfuscation technique?

I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Diablo obfuscation module and Symbolic Execution ...
user avatar
  • 18k
23 votes
3 answers
50k views

What is the most efficient way to detect and to break xor encryption?

I know that modern cryptographic algorithms are as close as they can to fully random data (ciphertext indistinguishability) and that trying to detect it is quite useless. But, what can we do on weak-...
user avatar
  • 18k
20 votes
2 answers
30k views

How can I set a breakpoint for a button click?

I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible? Any tools or tricks to assist in this?
user avatar
  • 303
16 votes
1 answer
4k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...
user avatar
32 votes
3 answers
21k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
user avatar
  • 3,836
22 votes
6 answers
7k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for unknow CPU can I somehow detect cpu architecture? I know that it depends mostly on compiler but I think that for most of CPU architectures it should be ...
user avatar
  • 345
14 votes
4 answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
user avatar
  • 143
10 votes
2 answers
4k views

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled ...
user avatar
  • 279
7 votes
1 answer
7k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
user avatar
  • 181
8 votes
2 answers
2k views

basic reversing question about local variable

I do not understand the following: in a very simple dummy C function: void vulnerable_function(char* string) { char buffer[100]; } When I use gdb to disassemble it, I obtain: 0x08048464 <+...
user avatar
6 votes
2 answers
4k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc near ...
user avatar
  • 1,439
4 votes
1 answer
2k views

Reversing encryption by analysing executable

I have a program that reads data from a file, parses/organizes it, and spits it out as an encrypted XML. The application can also take an encrypted XML and spit out the original file. My objective at ...
user avatar
  • 265
3 votes
1 answer
5k views

Finding all API calls in a function

is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function. .text:003A33D9 call esi ; _snwprintf .text:...
user avatar
  • 1,042
9 votes
2 answers
2k views

Highlight Executed Basic Blocks in IDA

When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?
user avatar
  • 1,387

15 30 50 per page
1
2 3 4 5
16