All Questions

Ask Question
791 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
131 votes
14 answers
125k views

Where can I, as an individual, get malware samples to analyze?

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users. The bottleneck here for people aspiring to break ...
Community wiki
mrduclaw
43 votes
3 answers
27k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
Remko
  • 3,093
76 votes
9 answers
83k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
Adam Caudill
  • 953
32 votes
5 answers
11k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
lllllllllllll
  • 2,475
31 votes
3 answers
11k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
Rolf Rolles
  • 8,499
329 votes
16 answers
410k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
dyasta
  • 4,108
11 votes
3 answers
22k views

ZTE encrypted backup config file

I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI. I found out ...
J91321
  • 271
22 votes
3 answers
38k views

Crack Me Material

I'd like to get started with reverse engineering. Some years ago I've seen many many program, so called "crack mes" to crack. When I searched for some this week I've found none. My Question is, can ...
0x45
  • 229
21 votes
1 answer
4k views

Windows Wiki : Books and Tutorials [closed]

This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
Community wiki
11 revs, 3 users 51%
asheeshr
66 votes
4 answers
5k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
Archenoth
  • 1,455
63 votes
6 answers
31k views

Where to find (free) training in reverse engineering? [closed]

Can someone give a list of websites with good (and free) reverse engineering training exercises ?
perror
  • 18.5k
37 votes
3 answers
23k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
mrduclaw
  • 4,006
13 votes
3 answers
2k views

How to prevent use of Resource editors

There are variety of tools that allow editing the resources of Windows executables. These tools allow a very easy interface for changing the programs look and feel. Replacing icons, text, menus can be ...
Mellowcandle
  • 4,705
10 votes
1 answer
6k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
Zach Riggle
  • 2,307
8 votes
1 answer
867 views

Why are values passed through useless copies?

So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values. mov QWORD PTR [rbp-0x18],rdi mov rdx,QWORD PTR [rbp-0x18] lea rax,[...
David
  • 265
6 votes
2 answers
10k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
user2578525
  • 165
91 votes
9 answers
285k views

How do I reverse engineer .so files found in android APKs?

I know how to reverse engineer normal android APKs using tools like APK-tool anddex2jar but i don't know how to work with obfuscation. Can anyone help or atleast provide some pointers? I know this ...
Pervy Sage
  • 1,185
85 votes
3 answers
127k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
perror
  • 18.5k
70 votes
7 answers
135k views

What are the possibilities for reverse engineering an IPA file to its source?

I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
BlueBerry - Vignesh4303
  • 1,075
70 votes
2 answers
43k views

What is DLL Injection and how is it used for reversing?

I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
user2142
  • 1,517
46 votes
8 answers
33k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
asheeshr
  • 2,405
32 votes
5 answers
4k views

Why is disassembly not an exact science?

Newbie here. From Wikipedia Disassembly is not an exact science: on CISC platforms with variable-width instructions, or in the presence of self-modifying code, it is possible for a single ...
Einar
  • 421
28 votes
1 answer
101k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
3lokh
  • 433
27 votes
3 answers
17k views

What is a "control-flow flattening" obfuscation technique?

I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Symbolic Execution and CFG Flattening)....
perror
  • 18.5k
18 votes
2 answers
33k views

Managing inputs for payload injection?

I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program. I know that there are several tricks ...
perror
  • 18.5k
18 votes
1 answer
23k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
Light123
  • 195
15 votes
2 answers
6k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
SDsolar
  • 329
15 votes
3 answers
10k views

Which calling convention to use for EAX/EDX in IDA

I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
Devolus
  • 963
11 votes
3 answers
6k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
perror
  • 18.5k
10 votes
1 answer
3k views

RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)

I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a Watlow EZ-Zone PM of which I have not been able to find any documentation of the protocol. I have managed ...
Onlyjus
  • 203
9 votes
1 answer
9k views

Decompile and recompile C?

What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
user8005
  • 121
5 votes
1 answer
2k views

Intro to reverse engineering [closed]

I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
Ray
  • 93
128 votes
2 answers
115k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
perror
  • 18.5k
61 votes
8 answers
35k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
Mellowcandle
  • 4,705
47 votes
4 answers
44k views

Is reverse engineering and using parts of a closed source application legal?

Is it legal to reverse engineer certain features of a closed source application and then integrate those features into a closed or open source application that may be either a commercial or non-...
asheeshr
  • 2,405
41 votes
8 answers
79k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
APerson
  • 907
37 votes
3 answers
12k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
Dougall
  • 1,749
24 votes
6 answers
8k views

Tool or data for analysis of binary code to detect CPU architecture

Assuming that I have binary file with code for an unknown CPU, can I somehow detect the CPU architecture? I know that it depends mostly on the compiler, but I think that for most CPU architectures it ...
n3vermind
  • 375
23 votes
2 answers
31k views

How can I set a breakpoint for a button click?

I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible? Any tools or tricks to assist in this?
Menna
  • 333
23 votes
3 answers
52k views

What is the most efficient way to detect and to break xor encryption?

I know that modern cryptographic algorithms are as close as they can to fully random data (ciphertext indistinguishability) and that trying to detect it is quite useless. But, what can we do on weak-...
perror
  • 18.5k
20 votes
3 answers
18k views

Detecting tracing in Linux

Under Linux it's possible to trace exactly the kernel system calls with strace. ltrace can be used also to trace library calls. I wonder if it's possible to detect if my executable is running under ...
Mellowcandle
  • 4,705
17 votes
1 answer
5k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...
astrophonic
  • 173
15 votes
4 answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
RcketCalf
  • 153
12 votes
1 answer
620 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
samuirai
  • 3,009
10 votes
2 answers
5k views

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled ...
drdot
  • 279
10 votes
1 answer
2k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
Dominik Antal
  • 1,998
9 votes
2 answers
2k views

Highlight Executed Basic Blocks in IDA

When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?
user2142
  • 1,517
9 votes
2 answers
5k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc near ...
Biswapriyo
  • 1,529
8 votes
3 answers
614 views

How can I clean up strings built at runtime (stack strings)?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
phoenix89
  • 83
8 votes
2 answers
837 views

Trace assisted code identification?

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists. I'd like to find a specific part of code in the binary. Searching for ...
mikeazo
  • 1,052

15 30 50 per page
1
2 3 4 5
…
16