All Questions
811
questions
132
votes
14
answers
126k
views
Where can I, as an individual, get malware samples to analyze?
It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.
The bottleneck here for people aspiring to break ...
43
votes
3
answers
28k
views
Unpacking binaries in a generic way
I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
- 3,198
76
votes
9
answers
85k
views
Analyzing highly obfuscated JavaScript
I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
- 963
32
votes
5
answers
11k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,475
32
votes
4
answers
12k
views
Why are machine code decompilers less capable than for example those for the CLR and JVM?
Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original.
Why can't the same be done for the native code? I tried a few but they either don't ...
- 9,168
336
votes
16
answers
418k
views
Is there any disassembler to rival IDA Pro?
Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
- 4,178
11
votes
3
answers
23k
views
ZTE encrypted backup config file
I was poking around in ZTE Speedport Entry 2i (CPE used mostly in Germany, Slovakia etc, probably custom made for Deutsche Telekom). It's possible to download backup of config from UI.
I found out ...
- 271
27
votes
3
answers
39k
views
Crack Me Material
I'd like to get started with reverse engineering.
Several years ago I saw many programs called crackmes, to crack.
When I searched for some this week, I found none.
My question is, can somebody ...
- 279
21
votes
1
answer
4k
views
Windows Wiki : Books and Tutorials [closed]
This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
66
votes
4
answers
5k
views
How can I analyze a potentially harmful binary safely?
I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
- 1,475
63
votes
6
answers
32k
views
Where to find (free) training in reverse engineering? [closed]
Can someone give a list of websites with good (and free) reverse engineering training exercises ?
- 18.9k
37
votes
3
answers
24k
views
What is a FLIRT signature?
I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
- 4,056
13
votes
3
answers
2k
views
How to prevent use of Resource editors
There are variety of tools that allow editing the resources of Windows executables.
These tools allow a very easy interface for changing the programs look and feel.
Replacing icons, text, menus can be ...
- 4,765
10
votes
1
answer
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
- 2,317
8
votes
1
answer
891
views
Why are values passed through useless copies?
So, say that I have the following code, which gives three examples of what I believe to be unnecessary copies of values.
mov QWORD PTR [rbp-0x18],rdi
mov rdx,QWORD PTR [rbp-0x18]
lea rax,[...
- 285
6
votes
2
answers
11k
views
Offset calculation for branch instruction in ARM
As the title says, how to calculate offsets for branch instructions?
For example i have following assembly code,
0x60ECE B loc_60EE6
;
;
;
0x60EE6 LDR.W R2, #0x123
Hex code for location ...
- 165
138
votes
2
answers
124k
views
What is PLT/GOT?
From time to time, when disassembling x86 binaries, I stumble on
reference to PLT and GOT, especially when calling procedures from a
dynamic library.
For example, when running a program in gdb:
(gdb)...
- 18.9k
92
votes
9
answers
303k
views
How do I reverse-engineer .so files found in Android APKs?
I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation.
When I extract everything from APK, I get some Smali files (I ...
- 1,195
86
votes
3
answers
131k
views
How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?
I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es.
Can ...
- 18.9k
71
votes
7
answers
140k
views
What are the possibilities for reverse engineering an IPA file to its source?
I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
- 1,097
70
votes
2
answers
44k
views
What is DLL Injection and how is it used for reversing?
I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
- 1,527
47
votes
8
answers
33k
views
How do I add functionality to an existing binary executable?
I want to add some functionality to an existing binary file. The binary file was created using gcc.
Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
- 2,435
32
votes
5
answers
5k
views
Why is disassembly not an exact science?
Newbie here.
From Wikipedia
Disassembly is not an exact science: on CISC platforms with
variable-width instructions, or in the presence of self-modifying
code, it is possible for a single ...
- 421
29
votes
3
answers
20k
views
What is a "control-flow flattening" obfuscation technique?
I recently heard about the "control-flow flattening" obfuscation which seems to be is used to break the structure of the CFG of the binary program (see Symbolic Execution and CFG Flattening)....
- 18.9k
28
votes
1
answer
108k
views
Reversing ELF 64-bit LSB executable, x86-64 ,gdb
I'm a newbie and just got into RE.
I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it.
First I tried to set a break point on line 1 using
gdb ./filename
break 1
The gdb says
No ...
- 433
24
votes
2
answers
32k
views
How can I set a breakpoint for a button click?
I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible?
Any tools or tricks to assist in this?
- 343
20
votes
2
answers
36k
views
Managing inputs for payload injection?
I am looking for a complete list of the ways to inject a payload in a vulnerable program in a Unix (Linux) context depending on the inputs opened by the program.
I know that there are several tricks ...
- 18.9k
18
votes
1
answer
23k
views
Approach to extract useful information from binary file
The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file.
I'...
- 195
15
votes
3
answers
11k
views
Which calling convention to use for EAX/EDX in IDA
I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
- 963
15
votes
2
answers
7k
views
How does a SIM card work?
I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors.
They act as peripherals that are more than just flash memory.
I would like to be able to ...
- 329
11
votes
2
answers
9k
views
Decompile and recompile C?
What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it?
- 151
11
votes
3
answers
7k
views
What are the available libraries to statically modify ELF executables?
I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time).
The only library I know to do this is elfesteem (used in Miasm). But,...
- 18.9k
10
votes
1
answer
3k
views
RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM)
I am trying to reverse engineer a two wire RS-485 standard serial bus interface to talk to a Watlow EZ-Zone PM of which I have not been able to find any documentation of the protocol. I have managed ...
- 203
5
votes
1
answer
2k
views
Intro to reverse engineering [closed]
I would like learn how to reverse engineer malwares. I have a very small experience reverse engineering windows applications. I would like to know if there are good resources that is helpful in ...
- 93
62
votes
8
answers
37k
views
how can I diff two x86 binaries at assembly code level?
I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
- 4,765
48
votes
4
answers
45k
views
Is reverse engineering and using parts of a closed source application legal?
Is it legal to reverse engineer certain features of a closed source application and then integrate those features into a closed or open source application that may be either a commercial or non-...
- 2,435
41
votes
8
answers
81k
views
Is there any way to decompile a .NET assembly or program?
Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
- 907
37
votes
3
answers
12k
views
How can I reverse optimized integer division/modulo by constant operations?
When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand.
When I compile the following minimal examples:
int mod7(int x) {
...
- 1,789
25
votes
6
answers
9k
views
Tool or data for analysis of binary code to detect CPU architecture
Assuming that I have binary file with code for an unknown CPU, can I somehow detect the CPU architecture? I know that it depends mostly on the compiler, but I think that for most CPU architectures it ...
- 385
24
votes
3
answers
55k
views
What is the most efficient way to detect and to break xor encryption?
I know that modern cryptographic algorithms are as close as they can to fully random data (ciphertext indistinguishability) and that trying to detect it is quite useless. But, what can we do on weak-...
- 18.9k
21
votes
3
answers
18k
views
Detecting tracing in Linux
Under Linux it's possible to trace exactly the kernel system calls with strace.
ltrace can be used also to trace library calls.
I wonder if it's possible to detect if my executable is running under ...
- 4,765
17
votes
1
answer
5k
views
COM interface methods
I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?)
push offset ppv ; Address of ...
- 173
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
12
votes
1
answer
636
views
Are those code snippets and file paths in a C++ binary some sort of standard debug information?
This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.
Is this something standard? (Is this RTTI)
If so, how is this called?
Are there ...
- 3,059
10
votes
2
answers
5k
views
What is the purpose of these instructions before the main preamble?
I wrote a small C program below:
#include <stdlib.h>
int sub(int x, int y){
return 2*x+y;
}
int main(int argc, char ** argv){
int a;
a = atoi(argv[1]);
return sub(argc,a);
}
Compiled ...
- 279
10
votes
1
answer
2k
views
Mapping an external module's source code to assembly - extracting information from source code
The situation is the following:
I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
- 2,038
9
votes
2
answers
2k
views
Highlight Executed Basic Blocks in IDA
When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?
- 1,527
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,559
8
votes
2
answers
2k
views
basic reversing question about local variable
I do not understand the following:
in a very simple dummy C function:
void vulnerable_function(char* string) {
char buffer[100];
}
When I use gdb to disassemble it, I obtain:
0x08048464 <+...
- 103
8
votes
3
answers
637
views
How can I clean up strings built at runtime (stack strings)?
How can I clean up/simplify strings that are built at runtime?
I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
- 83