All Questions

Filter by
Sorted by
Tagged with
338 votes
16 answers
423k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
dyasta's user avatar
  • 4,198
142 votes
2 answers
130k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
perror's user avatar
  • 19.1k
132 votes
14 answers
127k views

Where can I, as an individual, get malware samples to analyze?

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users. The bottleneck here for people aspiring to break ...
123 votes
2 answers
100k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
0xC0000022L's user avatar
  • 10.9k
102 votes
20 answers
142k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
mrduclaw's user avatar
  • 4,066
93 votes
9 answers
316k views

How do I reverse-engineer .so files found in Android APKs?

I know how to reverse-engineer normal Android APKs using tools like apktool and dex2jar, but I don't know how to work with obfuscation. When I extract everything from APK, I get some Smali files (I ...
Pervy Sage's user avatar
  • 1,205
87 votes
3 answers
133k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

I try to understand the process of memory segmentation for the i386 and amd64 architectures on Linux. It seems that this is heavily related to the segment registers %fs, %gs, %cs, %ss, %ds, %es. Can ...
perror's user avatar
  • 19.1k
76 votes
9 answers
86k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
Adam Caudill's user avatar
71 votes
7 answers
143k views

What are the possibilities for reverse engineering an IPA file to its source?

I browsed a lot, but can't find any resources for reverse engineering an IPA file (iPhone application). Is there any method to reverse engineer an IPA file to its source? I've tried to rename it to ...
BlueBerry - Vignesh4303's user avatar
71 votes
3 answers
15k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
Mellowcandle's user avatar
  • 4,825
70 votes
2 answers
44k views

What is DLL Injection and how is it used for reversing?

I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
user2142's user avatar
  • 1,537
67 votes
4 answers
6k views

How can I analyze a potentially harmful binary safely?

I've recently managed to isolate and archive a few files that managed to wreak havoc on one of my client's systems. So I was wondering what software and techniques make the best sandbox for isolating ...
Archenoth's user avatar
  • 1,485
64 votes
6 answers
32k views

Where to find (free) training in reverse engineering? [closed]

Can someone give a list of websites with good (and free) reverse engineering training exercises ?
perror's user avatar
  • 19.1k
63 votes
8 answers
38k views

how can I diff two x86 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
Mellowcandle's user avatar
  • 4,825
63 votes
7 answers
135k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
62 votes
7 answers
17k views

Visualizing ELF binaries

I recently saw an older talk by Sergey Bratus and Greg Conti by the name of Voyage of the Reverser: A Visual Study of Binary Species. Are there any opensource/free tools that one could use to see ...
user avatar
56 votes
7 answers
159k views

How to know in which language/technology program (.exe) is written?

How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
Pranit Kothari's user avatar
52 votes
5 answers
33k views

Bypassing copy protection in microcontrollers using glitching

The ATmega microcontrollers generally have two lock bits, LB1 and LB2. One prevents further programming, and the other prevents the flash being read back. If both are set, the chip needs to be erased ...
Cybergibbons's user avatar
  • 1,762
50 votes
12 answers
5k views

Where to find information about a file format?

Let's say I found 'some' file (might be an executable, might be data, or something else) and want to run or read it. I open this file in a text editor, but the format isn't readable. Examples include: ...
user avatar
48 votes
8 answers
34k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
asheeshr's user avatar
  • 2,465
48 votes
4 answers
46k views

Is reverse engineering and using parts of a closed source application legal?

Is it legal to reverse engineer certain features of a closed source application and then integrate those features into a closed or open source application that may be either a commercial or non-...
asheeshr's user avatar
  • 2,465
45 votes
4 answers
23k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
user1365830's user avatar
43 votes
3 answers
28k views

Unpacking binaries in a generic way

I find that more and more often binaries are being packed with exe protectors such as upx, aspack etc. I tried to follow a few tutorials on how to unpack them but the examples are often quite easy ...
Remko's user avatar
  • 3,273
42 votes
8 answers
82k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
APerson's user avatar
  • 927
42 votes
1 answer
94k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
user94584392's user avatar
40 votes
5 answers
134k views

How do you reverse engineer an EXE "compiled" with PyInstaller

Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller. In his presentation, he is creating ...
Mick's user avatar
  • 7,582
39 votes
8 answers
8k views

What are the targets of professional reverse software engineering?

At the professional level, for what purpose is reverse software engineering used? What software is targeted and why? For reasonably complex compiled code that's doing something novel, making ...
Praxeolitic's user avatar
38 votes
9 answers
61k views

How does one reverse engineer a SWF file?

What tools and techniques exist to either decompile or analyze the bytecode in a SWF file? What resources are available to the reverse engineer to learn more about SWF internals?
user1354557's user avatar
  • 1,234
37 votes
5 answers
8k views

Why would a program contain a call instruction targetting the address immediately following that instruction?

While reversing a 32bit Mach-O binary with Hopper, I noticed this peculiar method. The instruction on 0x0000e506 seems to be calling an address right below the instruction. What would be the reason ...
Daniel Sloof's user avatar
37 votes
5 answers
11k views

How can I analyse an executable with no read permission?

I have a binary on a Linux (Kernel 2.6) which I can execute, but can't read (chmod 0711). Therefore no static analysis is possible. user1: $ ls -l bin -r-s--x--- user2 user1 bin user1: $ file bin ...
samuirai's user avatar
  • 3,079
37 votes
3 answers
12k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
Dougall's user avatar
  • 1,789
37 votes
3 answers
25k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
mrduclaw's user avatar
  • 4,066
37 votes
3 answers
32k views

How do I figure out what is burned on an Arduino ROM?

I have an Arduino Uno Rev3. I would like to extract and find out what code is burned on the ROM of the micro-controller board. How do I extract the code from the board? How do I figure out the ...
asheeshr's user avatar
  • 2,465
36 votes
8 answers
50k views

Reverse engineering T-Disk barcodes for Tassimo coffee makers

In hope this is appropriate I have a Bosch Tassimo TAS2002EE coffee maker that uses T-Disks. Those contain coffee/milk/something else, and a barcode that is supposed to tell the machine how to deal ...
GSerg's user avatar
  • 460
35 votes
7 answers
11k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
WilliamKF's user avatar
  • 937
34 votes
4 answers
17k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
c00000fd's user avatar
  • 1,691
33 votes
4 answers
34k views

How do I identify and use JTAG?

I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...
mrduclaw's user avatar
  • 4,066
33 votes
5 answers
30k views

Open source GUI tool for decomposing a PDF

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
Lizz's user avatar
  • 443
33 votes
1 answer
9k views

How to reattach tabs in IDA?

I feel dumb for needing to ask, but I've been annoyed by this several times in the past and have yet to come across the answer. Sometimes, when rearranging tabs in IDA Pro, I accidentally detach the ...
Kevin's user avatar
  • 901
32 votes
5 answers
57k views

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
amccormack's user avatar
  • 1,326
32 votes
5 answers
5k views

Why is disassembly not an exact science?

Newbie here. From Wikipedia Disassembly is not an exact science: on CISC platforms with variable-width instructions, or in the presence of self-modifying code, it is possible for a single ...
Einar's user avatar
  • 421
32 votes
5 answers
12k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
lllllllllllll's user avatar
32 votes
4 answers
12k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
Rolf Rolles's user avatar
  • 9,198
32 votes
5 answers
25k views

What is a good tools to reverse the effects of Minify on JavaScript?

Are there any scripts and/or online tools that can reverse the effects of minification? I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
WPrecht's user avatar
  • 816
32 votes
5 answers
45k views

What is the meaning of movabs in gas/x86 AT&T syntax?

I just found a strange instruction by assembling (with gas) and disassembling (with objdump) on a amd64 architecture. The original amd64 assembly code is: mov 0x89abcdef, %al And, after gas ...
perror's user avatar
  • 19.1k
32 votes
9 answers
59k views

Decompiling a 1990 DOS application

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
ScumCoder's user avatar
  • 609
32 votes
1 answer
9k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...
WilliamKF's user avatar
  • 937
32 votes
2 answers
815 views

What is the current state of the art for platform modeling?

When we're doing reverse engineering, we have a few levels of models. One of them is the instruction semantics model, which tells us what every native instruction does to modify instruction state. We'...
Andrew's user avatar
  • 1,522
31 votes
4 answers
44k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
creuchmeuch's user avatar
31 votes
5 answers
57k views

What is the linux equivalent to OllyDbg and Ida Pro?

What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
k170's user avatar
  • 453

15 30 50 per page
1
2 3 4 5
195