All Questions

Filter by
Sorted by
Tagged with
7
votes
2answers
726 views

Trace assisted code identification?

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists. I'd like to find a specific part of code in the binary. Searching for ...
4
votes
1answer
2k views

/proc/self/maps equivalent on windows

I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in. How could one ...
10
votes
1answer
567 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
8
votes
1answer
2k views

Mapping an external module's source code to assembly - extracting information from source code

The situation is the following: I'm reversing an application, In which I found a lot of functions that belongs to the OpenSSL library. Since I have the source code for this module, I was wondering if ...
114
votes
1answer
87k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
95
votes
19answers
123k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
57
votes
7answers
123k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
26
votes
5answers
4k views

How do I move from RCE being a hobby to RCE being a profession?

I'm currently a high school sophomore. I haven't really done much on the RCE of malware, I've unpacked zbot and rbot, and looked at how they work, but I can manipulate practically any game to my ...
49
votes
12answers
4k views

Where to find information about a file format?

Let's say I found 'some' file (might be an executable, might be data, or something else) and want to run or read it. I open this file in a text editor, but the format isn't readable. Examples include: ...
26
votes
1answer
25k views

What symbol tables stay after a strip In ELF format?

I am currently looking at the ELF format, and especially at stripped ELF executable program files. I know that, when stripped, the symbol table is removed, but some information are always needed to ...
29
votes
1answer
8k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...
30
votes
4answers
31k views

How do I identify and use JTAG?

I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...
25
votes
6answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
13
votes
2answers
7k views

What is the algorithm used in Recursive Traversal disassembly?

Disassembling binary code is a quite difficult topic, but for now only two (naive) algorithms seems to be broadly used in the tools. Linear Sweep: A basic algorithm taking all the section marked as ...
33
votes
7answers
11k views

What hints in machine code can point me to the compiler which was used to generate it?

When I am looking at the machine code of an application, are there hints and patterns I can discern from the generated machine code which would indicate which compiler (and possibly version) was used ...
13
votes
2answers
10k views

What are the different types of packers?

I know the basic principle of a packer. Basically, it is a small routine launched at the beginning of the program that decompress the actual program and jump to it once achieved. Yet, it seems that ...
18
votes
1answer
4k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
19
votes
4answers
19k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
14
votes
3answers
9k views

Dynamic java instrumentation?

This is not strictly 'reverse engineering', it's mostly related to dynamic instrumentation. So, in the same fashion as strace which allows you to see syscalls made by a process, or ftrace to see ...
13
votes
5answers
1k views

How do you store your data about a binary while performing analysis?

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite ...
11
votes
2answers
5k views

How does BinDiff work?

I would like to know what are the basic principles (and maybe a few things about the optimizations and heuristics) of the BinDiff software. Does anyone have a nice and pedagogic explanation of it?
5
votes
1answer
2k views

What are good Windows anti-debug references? [closed]

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
13
votes
4answers
6k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
12
votes
2answers
15k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
10
votes
5answers
11k views

How to find offsets in OllyDBG from IDA

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
10
votes
2answers
4k views

What to do when IDA cannot provide a function name?

For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
10
votes
4answers
22k views

Try to deobfuscate multi layered javascript

According to the techy zilla blog It will be much harder to deobfuscate code that has been obfuscated using multiple obfuscating algorithms. According to them, jsbeautifier can't fix this obfuscated ...
12
votes
2answers
3k views

Detecting recursive functions in IDA

How can I detect/mark recursive functions in IDA? Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
9
votes
3answers
21k views

x64dbg how to debug a DLL called from an application

I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
8
votes
1answer
3k views

What x86 calling convention passes first parameter via ESI?

I am looking at some x86 code, which I believe was built using a Microsoft tool chain, and am trying to figure out the calling convention used during this call: push esi ; save ESI (it gets ...
5
votes
1answer
2k views

Is not valid win32 application. Why?

Now I'm developing an unpacker and reached testing stage. Sometimes I got a message which says that unpacked file is invalid Win32 executable, however it is not informative. I would like to ask if ...
11
votes
2answers
19k views

How do I know the bytes corresponding to an instruction in Hex view in IDA?

When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?
9
votes
1answer
1k views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
8
votes
1answer
4k views

Reverse engineering apps for Windows Phone 7 and 8

How can I reverse engineer Windows Phone apps? Especially apps that are running on version 7.8 and 8 of the OS? I'm looking for tools and procedures for doing this.
8
votes
3answers
9k views

How can one extract the appended data of a Portable Executable?

How do you reliably extract appended data in a Portable Executable?
7
votes
4answers
3k views

Can AI be used to write better decompilers/disassemblers? [closed]

In the past for years I used some disassembler and tried some decompiler, nowadays there's so much talking and stuff about deep learning and AI, I wonder if some can be used with those tasks (given ...
6
votes
3answers
544 views

How can I clean up strings built at runtime?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
6
votes
2answers
8k views

What is the difference between static disassembly and dynamic disassembly?

I am told that tools like IDA Pro are static disassembly tool, and tools like OllyDbg are dynamic disassembly tool. But from the using experiences on these tools, I don't think there is any ...
4
votes
3answers
1k views

Soundness of ARM disassembly

I'm interested in formal verification of software at binary code level. Obviously, the first step would be to recover the actual assembly instructions from binaries. IDAPro can do a pretty good job ...
2
votes
2answers
3k views

Why does IDA show wrong function arguments in pseudocode?

I've open a DLL in IDA v7. In one subroutine, there is a PathAllocCombine() function. The pesudocode shows six arguments in it. But the documentations shows there are four arguments i.e. ...
2
votes
3answers
6k views

Where can I get Linux malware samples?

There have been numerous sites stated in this wonderful post that one could retrieve malware samples. However, I am having a difficult time (sorry D:) locating Linux-specific malware from those sites ...
9
votes
2answers
6k views

How to bypass ZwContinue?

During an analysis, I have found a call to ZwContinue. The executable file first gets the address of ntdll.NtContinue and stores it in the EAX register. After I step over the following assembly line, ...
6
votes
3answers
4k views

Segments in IDA. How to overcome NONAME problem

I'm disassembling a packed 16 bit DOS MZ EXE. To deobfuscate it, I've set a breakpoint in DOSbox at the end of the unpacking routine, let it run, and made a memory dump. This way I essentially got ...
2
votes
2answers
1k views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
2
votes
2answers
7k views

How to decrypt encrypted script files for a game?

I want to mod Tony hawks underground 2. I noticed that the files in a folder scripts (down the game's directory tree), are all encrypted. Where do I start if I want to decrypt them?
16
votes
1answer
113k views

How to deobfuscate an obfuscated javascript file like this? [duplicate]

I'm having serious problems deobfuscating a JavaScript file at work. This file is inside a web app that I was left in charge to improve it. The problem is that I can do it without having access to ...
24
votes
2answers
60k views

How do I extract a copy of an unknown firmware from a hardware device?

Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
42
votes
4answers
22k views

convert this x86 ASM to C?

How could this 32-bit x86 assembly be written in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, ...
31
votes
4answers
13k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
22
votes
2answers
13k views

How to reverse engineer simple usb device [windows -> linux]

I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature. I was thinking about running virtualboxed ...

15 30 50 per page
1
2
3 4 5
15