All Questions

Filter by
Sorted by
Tagged with
28
votes
4answers
38k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
20
votes
1answer
30k views

How to dump flash memory with SPI?

Often flash memory is connected via SPI (Serial Peripheral Interface Bus) to a processing unit like an ARM core or a micro controller. How can one dump the memory? Can there be protection mechanisms? ...
20
votes
4answers
45k views

How can DLL injection be detected?

In this question on DLL injection multiple answers mention that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. It seems desirable to be able to detect DLL ...
17
votes
4answers
4k views

How can you reliably unpack a Windows driver manually?

When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
17
votes
6answers
2k views

In what industries is [code] reverse engineering used?

While we all know what fun reverse engineering of code can be, I am wondering what legitimate industries, besides the anti-X industry, reverse engineer code? While this may sometimes be needed in many ...
28
votes
4answers
19k views

What is a good tools to reverse the effects of Minify on JavaScript?

Are there any scripts and/or online tools that can reverse the effects of minification? I'm specifically looking to unminify a minified JavaScript file. Variable renaming is not a big issue, I want ...
27
votes
8answers
45k views

Decompiling a 1990 DOS application

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
18
votes
3answers
5k views

Anti-debug techniques on Unix platforms?

I am trying to scan all possible techniques to disrupt the usage of a debugger on a Unix platform (ie POSIX and a bit more). I am thinking about techniques such as the PTRACE test at the beginning of ...
17
votes
4answers
12k views

How to generate the call graph of a binary file?

I have a non-stripped ELF binary for which I want to create a call graph as a dot file. Is there such a tool which generates the call graph? EDIT: Is there away in addition to the conventional call ...
21
votes
1answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
14
votes
1answer
11k views

Bypassing certificate pinning in android

I've spent the past 4 months trying to bypass certificate pinning in the Facebook android application so I can understand how it works, but I'm having trouble doing so. I have tried using android ...
14
votes
3answers
20k views

Difference between DllMain and DllEntryPoint

I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following: Run it with ...
24
votes
7answers
79k views

Decompiling .pyc files

Does anybody have a suggestion for (non commercial) software to decompile "byte-code" Python (.pyc) files? Everything I've found seems to break...
13
votes
4answers
6k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
14
votes
3answers
2k views

How exploit writers find bugs in Java Machine?

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/) The victimn should visit the ...
12
votes
5answers
28k views

Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?

Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
3
votes
1answer
125k views

Translate ASSEMBLY to C [closed]

How to translate code assembly to C?? I am very poor in assembly code. EG: mov dword ptr [ebp+data], 612E2F47h mov dword ptr [ebp+data+4], 5B2A451Ch mov dword ptr [ebp+data+8], 6E6B5E18h ...
14
votes
2answers
4k views

Using QEmu monitor interface to extract execution traces from a binary?

My original point was to build something a bit more powerful and generic than a PTRACE system call for Linux platforms. The problem with PTRACE is that it only run on your own system and architecture. ...
11
votes
2answers
2k views

Protect data stored in binary

Let's say I've some function(i.e. hash function), that generates value from input seed and some precomputed hash values, that are stored somewhere in binary. What are the possible approaches for: ...
11
votes
1answer
5k views

Are the EU laws preventing reverse engineering of software products?

Would it be legal to decompile and/or reverse engineer a commercial java JAR file to view the inner workings of a library in order to write original code for use with the library in the EU or UK?
9
votes
3answers
8k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
8
votes
1answer
5k views

How to make radare2 work for a large binary?

I compiled cpython with debugging headers and I want to perform the following analysis using radare2. The problem I encounter is that it takes forever (at least 27 hours) to perform the aaa (...
5
votes
4answers
5k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
13
votes
1answer
4k views

Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?

I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
11
votes
1answer
2k views

Delphi Pascal Try..Except..Finally block

I'm having trouble reverse-engineering a specific Delphi Pascal .exe (old vsn., pre-1995 so probably v.3). From the system calls I understand this is probably a try..except..finally block, but I am at ...
8
votes
1answer
9k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
8
votes
2answers
14k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
7
votes
1answer
9k views

Reverse Engineering of a packet encryption function of a game

I am trying to make a game server emulator for a specific MMORPG (Perfect World). I know the basics of how the network of the game works and the structure for some packets, but they all are encrypted, ...
7
votes
1answer
5k views

Recursive traversal disassembling with Radare2?

I am trying the recursive traversal disassembler of the radare2 tool. But, I cannot use it properly. First, according to the radare2 manual, we can use recursive traversal disassembler by using the ...
7
votes
2answers
5k views

Do I need to have IDA Pro to use the BinDiff tool?

I'm trying to learn how to use BinDiff tool, but I can't figure out how to open two binaries to do the comparison. While skimming through their manual, it seems like I need to have IDA Pro for that. ...
4
votes
2answers
2k views

How to import Windows DDK headers into IDA?

Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files. However, there are ...
3
votes
1answer
491 views

How can I determine if a piece of code is an encryption algorithm?

I am trying to reverse engineer a malware, and came across a piece of code that I suspect is an encryption/decryption procedure, however I do not know for sure. I can recognize that it extracts its ...
15
votes
3answers
4k views

What are nullsub_ functions in IDA?

In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction). So, what are those and why are ...
6
votes
1answer
671 views

Recompiling/optimizing redundant code to make analysis easier

I'm analyzing an application created with Borland Delphi but the poor quality of the object code makes analysis difficult and tedious. The code is so convoluted and inflated with superfluous ...
4
votes
1answer
2k views

Stack buffer size is different between C and ASM

Given that function: void vuln( char * arg ) { char buf[256]; strcpy(buf, arg); } Disassembled in: 0x0804842b 55 push ebp ...
16
votes
2answers
2k views

Is there an actively maintained collaboration plugin for IDA?

There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)? These are the tools that I'm aware of, ...
12
votes
5answers
3k views

Artifacts similar to "@YAXPAX@" within memory and IDA sessions

When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention? I believe theses strings are symbol ...
11
votes
3answers
2k views

Why is JMP used with CALL?

I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> I am not an expert in Assembly. I know that CALL ...
11
votes
5answers
6k views

How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?

I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is: Unable to enumerate locals, HRESULT 0x80004005 ...
9
votes
1answer
9k views

Reverse Engineering program written in Python, compiled with "freeze"

I am attempting to reverse engineer an EXE compiled using the utility "Freeze" or "pfreeze" that ships with Python (not to get confused with "cx_freeze"). Inside the EXE there is an array of memory ...
8
votes
3answers
1k views

How can I use DynamoRIO or something similar in Linux kernel space?

I've found some universities that are porting DynamoRIO (or something very similar) to Linux kernel space, but the code doesn't seem to be available. Is there a resource I am unaware of? Here's an ...
8
votes
1answer
4k views

Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better

When I decompile using IDA PRO I get code which could look like both of these Understanding the __PAIR__ macro. Macro itself. // The following definition is not quite correct because it always ...
7
votes
2answers
541 views

Backblaze 16-bit checksum ("bzsanity")

I use Backblaze to back up my computer. You restore files from your backups by selecting files to restore, which are then packed into large zip files. Of course, it's fairly rare to be able to ...
6
votes
2answers
6k views

Disassembly shows `LEA` with RIP?

When I disassemble this instruction using pad on Radare I get an LEA with rip [0x00000000]> pad 8d 15 c8 90 04 08 lea edx, [rip + 0x80490c8] I got this instruction from this post here I'm ...
6
votes
2answers
2k views

(linux) How to debug a "debugger"?

I'm trying to understand a program. This programm implements an antidebug technique. From what I've understand so far, the father ptrace a forked process. An the child does something like that: ...
6
votes
2answers
566 views

Which instrument is effective in discovering carrier frequency?

If two devices have wireless interconnection, how to detect carrier frequency? Range may vary in all radio, from FM, GSM to Wi-Fi and WiMax. Which tools are effective for doing this? Which one is ...
5
votes
3answers
6k views

RE Compressed backup file,router linux based so is it compresed with zlib?

so I have backup from my router its zte zxv10h201l and its linux based but I can not identify type of compression of this file. Here is couple of first "lines" of it 00000000 99 99 99 99 ...
5
votes
1answer
3k views

Why was my memory breakpoint not triggered in OllyDbg?

I am currently battling this protection on an 32-bit executable. At some point during it's runtime, the protection gets the address of DbgUiRemoteBreakin and writes a JMP to ExitProcess as an anti-...
4
votes
3answers
4k views

Does IDA support remote debugging in their Freeware Version?

I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
4
votes
3answers
18k views

How to view strings in an executable?

I have been playing around, searching for Strings "Please wait!!!" "Done!!" Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this File pos Mem ...

15 30 50 per page
1 2
3
4 5
16