All Questions

Filter by
Sorted by
Tagged with
4
votes
1answer
9k views

Reverse engineering flexlm license management

I have a 3D driver from the early 90's for Solaris 2.5-2.6 Sparc that uses flexlm to handle license management. How would I go about either circumventing or removing it for computer archeology/hobby ...
11
votes
5answers
4k views

Is it legal to sell clean room engineered products?

The clean room technique is : First, a team of engineers study the software and describe everything it does as completely as possible without using or referencing any actual code. Then, a ...
49
votes
12answers
4k views

Where to find information about a file format?

Let's say I found 'some' file (might be an executable, might be data, or something else) and want to run or read it. I open this file in a text editor, but the format isn't readable. Examples include: ...
11
votes
2answers
3k views

What techniques are used in reverse engineering embedded firmware?

This question is related to another question I posted here. I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. ...
5
votes
3answers
1k views

Linux protectors: any good one out there?

I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...
14
votes
4answers
5k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
0
votes
4answers
3k views

Where to find a hard crackme [closed]

I'd like to improve my skill as a reverse engineer. And thus I am looking for a location to find these.
21
votes
4answers
6k views

What is “overlapping instructions” obfuscation?

I analyzed some binaries in x86/x86-64 using some obfuscation tricks. One was called overlapping instructions. Can someone explain how does this obfuscation work and how to work around?
33
votes
5answers
25k views

Open source GUI tool for decomposing a PDF

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
19
votes
2answers
4k views

What techniques are used in reverse engineering a serial protocol?

I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. A key piece of data we need is the current bus route a given ...
11
votes
3answers
8k views

Reverse engineer an old DOS QBasic executable

I recently decided to try my hand at reverse engineer an old DOS text based game that was coded in QBasic. I found some info online about old DOS games disassembly but mostly for Wacom compiled C/C++ ...
19
votes
4answers
6k views

How common are virtualized packers in the wild?

I'm just getting into the RE field, and I learned about virtualized packers (like VMProtect or Themida) in a class about a year ago. How often is malware in the wild really packed with virtualized ...
11
votes
2answers
5k views

How does BinDiff work?

I would like to know what are the basic principles (and maybe a few things about the optimizations and heuristics) of the BinDiff software. Does anyone have a nice and pedagogic explanation of it?
4
votes
1answer
1k views

3D control-flow graphs in IDA

Is there any way to leave 2D flow chart graphs and go to 3D model? I mean something like that: Usual 2D graph: 3D graph: The only one solution I've seen is using UbiGraph + Linux on VM (to use ...
17
votes
3answers
10k views

Are there any tools or scripts for identifying compression algorithms in executables?

I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
9
votes
2answers
1k views

Is there an easy way to detect if the SSDT has been patched from a memory dump?

The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
7
votes
1answer
239 views

How can I work out which PCB layer a via goes to, without destroying the board?

I'm trying to reverse engineer some boards that have multiple layers, but can't figure out any way of discovering which layer certain vias go to. Unfortunately I can't destroy the board with ...
30
votes
5answers
51k views

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
9
votes
1answer
1k views

Draw circuit of a multilayer PCB

I have found a multilayer PCB of which I need to draw the circuit. At first, I tried to find the circuit on the internet using part numbers, but I did not get any result. The PCB is from a very old ...
69
votes
9answers
76k views

Analyzing highly obfuscated JavaScript

I was recently analyzing a web page that contained some highly obfuscated JavaScript - it's clear that the author had went through quite a bit of effort to make it as hard to understand as possible. I'...
18
votes
1answer
7k views

What is the state of art in LLVM IR decompilation?

LLVM IR is a fairly high-level, typed bitcode which can be directly executed by LLVM and compiled to JIT on the fly. It would not surprise me if a new executable format or programming language was ...
18
votes
4answers
21k views

Determine Encryption Algorithm

I'm analyzing some software that appears to encrypt its communications over the network, but it does not appear to be SSL. How can I easily determine what encryption algorithm its using, and maybe ...
15
votes
1answer
2k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
12
votes
3answers
3k views

Thread Injection on OSX

Much reverse engineering has been done on Windows over the years leading to great undocumented functionality, such as using NtCreateThreadEx to inject threads across sessions. On OSX the topic of ...
6
votes
1answer
312 views

Available tools & techniques for locating sections of interest in a binary executable

If I'm trying to figure out how a program accomplishes a certain task or how it works with an unknown data structure or format, what techniques and tools can I employ to quickly and efficiently locate ...
8
votes
1answer
909 views

Context-Free Grammar from Samples

Is there a tool available that will generate a grammar from a corpus of sample inputs, similar to what HotFuzz does for network protocols? For example, given a collection of MP3 files, I'm looking ...
11
votes
2answers
811 views

How do I determine code coverage when fuzzing

Let's say I'd like to begin fuzzing Acme Corp's PDF Reader. I'd like to try to follow what Miller did by downloading a bunch of benign PDFs and mutate them. Miller began by reducing his corpus of ...
12
votes
3answers
2k views

How to prevent use of Resource editors

There are variety of tools that allow editing the resources of Windows executables. These tools allow a very easy interface for changing the programs look and feel. Replacing icons, text, menus can be ...
35
votes
3answers
11k views

How can I reverse optimized integer division/modulo by constant operations?

When compiling a division or modulo by a constant, my compiler (LLVM GCC) generates a series of instructions that I don't understand. When I compile the following minimal examples: int mod7(int x) { ...
10
votes
2answers
2k views

Debugging EXE with TLS

How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.
6
votes
1answer
539 views

Firmware-Mod-Kit Increases Size

I love using firmware-mod-kid to modify SoHo router firmware. The problem I encounter is that it often bloats the size of the image. It appears this happens during the mksquashfs step. If I'm just ...
93
votes
18answers
118k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
5
votes
1answer
2k views

What are good Windows anti-debug references? [closed]

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
17
votes
4answers
4k views

How can you reliably unpack a Windows driver manually?

When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
6
votes
2answers
23k views

What happens when a DLL is added to AppInit_DLL

I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
6
votes
2answers
2k views

State of the Art Fuzzing Framework [closed]

I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer. It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to ...
29
votes
4answers
30k views

How do I identify and use JTAG?

I'm a software guy through and through. But periodically when I'm taking apart hardware I know to look for JTAG ports and RS232 ports. So far I've always been lucky and have been able to solder on ...
54
votes
7answers
119k views

What is a good Java decompiler and deobfuscator?

I am using JD-GUI to decompile Java JAR files, but the problem is that it leaves many errors, such as duplicate variables which I have to fix myself and check to see if the program still works (if I ...
0
votes
2answers
6k views

How do you deobfuscate Java classes? [closed]

What tools or methodology do you use to de-obfuscate Java classes? I know you can theoretically decompile, modify and recompile, but that's only you fully trust a Java decompiler (and none is ...
8
votes
2answers
262 views

REIL Implementations and Adoption?

Apart from BinNavi (A commercial product from the creators of REIL), I am only aware of one project using REIL, which implements a tiny handful (mov/add/sub/inc/jmp) of the translators to convert x86 ...
8
votes
1answer
3k views

Encrypting text in binary files

Text strings are usually easily read in a binary file using any editor that supports ASCII encoding of hexadecimal values. These text snippets can be easily studied and altered by a reverse engineer. ...
4
votes
1answer
150 views

How to investigate function calls across a batch of targets?

Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, ...
6
votes
1answer
128 views

Which format/tool to store 'basic' informations?

It's really a productivity bottleneck when various analysis tools can't share information. What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
25
votes
6answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
4
votes
1answer
234 views

Safari windows debugging symbols

Apple developer network site has a small guide about setting up debugging symbols server for Safari browser on Windows. But it doesn't work. First, the link to actual symbols server gets redirected ...
5
votes
1answer
250 views

What is the scalability of state of the art static binary analysis techniques?

What is the largest program that has been analyzed by a semantics-based static binary analysis? By semantics-based, I mean an analysis that examines the meaning of the program, and does not simply ...
17
votes
3answers
3k views

Automated tools for file format reverse engineering?

Are there any tools available to help automate the process of reverse engineering file formats? In particular, I'm interested in tools that use dynamic analysis of an application to parse the format, ...
7
votes
3answers
28k views

Find out a Java class file's compiler version

I have a java class file. How do I find out the version of the compiler used to compile this file? I'm on Ubuntu Server 12.04.
6
votes
1answer
871 views

Importing external libraries in Hopper scripts?

Can external libraries be used in Hopper scripts? I'd like to add PDB support to Hopper using pdbparse, but I haven't been able to get it to use external libraries. Alternatively, I suppose one could ...
11
votes
3answers
12k views

How should I determine the format of this audio file?

I have an audio file in an unknown format. How should I try to determine its format ? Also, is it possible to do this by manual observation and not using any automated tool ?

15 30 50 per page