All Questions

Filter by
Sorted by
Tagged with
11
votes
3answers
12k views

How should I determine the format of this audio file?

I have an audio file in an unknown format. How should I try to determine its format ? Also, is it possible to do this by manual observation and not using any automated tool ?
7
votes
1answer
782 views

What is your vulnerability discovery process? [closed]

I myself am a static analysis guy; I mostly gave up dynamic reverse engineering ten years ago. So these days, my process is usually to locate where my input enters the module that I am interested in, ...
29
votes
2answers
10k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
5
votes
4answers
369 views

Secure RE-ing a PHP script

I have a very messy PHP script of which I need to determine the function. I can't quite understand the code, it's really messy. Now I thought that I perhaps could reverse engineer this script. What I ...
7
votes
1answer
934 views

Reverse engineering XKCD 1190

The latest (as of now) comic is titled "Time". It's a standard-looking comic though without much action, but the picture's alt title says "Wait for it.". I waited but nothing happened (tried in Opera ...
20
votes
3answers
1k views

What are the qualitative differences in reverse engineering x64/Win64 code versus x32/Win32 code?

Many professional reverse engineers spend their days looking at 32-bit code compiled for Windows, and familiarity breeds proficiency. What are the high-level differences between reverse engineering 64-...
12
votes
1answer
2k views

Treating independent code as a function in IDA Pro

When reverse engineering programs, I often find functions like the one below. This function in particular has a set of nested if/else blocks (pink boxes) which would typically be fairly easy to ...
4
votes
1answer
45 views

Exposing the connectors in a package on package

To analyze the communication protocol between two chips running unknown firmware, we eavesdrop into the communication bus between the chips. In the ideal case, this is “just” a matter of matching ...
6
votes
1answer
1k views

Determining communication protocol

I have two chips that are connected using two lines. One appears to be the clock line (50% duty cycle), but it doesn't have to be (sometimes constant high). The other line appears to be totally random,...
7
votes
2answers
2k views

Determining RS232 bus settings

I have a device with two chips without part numbers. It looks like their using RS232 for serial communication (proper setup, right voltage), but I do not know the bus settings (speed, parity, etc.). ...
16
votes
4answers
4k views

How to recover variables from an assembly code?

Assuming we have an assembly code, what are the known techniques that could be used to recover the variables used in the original high-level code ? Edit: By recovering variables, I do not mean ...
18
votes
7answers
8k views

Are there ready-to-go reverse engineering VMs?

In computer forensics & pentesting, there are live CDs that have a bunch of tools installed. This makes it easy to boot a machine and have a variety of tools for examining the HDD (for example). ...
8
votes
1answer
4k views

Reverse engineering apps for Windows Phone 7 and 8

How can I reverse engineer Windows Phone apps? Especially apps that are running on version 7.8 and 8 of the OS? I'm looking for tools and procedures for doing this.
62
votes
6answers
30k views

Where to find (free) training in reverse engineering? [closed]

Can someone give a list of websites with good (and free) reverse engineering training exercises ?
25
votes
2answers
18k views

How to reverse engineer a proprietary data file format (e.g. Smartboard Notebook)?

How should I begin trying to reverse engineer this file format? The only thing I can think of is saving a simple file, and then dig in with a hex editor. But since the file format may be some kind of ...
9
votes
2answers
404 views

What is a correct disassembler?

A disassembler is supposed to produce a human readable representation of the binary program. But the most well known techniques: linear sweep and recursive traversal (see this comment for more) are ...
6
votes
2answers
293 views

How should I go about trying to figure out the programming language that was used?

I have an executable file and I would like to figure out which programming language was the source code written in. The first step would be to use a disassembler. What should be done after that ? ...
66
votes
3answers
11k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
8
votes
1answer
585 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
8
votes
3answers
555 views

How to differentiate from different hex files of different families of microcontrollers?

Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or ...
2
votes
1answer
202 views

How do I identify the content management system used by a website?

If I go to a random blog or informational website say, having pages with information, a sidebar with an overview of the archives. I know that this website is built with a CMS. How can I get to know ...
10
votes
1answer
4k views

How to see what compiler made PIC ASM code?

I extracted a .hex file from a PIC16F88. For example: :020000040000FA :100000008F3083160F0570388F009B0183129F017C :1000100083169F0107309C0005108312051483127C :...
6
votes
1answer
235 views

How should I go about investigating an IC's functionality without destroying it?

I found a 14 pin integrated circuit with no visible markings. I have no information about its functioning. How should I go about trying to explore its functionality without destroying it ? I have a ...
13
votes
5answers
2k views

Decryping TLS packets between Windows 8 apps and Azure

In Windows Store application development for Windows 8, there is a class called remoteSettings that lets a developer store batches of data so that the user will have access to it across several ...
6
votes
1answer
825 views

Canonical method to circumvent the ZwSetInformationThread antidebugging technique

I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
125
votes
14answers
124k views

Where can I, as an individual, get malware samples to analyze?

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users. The bottleneck here for people aspiring to break ...
14
votes
3answers
1k views

What different UPX formats exist and how do they differ?

Recently I asked a question about detecting UPX compression. 0xC0000022L wanted to know if it was plain UPX. However until that point I only was aware of plain UPX. So my question is: What versions/...
9
votes
2answers
624 views

How can I analyze a program that uses a JIT compiled code?

A lot of code I encounter today has a considerable amount of code generated at runtime, making analysis extremely laborious and time consuming. Is there any way I can create symbolic names for the ...
11
votes
1answer
378 views

What kind of information can i get from reverse engineering an integrated circuit package

I've seen numerous examples of people essentially dissolving away the resin from integrated circuits in boiling high strength acid in order to expose the raw silicon chip underneath. My general ...
14
votes
2answers
917 views

Are there any metrics for code obfuscation?

Is source code obfuscation quantifiable ? Are there any metrics that measure the degree of obfuscation in a source file ?
45
votes
8answers
31k views

How do I add functionality to an existing binary executable?

I want to add some functionality to an existing binary file. The binary file was created using gcc. Do I need to decompile the binary first, even though I sufficiently understand the functioning of ...
8
votes
2answers
2k views

Obfuscating Windows Executables

GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h. ...
32
votes
3answers
21k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
14
votes
3answers
9k views

Are hardware dongles able to protect your software?

Various software companies distribute their software with hardware security, usually a dongle which must be mounted in order for the software to operate. I don't have experience with them, but I ...
6
votes
2answers
412 views

Viewing MSSQL transactions between closed-source application and server

I am reversing a closed-source legacy application that uses Microsoft SQL Server (2005) and I would like to find out precisely what queries are being executed in the background. I understand that it ...
7
votes
5answers
992 views

Is it possible to hide the details of which compiler was used?

The compiler adds system information to the output/object file that is created on compilation. Is there any compiler option that can prevent this information from being added? Can the compiler ...
7
votes
4answers
13k views

How to check if an ELF file is UPX packed?

I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?
35
votes
5answers
98k views

How do you reverse engineer an EXE "compiled" with PyInstaller

Having recently watched/read a presentation given by Dave Kennedy at DEF CON 20 [PDF], I'd like to know how to decompile a Python script compiled with PyInstaller. In his presentation, he is creating ...
5
votes
1answer
385 views

Should I keep parenthesis information while source modeling?

I'm developing an AST model for a source code reverse engineering platform. My question is, should I keep parenthesis data in my AST? Because I have everything in a tree, I already know which ...
9
votes
3answers
4k views

Can you decompile Actionscript 3 on a Mac?

Reverse engineering SWFs with ActionScript 3 on a Mac typically requires a Windows VM and a lot of copying and pasting. There are some good decompilers for Windows such as as3extractor but I haven't ...
10
votes
1answer
614 views

Tracing message passing instead of a call stack

In a microkernel, much of the interesting functionality happens not with traditional function calls, but instead through message passing between separate entities. Is there a structure that OS ...
37
votes
9answers
58k views

How does one reverse engineer a SWF file?

What tools and techniques exist to either decompile or analyze the bytecode in a SWF file? What resources are available to the reverse engineer to learn more about SWF internals?
10
votes
1answer
9k views

Get code from protected PIC

I have a PIC18F4550 from an old device and I need to see the code. I tried reading it using my ICD3 programmer, but the chip seems to have its code protected. How can I get the code anyway?
35
votes
3answers
31k views

How do I figure out what is burned on an Arduino ROM?

I have an Arduino Uno Rev3. I would like to extract and find out what code is burned on the ROM of the micro-controller board. How do I extract the code from the board? How do I figure out the ...
8
votes
3answers
281 views

How to manage/revert to specific OS versions for effective patch diffing?

For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now ...
29
votes
1answer
8k views

What kinds of steps can I take to make my C++ application harder to reverse engineer?

If I am building a C++ application and I want to make it more difficult to reverse engineer, what steps can I take to do this? Does the choice of compiler affect this? What about compiler flags, ...
6
votes
4answers
3k views

Unpacking binary statically

Say I have a binary that I'm not able to execute (for example it runs on some device that I don't have one of), but I can disassemble it. I can get the docs on the architecture. (It's MIPS little ...
-8
votes
1answer
1k views

How can I turn .deb files back to .tar for reuse with other Linux distros? [closed]

We all know that Ubuntu is the most popular Linux distro today with plenty of application currently being developed for it. But then I use Fedora and some use other distros but still liked to have the ...
8
votes
1answer
145 views

AMD64 compiler optimizations with register manipulations

AMD64 (aka x86-64 or x64) registers can be accessed 8, 16, 32 or 64 bits at a time. When reading a disassembly listing, what register operations are not straightforward? For example, when an ...
34
votes
5answers
10k views

How can I analyse an executable with no read permission?

I have a binary on a Linux (Kernel 2.6) which I can execute, but can't read (chmod 0711). Therefore no static analysis is possible. user1: $ ls -l bin -r-s--x--- user2 user1 bin user1: $ file bin ...

15 30 50 per page