Hot answers tagged

6

IDA recognizes standard library functions based on IDA's FLIRT libraries. If IDA isn't detecting statically linked standard library functions in your disassembly, it's likely because You don't have the correct FLIRT library loaded, or IDA doesn't have a FLIRT library for the compiler that created your binary (IDA natively supports these compilers) You can ...


5

Okay, so far your question is a bit meager on the informational side, but it's intriguing. Let me start an attempt to answer it. I'll not be able to answer it, lacking the device in question. Methodology Here's what I would do. Pose as a WiFi access point (AP). Most WiFi cards will allow you to do this, if the software side allows for it as well. If the ...


5

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two types of files: Executables (Shared Objects *.so and stand-alone executables) Linkables (Object files *.o) Let us focus on executables. Dependencies resolution ...


3

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods like getIn and getOut which retrieve incoming and outgoing nodes (basic blocks), respectively. So I think using this methods should be the interface for ...


3

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like API Monitor may be more suitable.


3

To answer the main question, some C functions call WinAPI functions. Some don't. There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient WinAPI for, but can implement as pure C, so it depends on the library.


3

As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same method names in the APIs was a copyright violation, which is obviously silly.


3

I tried to decode the "AlphaNumeric" string for each movie in the Top 250 Chart. Looks like they replaced the padding symbol (they use '@' instead of '=') but, once I restored the padding, every decoded string had the same format you reported before (I will use commas, instead of '^A', as field separators): 1, [numeric value], 2, jpg, me + [numeric value]...


2

This thermostat looks identical to the Radio Thermostat CT-50. That device has an open JSON API which you can read on their website. http://radiothermostat.com


2

The answer is embarrassingly simple. Simply remove the /web part of the URL so you end up with something like this: http://music.163.com/api/search/get/ and you're good to go.


2

Smali, obviously. There's no reason to add an extra level of inefficiency and errors into your tool. Decompilation is primarily useful for making the code easier to read for humans.


2

r2pipe The best programming interface to radare2 called r2pipe. To quote from the project's Github page: The r2pipe APIs are based on a single r2 primitive found behind r_core_cmd_str() which is a function that accepts a string parameter describing the r2 command to run and returns a string with the result. r2pipe supports many programming ...


2

These constants are usually defined in the header file corresponds to the API function in use. You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the Header row of the Requirements table at the bottom. In this case, the relevant header is Winuser.h, which you could find in the SDK corresponds to the ...


2

Fire up API Monitor (with the correct architecture fitting your sample) Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can use ApiLogger (https://www.aldeid.com/wiki/SysAnalyzer/ApiLogger) Don't forget to set the Breakpoints Before Call In my example I set a filter on ...


1

Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server. I found out you can disable it by adding supress_origin=True when calling connect on the WebSocket.


1

I (a random bloke on the internet) would do these: read the EULA and terms&conditions. Do they explicitly prohibit/allow all/some parts of the API? is the API you're using internal or merely undocumented? depending on the country/jurisdiction you might not be able to use the results of RE. It can be questionable how much of an RE it is to guess the API ...


1

Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow, and it's quite unlikely the API itself is a problem. Especially with I/O, there are all the caches, drivers, and hardware itself (i.e. HDD/SSD) to consider. ...


1

this should be a comment but the content is long for a comment so an answer your statement /subsequent edit / that header files does not contain names is not correct :\>echo %cd% E:\ewdk\Program Files\Windows Kits\10\Include\10.0.10586.0\um :\>grep -irn -B 3 -A 3 GetLocalTime * sysinfoapi.h-180-WINBASEAPI sysinfoapi.h-181-VOID sysinfoapi.h-182-...


1

There is msdn-crawler, created by Zynamics and then amended by FireEye. I was not able to get it working but maybe you'll have more luck. Alternatively, you can find an old MSDN CD with CHM files, decompile them to HTML and parse that.


1

A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\Windows\CurrentVersion\Component Based servicing\Packages. WMI has its own datastores which are probably less useful to you.


1

So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.


1

Where I would start... Start by reading about QR codes. I would guess that QR codes aren't that far off from Snapcodes, but Snapcodes probably carry very little information. As in, they only contain a pointer to a Snapchat ID. A Micro QR code can hold 35 characters, which is probably about the capacity of a Snapcode and rather than an anchor point you have ...


Only top voted, non community-wiki answers of a minimum length are eligible