Hot answers tagged

6 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
user avatar
  • 76
5 votes
Accepted

Ghidra Control Flow Graph

I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods ...
user avatar
3 votes

How to use API monitor on specific process

Fire up API Monitor (with the correct architecture fitting your sample) Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can ...
user avatar
  • 51
3 votes

What is the relationship between the Windows API and the C run time library?

To answer the main question, some C functions call WinAPI functions. Some don't. There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient ...
user avatar
3 votes

How to see ReadFile results with ProcMon

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
user avatar
  • 34.9k
3 votes

How to print all functions of a binary using radare2 c/c++ API

r2pipe The best programming interface to radare2 called r2pipe. To quote from the project's Github page: The r2pipe APIs are based on a single r2 primitive found behind r_core_cmd_str() which ...
user avatar
  • 8,659
3 votes

What are ways to find Windows constant macro definitions?

These constants are usually defined in the header file corresponds to the API function in use. You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the ...
user avatar
  • 31
3 votes

cost, time and tools had Google reverse-engineered Java packages?

As I understand it, they didn't reverse engineer anything. They wrote an independent implementation based on reading the documentation of the APIs. Oracle's contention was that simply having the same ...
user avatar
  • 1,972
3 votes

Finding how IMDB creates its image codes

I tried to decode the "AlphaNumeric" string for each movie in the Top 250 Chart. Looks like they replaced the padding symbol (they use '@' instead of '=') but, once I restored the padding, every ...
user avatar
  • 143
2 votes
Accepted

NetEase Cloud Music: Getting search results in API

The answer is embarrassingly simple. Simply remove the /web part of the URL so you end up with something like this: http://music.163.com/api/search/get/ and you're good to go.
user avatar
2 votes
Accepted

Smali vs Decompilation for malware detection in apk files

Smali, obviously. There's no reason to add an extra level of inefficiency and errors into your tool. Decompilation is primarily useful for making the code easier to read for humans.
user avatar
  • 1,972
2 votes

advapi32.dll changes name of function during forwarding of exports

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption. In the export directory entries, if a ...
user avatar
1 vote

Decoding API response of unknown encoding?

Your best bet will probably be to debug the application that sends this API request. It looks like base64, so you could also decode it. I did that and the result was not a proper string, so this is ...
user avatar
1 vote
Accepted

finding rest api urls after decompiling apk

They might be stored encoded/encrypted and decoded/decrypted in runtime, you can validate this if you can capture any API calls in runtime (Not sure if you tried this, but maybe give it a try, in that ...
user avatar
1 vote

Reverse Engineering API's of Browser games

This depends on the implementation of the game in the browser. The API is likely a RESTful API and the format for data exchange is likely JSON. A modern full stack web development course will often ...
user avatar
1 vote
Accepted

Accessing Call String of CALLOTHER Pcode Instruction via Java API?

There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java basically: op = ...
user avatar
  • 391
1 vote
Accepted

How to extract static API sequences of a PE file?

That should be rather easy to solve in IDA with IDAPython or IDC. I remember plugins that name functions based on API calls happening inside for a quick overview, one example here: Finding all API ...
user avatar
1 vote

learning detour and code injection

Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. ...
user avatar
  • 51
1 vote

learning detour and code injection

Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.
user avatar
1 vote

WebSocket debugging in Javascript app gives "401 Unauthorized"

Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server. I ...
user avatar
1 vote
Accepted

Reverse Engineering Grocery Software API

I (a random bloke on the internet) would do these: read the EULA and terms&conditions. Do they explicitly prohibit/allow all/some parts of the API? is the API you're using internal or merely ...
user avatar
  • 223
1 vote

How to debug slow Windows API calls?

Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow,...
user avatar
  • 34.9k
1 vote

Reverse-engineer digest http authentication

So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.
user avatar
1 vote
Accepted

Parseable Windows API documentation

this should be a comment but the content is long for a comment so an answer your statement /subsequent edit / that header files does not contain names is not correct :\>echo %cd% E:\ewdk\...
user avatar
  • 15k
1 vote

Parseable Windows API documentation

There is msdn-crawler, created by Zynamics and then amended by FireEye. I was not able to get it working but maybe you'll have more luck. Alternatively, you can find an old MSDN CD with CHM files, ...
user avatar
  • 34.9k
1 vote
Accepted

which windows API called when execute wmic qfe get hotfixid command?

A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\...
user avatar
  • 972
1 vote

Generating Snapchat Snaptags ("QR" Codes)

Where I would start... Start by reading about QR codes. I would guess that QR codes aren't that far off from Snapcodes, but Snapcodes probably carry very little information. As in, they only contain ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible