7
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 86
6
votes
Accepted
Ghidra Control Flow Graph
I'm looking for the same thing and for now I found the class PcodeSyntaxTree having a method called getBasicBlocks(), which returns an array of PcodeBlockBasic elements. This second class has methods ...
3
votes
How to use API monitor on specific process
Fire up API Monitor (with the correct architecture fitting your sample)
Set the API hooks you need. This highly depends on what you are looking for. To see which APIs your exe is usually using you can ...
- 51
3
votes
How to print all functions of a binary using radare2 c/c++ API
r2pipe
The best programming interface to radare2 called r2pipe.
To quote from the project's Github page:
The r2pipe APIs are based on a single r2 primitive found behind
r_core_cmd_str() which ...
- 8,919
3
votes
What are ways to find Windows constant macro definitions?
These constants are usually defined in the header file corresponds to the API function in use.
You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the ...
- 31
3
votes
What is the relationship between the Windows API and the C run time library?
To answer the main question, some C functions call WinAPI functions. Some don't.
There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient ...
- 263
3
votes
How to see ReadFile results with ProcMon
TLDR; you can't.
ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
- 36.4k
2
votes
Accepted
Smali vs Decompilation for malware detection in apk files
Smali, obviously. There's no reason to add an extra level of inefficiency and errors into your tool. Decompilation is primarily useful for making the code easier to read for humans.
- 2,002
2
votes
advapi32.dll changes name of function during forwarding of exports
Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.
In the export directory entries, if a ...
- 31
2
votes
IDA API: Writing a plugin - How can I ensure that analysis has completed?
Arrange your plugin like this:
# your imports
import idc
#...
# wait for auto-analysis to complete
def PLUGIN_ENTRY():
idaapi.auto_wait()
return yourthing()
###do your thing
###
def ...
- 1,797
2
votes
Accepted
finding rest api urls after decompiling apk
They might be stored encoded/encrypted and decoded/decrypted in runtime, you can validate this if you can capture any API calls in runtime (Not sure if you tried this, but maybe give it a try, in that ...
- 168
1
vote
Decoding API response of unknown encoding?
Your best bet will probably be to debug the application that sends this API request.
It looks like base64, so you could also decode it. I did that and the result was not a proper string, so this is ...
- 11
1
vote
Reverse Engineering API's of Browser games
This depends on the implementation of the game in the browser.
The API is likely a RESTful API and the format for data exchange is likely JSON.
A modern full stack web development course will often ...
- 878
1
vote
Accepted
Accessing Call String of CALLOTHER Pcode Instruction via Java API?
There is a ghidra_script that current does this, see https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/ghidra_scripts/MarkCallOtherPcode.java
basically:
op = ...
- 441
1
vote
Accepted
How to extract static API sequences of a PE file?
That should be rather easy to solve in IDA with IDAPython or IDC.
I remember plugins that name functions based on API calls happening inside for a quick overview, one example here:
Finding all API ...
- 1,391
1
vote
learning detour and code injection
Detouring is more or less a patching of the .text section inside of a program. It's practically more or less hacking, you're rerouting a program to do what you want it to do with your own function. ...
- 81
1
vote
learning detour and code injection
Practical Binary Analysis by Dennis Andriesse is great, the examples are mostly done on Linux but the concept is still the same for Windows.
- 63
1
vote
WebSocket debugging in Javascript app gives "401 Unauthorized"
Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server.
I ...
- 21
1
vote
Accepted
Reverse Engineering Grocery Software API
I (a random bloke on the internet) would do these:
read the EULA and terms&conditions. Do they explicitly prohibit/allow all/some parts of the API?
is the API you're using internal or merely ...
- 233
1
vote
How to debug slow Windows API calls?
Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow,...
- 36.4k
1
vote
Reverse-engineer digest http authentication
So finally, I used Cycript and attached to the running app process, and consequently intercepted the private key in runtime.
- 121
1
vote
Generating Snapchat Snaptags ("QR" Codes)
Where I would start...
Start by reading about QR codes. I would guess that QR codes aren't that far off from Snapcodes, but Snapcodes probably carry very little information. As in, they only contain ...
1
vote
Accepted
Parseable Windows API documentation
this should be a comment but the content is long for a comment so an answer
your statement /subsequent edit / that header files does not contain names
is not correct
:\>echo %cd%
E:\ewdk\...
- 16.3k
1
vote
Parseable Windows API documentation
There is msdn-crawler, created by Zynamics and then amended by FireEye. I was not able to get it working but maybe you'll have more luck.
Alternatively, you can find an old MSDN CD with CHM files, ...
- 36.4k
1
vote
Accepted
which windows API called when execute wmic qfe get hotfixid command?
A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\...
- 1,022
Only top scored, non community-wiki answers of a minimum length are eligible