Hot answers tagged

7

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...


4

Ghidra is a great tool that supports decompile for many CPU architectures.


4

import binascii print(binascii.hexlify(b" a nice nice long string")) print(binascii.hexlify(b"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")) you can find both the string in your listing b'2061206e696365206e696365206c6f6e6720737472696e67' b'41414141414141414141414141414141414141414141414141414141414141' first string 0x0000000000000714 <+26>: movabs rax,...


4

Program entry point != main You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) environment. From Microsoft's CRT Initialization: By default, the linker includes the CRT library, which provides its own startup code. This startup code ...


3

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF specification to know how every file in that format looks like, which sections it consists of and how they are located in the process image at the runtime. Even when ...


2

I think this is a strcmp function which was compiled without optimization and is really inefficient. Here is why: The function only uses r0 and r1 which are first and the second parameter. Both parameters are pointer because they are dereferenced All memory access are byte long Read bytes are compared against '\0' Read bytes are compared using the ...


2

v2 = -1640531527; C:>python -c "print hex(0x100000000-1640531527)" 0x9e3779b9L google 0x9e3779b9L first hit TEA algorithm google python tea first hit pytea quoting from the site below from pytea import TEA key = os.urandom(16) print('key is', key) content = 'Hello, 你好' tea = TEA(key) e = tea.encrypt(content.encode()) print('encrypt hex:', e.hex()) ...


2

I would like to extend the .text section and insert [code]. If there's a better method of inserting new functionality into an ELF I'm all ears. Techniques for adding arbitrary code to ELF files were pioneered by Linux virus writers beginning all the way back in the 1990s. In comparison with the methods they developed, as well as with more modern techniques,...


2

Not a vulnerability list by itself, but SEI CERT C Coding Standard lists many “dangerous” code patterns which can be a source of vulnerabilities. The book The Art of Software Security Assessment is a little old by now but still contains a lot of valuable advice.


2

These CWE lists will help you a lot: Weaknesses in software written in C Weaknesses in software written in C++


2

I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move some magic number to RDX (?) mul rdx ; Multiply 9 by magic number mov rax, rdx ; Take only the upper 64 bits of ...


2

This question is a bit confusing. Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...


2

How come there are entire rows of other data between the 3 stack strings? First of all, in x64 Linux code, the stack should be aligned to 16 bytes before any function call, so you can expect that rsp will be aligned as such in compiler generated code. Now, it's just a compiler's decision how many bytes it will use for item allocation. In GCC, for instance, ...


2

You don't need to make install the binary, this often strips the binary removing all the debug information. In the HACKING file these is a section on how to debug this tool, they advise the following settings, personally I would add -ggdb to enable gdb specific bindings. (This advice also applies to other projects, although this project has explicitly added ...


1

If you want instruction access references to a particular variable, then first define the reference manager: refmanager = program.referenceManager Then lets say you get all the local variables of a particular function - using - vars = function.getLocalVariables() You can get references to a particular variable: for var in vars: for ref in refmanager....


1

I continued to mess with it some more and found a way. I correct the signature to have a pointer of argv: int main(int argc, char **argv) But I don't really know why the pointer works and the standard C signature didn't. Hope for someone to clarify this.


1

Reko supports a variety of processor architectures.


1

This is a great resource. You can find most of the material on SEI CERT website but the book is great. https://www.amazon.com/Secure-Coding-2nd-Software-Engineering/dp/0321822137


1

These are functions exported by ordinal rather than by name. This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library. 6153 ?...


1

you may either need to use the local variables or compile with optimizations disabled I assume you are using msvc on windows ?? shown below is a snippet that was compiled on x64 for x64 in win 10 where you can clearly see the local vars being initialized and used f:\git\usr\bin\ls -lg total 1 -rw-r--r-- 1 197121 61 Sep 25 15:24 local.cpp f:\git\usr\bin\...


1

As part of ASLR, operating systems use code relocation tables embedded in an executable to change the location where an executable image is located. If you remove the relocation tables (or generate an executable without it to begin with) the operating system will not be able to relocate the executable image, however other images also loaded to the same ...


1

You can use checksec for dynamically linked binaries. However it'll fail for statically compiled binaries. You can try something like this for x86 $ r2 -AAA -qq -c "pdf @main~fs" test │ 0x00400b5c 64488b042528. mov rax, qword fs:[0x28] │ 0x00400b85 644833142528. xor rdx, qword fs:[0x28] In x86 cookie is loaded from fs:[0x28] ...


1

You can identify if a function is protected by the presence of __stack_chk_fail. It doesn't matter if it's user-custom code or it is statically compiled from libraries. gets is a very problematic function by design. It's impossible to protect it from buffer overflows For example: int main() { char buf[2000]; gets(buf); } In this case, the stack ...


1

You can check "graceful failures" for some common problems that can prevent decompilation and try to induce them deliberately. However, most of them can be worked around with a bit of effort so don’t expect them to stop a motivated person.


1

I am unsure what you mean by "solving" this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version: call $+5 add [esp], 5 ret xor eax, eax ret And with annotations: _main: call $+5 ; call address of next instruction, placing return address on stack (esp) add [esp], 5 ; add 5 bytes to the ...


1

As @Chris Stratton already said, you don't give the right pointer value - you want to put \x10\x50\x75\x55\x55\x55\x00\x00 as that value. Your segfault comes from instruction: mov dword [rax], r13d where rax = 0x7838302555755010, which confirms that you need to put these 4 extra bytes (to overwrite 78383025 part). I do not know however how you can pass ...


1

execve specification says: Both argv and envp must be terminated by a NULL pointer. but from your question it seems, that you forgot about it; you want to call it like this: execve("/bin/cat", ["/bin/cat","/test/file", NULL], NULL) If it still doesn't work, here is the working code in C. You can then follow @user3629249's suggestion and use gcc -S ...


1

I think just replace mov eax, 0xfffffff4 and not eax


1

By declaring d inside main() it is a local scope variable, which exists on the stack and is therefore dynamic. If you declare this pointer outside of main, it will be a global variable and it will have the same address every time, as long as there is know memory randomization provided as security measure of the OS.


Only top voted, non community-wiki answers of a minimum length are eligible