Hot answers tagged

8

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L said above). Most parts of the below answer would apply to other architectures as well, but they may use different mnemonics or lack some mentioned ...


6

The signature for mmap is void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset); 4294967295 is same as -1 when treated as a signed integer. The mmap calls actually looks like mmap( NULL, /*addr*/ 321, /*length*/ PROT_EXEC | PROT_READ | PROT_WRITE, /*...


5

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...


5

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32: I'd define it as such: struct WF{ WF_STATE state; WF_STATE2 state2; DWORD ExStyles; //With ...


4

Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows. The main function is the first function executed for a C/C++ program. However, it doesn't mean this is the real first function / code executed. You will usually find some initialization code before this function is called. my ...


4

The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI. So, instead of trying to fully reverse engineer the code, I tried to search for the used constants instead and saw if the code matches with something: It turned out the algorithm is JCALG1. I made a quick and very ugly PoC from a code found on ...


3

Just a quick note in case you would not be aware of this: $ cat tiny.c #include <unistd.h> void _start() { _exit(42); } on x86-64, here is what I get (you need a static libc: libc.a): $ gcc -static -ffreestanding -nostartfiles -s -o tiny tiny.c $ ./tiny || echo $? 42 Pay attention that: $ file tiny tiny: ELF 64-bit LSB executable, x86-64, ...


3

you mean the thread doesn't run when you have single stepped out of the CreateThread() call ?? if yes then the Windows Scheduler hasn't yet found time to Schedule your Threads Code you can confirm when the code is run by Setting breakpoint on the LP_THREAD_ROUTINE Argument passed to CreateThread() probably be in R8D in your screenshot i think ...


3

int main (void){ unsigned int uin = 0x1000; signed int sin = -0x1000; return (uin<<8)+(uin>>8)+(sin<<8)+(sin>>8); } compiled and linked with cl /Zi /W4 /Od /analyze /nologo salsaar.cpp /link /release disassembled :\>cdb -c "uf salsaar!main;q" salsaar.exe | grep -A 20 Reading 0:000> cdb: Reading ...


3

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-compilability is often not the goal.


2

You can definitely edit the binary and implement a new function that handles caching and calls the original function as needed. Then just replace any call to your new cache-implementing function instead. You'll need to be careful when implementing the cache for a recursive function and decide if you wanna cache all intermediate results or only final results. ...


2

This C code compiles to the equivalent of your assembly code: void f() { int b = 1; for (int a = 0; a<4; ++a) { b = b + a; } // disassembly finishes here but maybe there's something like below // return b; } The output on Compiler Explorer switches [ebp-8] and [ebp-4] and uses eax rather than ecx to increment the loop ...


2

Wrong Parameters I was able to solve my problem! The function execve has the following definition: int execve(const char *filename, char *const argv[], char *const envp[]);` ^ ^ ^ ^ eax ebx ecx edx So the second parameter argv is not just ...


2

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF specification to know how every file in that format looks like, which sections it consists of and how they are located in the process image at the runtime. Even when ...


2

Program entry point != main You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) environment. From Microsoft's CRT Initialization: By default, the linker includes the CRT library, which provides its own startup code. This startup code ...


2

I think this is a strcmp function which was compiled without optimization and is really inefficient. Here is why: The function only uses r0 and r1 which are first and the second parameter. Both parameters are pointer because they are dereferenced All memory access are byte long Read bytes are compared against '\0' Read bytes are compared using the ...


2

v2 = -1640531527; C:>python -c "print hex(0x100000000-1640531527)" 0x9e3779b9L google 0x9e3779b9L first hit TEA algorithm google python tea first hit pytea quoting from the site below from pytea import TEA key = os.urandom(16) print('key is', key) content = 'Hello, 你好' tea = TEA(key) e = tea.encrypt(content.encode()) print('encrypt hex:', e.hex()) ...


2

This question is a bit confusing. Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...


2

I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move some magic number to RDX (?) mul rdx ; Multiply 9 by magic number mov rax, rdx ; Take only the upper 64 bits of ...


2

These CWE lists will help you a lot: Weaknesses in software written in C Weaknesses in software written in C++


2

Not a vulnerability list by itself, but SEI CERT C Coding Standard lists many “dangerous” code patterns which can be a source of vulnerabilities. The book The Art of Software Security Assessment is a little old by now but still contains a lot of valuable advice.


1

You can check "graceful failures" for some common problems that can prevent decompilation and try to induce them deliberately. However, most of them can be worked around with a bit of effort so don’t expect them to stop a motivated person.


1

I am unsure what you mean by "solving" this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version: call $+5 add [esp], 5 ret xor eax, eax ret And with annotations: _main: call $+5 ; call address of next instruction, placing return address on stack (esp) add [esp], 5 ; add 5 bytes to the ...


1

I think just replace mov eax, 0xfffffff4 and not eax


1

These are functions exported by ordinal rather than by name. This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library. 6153 ?...


1

you may either need to use the local variables or compile with optimizations disabled I assume you are using msvc on windows ?? shown below is a snippet that was compiled on x64 for x64 in win 10 where you can clearly see the local vars being initialized and used f:\git\usr\bin\ls -lg total 1 -rw-r--r-- 1 197121 61 Sep 25 15:24 local.cpp f:\git\usr\bin\...


1

I would like to extend the .text section and insert [code]. If there's a better method of inserting new functionality into an ELF I'm all ears. Techniques for adding arbitrary code to ELF files were pioneered by Linux virus writers beginning all the way back in the 1990s. In comparison with the methods they developed, as well as with more modern techniques,...


1

As @Chris Stratton already said, you don't give the right pointer value - you want to put \x10\x50\x75\x55\x55\x55\x00\x00 as that value. Your segfault comes from instruction: mov dword [rax], r13d where rax = 0x7838302555755010, which confirms that you need to put these 4 extra bytes (to overwrite 78383025 part). I do not know however how you can pass ...


1

execve specification says: Both argv and envp must be terminated by a NULL pointer. but from your question it seems, that you forgot about it; you want to call it like this: execve("/bin/cat", ["/bin/cat","/test/file", NULL], NULL) If it still doesn't work, here is the working code in C. You can then follow @user3629249's suggestion and use gcc -S ...


1

the v20 stuff is simply this->mem = new(); where this is a structure of some sort the dynamicdata constructor you posted is actually filling up a struct with 0 you need to change the int a1 to struct foo* a1 prior to that you need to define the struct in ida so since it is returning the struct pointer you need to change the return value also as struct ...


Only top voted, non community-wiki answers of a minimum length are eligible