10 votes
Accepted

Need advice : Reverse engineering a pdf with shellcode

The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script. from binascii import unhexlify as unhx encoded = open('encoded.txt').read() # The ...
user avatar
  • 5,850
7 votes
Accepted

Any tool for finding IP that a process use/access?

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
user avatar
  • 8,589
6 votes

Returning a C function to its grandfather

I'm on a 64-bit machine. Your code in function_b() treats pointers as 32-bit values instead of 64-bit values. You should be using uint64_t* instead of uint32_t*.
user avatar
4 votes
Accepted

Extracting threads' stack from Windows memory dump

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it ...
user avatar
  • 14.8k
3 votes

Understanding the output of Windbg's `dds esp`

The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without ...
user avatar
  • 4,511
3 votes
Accepted

Tracing Callstack Despite Paged out Instructions

The prompt shown is kd> so you are debugging a live kernel. If memory could not be accessed windbg will show ? Not 0000 maybe you actually have 0000 in the address. Did you try doing .pagein ? ...
user avatar
  • 14.8k
3 votes
Accepted

Why do debuggers sometimes not show entire call stack?

Olly and WinDbg generate the 'call stack' by parsing the actual stack utilizing function signatures and calling convention. When the disassembler doesn't have the signature (e.g. when the developer ...
user avatar
  • 2,806
2 votes
Accepted

Understanding the output of Windbg's `dds esp`

dds means dump dwords intrepreting the result as symbols suppose 0x401234 contains 0x77123456 and 0x77123456 is resolved as kernel32!CreateFileA dds 0x401234 will yield kernel32!CreateFileA if ...
user avatar
  • 14.8k
2 votes
Accepted

usercalls in old Win32 game

Yes, this sounds perfectly normal. If the program did not use C++, you won't see thiscall with usage of ecx but just standard stdcall or cdecl which use only stack for passing arguments.
user avatar
  • 34.6k
2 votes

Estimate depth of call stack without symbols

ret instructions are not going to the call stack. When a function executes call, the next instruction address is pushed to the stack and when ret instruction is executed, eip is updated with the next ...
user avatar
2 votes

What is the difference between xrefs and stack trace?

x-refs is just a static cross-reference in the binary that can be identified during static-analysis. So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be ...
user avatar
1 vote
Accepted

Android Reverse Engineering Network Traffic Stack Trace

Hello you can start with the following approach: Decompile the apk file with apktool convert classes.dex to .jar with dex2jar open the file with some java decompiler. My favorite is Luyten Find ...
user avatar
  • 258
1 vote

VC 6 C++ Exception handling, nTryBlocks=0, pTryBlockMap=0 , how?why?

Actually it was so obvious - I just haven't read the C++ standard and was writing throw() specification thinking it would allow all exceptions - instead it turned out it was the exact opposite. And ...
user avatar
  • 383
1 vote
Accepted

What is a good resource to learn about how the call stack works while programming in C?

What I do NOT understand is how all the registers and the call stack fit together with this picture and what each registers is supposed to point to. It's great that you are competent in C, but there ...
user avatar
  • 6,829
1 vote

Any tool for finding IP that a process use/access?

Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP. On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports ...
user avatar
  • 11.3k
1 vote

Trace system calls, including stack (and java stack if possible), on android?

you can get system call stack with strace too. you just need to compile strace with libunwind. After that you just need to use -k to get system call stack for each system call.
user avatar
  • 11
1 vote

Trace system calls, including stack (and java stack if possible), on android?

JavaJournal, which was built on top of the pyspresso framework, was designed specifically for tracing method calls in Java.
user avatar
1 vote

Need advice : Reverse engineering a pdf with shellcode

The answer by extreme coders was wonderful,i wish to share my method too over here: I convert it to an executable with the tools in REMnux: remnux@remnux:~$ unicode2hex-escaped < sc.txt > sc2....
user avatar
1 vote

Tracing ("logging") the stack without setting a breakpoint?

The approach you describe is implemented in several profilers, usually under the name sampling profiler. What it usually does is: periodically (e.g. every 100ms) suspend the application get the ...
user avatar
  • 34.6k
1 vote

Tracing ("logging") the stack without setting a breakpoint?

A debugger cant read/log the Stack when an application is running and not stepped or paused. The closest thing to what you wanna do is called tracing and supported by some debuggers like OllyDbg and ...
user avatar
  • 336

Only top scored, non community-wiki answers of a minimum length are eligible