16

Let me start by telling you that what you want would be impossible, because of how well-known DLLs work. You can attempt something similar with tools like PEBundle or dllpackager, but that will usually (I'd say certainly) fail with the well-known DLLs (such as system DLLs as well as even the MSVC runtime DLLs in their different incarnations). See this and ...


15

The Windows kernel, unlike Linux or OS X, does not use consistent syscall numbering across versions. The numbers can change even after a servicepack release. For example, the NtReadFile syscall was 0x0086 on Windows NT 4 but on Windows 7 it's 0x0111 (see here for the full list). That's why all proper programs use the kernel32.dll (or ntdll.dll) to perform ...


11

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


7

You may want to read up on assembly before attempting to reverse engineer. esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi is used. Still, better safe than sorry.) mov eax,0cccccccch moves the value 0CCCCCCCCh into register eax. Which is actually kind of self-explanatory. That ...


7

You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No. Update Ok, as the author updated it with a more clearer question... this is what one can do: Strip symbols from the binaries. At the very least. Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...


6

Answering my own question so it's not marked as being opened. @DCoder's comment of using isAlign(idaapi.getFlags(ScreenEA())) is correct. .text:0040117B .text:0040117B locret_40117B: ; CODE XREF: sub_401160+Dj .text:0040117B retn .text:0040117B sub_401160 endp .text:0040117B .text:0040117B ; --------------------...


6

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6. http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...


6

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. All kinds of information that is contained in an assembly such as type names, variable names, method names, strings, and constants can be obfuscated. This makes ...


5

DCoder already referenced his own answer in a comment. The chunks in the control flow graph are usually referred to as basic blocks or extended basic blocks. The reason why they are being reordered has to with optimizations performed by the compiler. There are several terms for what you are asking about: function chunking basic block reordering partition ...


5

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: Newer Visual Studio also supports building with clang) I get that it's officially undocumented, but it's arguably the most publicly well-known and documented ...


5

Trying to provide a more general answer that would hopefully complement this answer linked in the comments. To those who are unsure, the .rodata section in an executable contains all read-only variables and constants with a global scope (i.e. will be defined for the entire duration of the program's execution) although the lines are becoming a little blurry ...


4

As for C compiler (gcc), first make sure you do not make a mistake of compiling it with -g option (adds symbols for debugging, basically whole source code). -g Produce debugging information in the operating system's native format Secondly, try with -s option: -s Remove all symbol table and relocation information from the executable. Without ...


4

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.


4

Very often functions like this will be listed within a vtable. This is where, within a language like C++, class objects can inherit functions and variables from other class objects. If class A, the parent class, implements a function getCount, class B can inherit from this class and change the return value of that function. Very often, developers will ...


4

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h They can change but very rarely. Applying this we can see that 0x241 == O_WRONLY | O_CREAT | O_TRUNC


4

The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom names (UPX00 etc.) or even garbage. AFAIK the only section name that is somewhat enforced is .rsrc - I think Explorer may not show the file icon if resources ...


3

This is just a bit of optimization. A call xxxx followed by a ret can be optimized to a jmp xxxx.


3

I personally enjoy Reverse Engineering for Beginners (by Dennis Yurichev). The book shows (among other things) lots of common code patterns being compiled to different architectures and using different compilers. This way you can learn about the idiosyncrasies of the individual compilers by comparing how they transform the same code. NOTE: Please don't let ...


3

The idea of truly protecting resources is impossible -- every protection you implement can and will be broken. Assume this, and do not put credentials or private data in your resources/code. The idea behind resource encryption/compression is summarized well in this codeproject article, the same ideas apply to .NET. You use some encryption method, add the ...


3

This is a common pattern in assembly generated by gcc at least. When it is not asked to optimize the generated code, the translation between C and asm is really straightforward. One statement in C produces a few lines of asm. Next statement: a few more lines of asm, and so on. In your case: mov [ebp+var_4], ecx is probably the end of a line of C, ...


3

Soot can give you a Jimple IR of an apk and inject instrumentation into it. It's not dynamic though, although I don't see why it couldn't be used for data dependency analysis. Unless your target app does weird things with reflection or JNI you should still be able to perform the analysis you want. There's a tutorial on using Soot with Dalvik executables ...


3

Normally the linker will leave the functions in their original order. However, techniques like Working-Set Tuning (see also Profile-Guided Optimization) can profile the program to see which parts are called the most often, then re-link it with that information in mind. This will clump the most frequently used code together (not only reordering functions, ...


3

Old versions of link.exe supported the /debugtype argument that used these options: /debugtype:coff use COFF format /debugtype:cv use CodeView or Program Database format (depends on /pdb option) /debugtype:both use both COFF and CodeView/Program Database formats According to the MSDN docs for Visual Studio 2008's linker, that option was no ...


3

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there, I won't list them all. Disassemble .class to "assembly" (usually Jasmin syntax), modify it, assemble back. Krakatau is a good tool that should be able to do ...


3

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-compilability is often not the goal.


3

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by default on modern gcc compilers. How to disable relro? Pass following flag -Wl,-z,norelro Difference between full and partial relro: partial relro makes partial ....


2

Probably with full intent from MS, not only does syscall numbering change between versions, but also many DLL ordinal values do too. Need to bind to WIN32 and use the full function name if you want your code to work across os releases.


2

Often times you will see patterns like this in a binary. It's certainly not guaranteed by any means, but you will typically see like functions placed near each other. What do I mean by that? Well consider how a typical C program might be laid out: foo.c static foo_1() static foo_2() use_foo() bar.c static bar_1() static bar_2() ...


2

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone https://github.com/gremwell/chainbreaker.git && cd chainbreaker $ python2 chainbreaker.py -f ~/Library/Keychains/login.keychain-db -p <PASS> $ ...


2

In addition to what others have already mentioned with respect to Compiler Optimizations, there is another possibility. At times, malwares can perform control flow obfuscations by making use of a lot of opaque predicates (in this case, unconditional jumps). In fact, if you perform an instruction trace using a pintool (DBI) on a malware, at times you will ...


Only top voted, non community-wiki answers of a minimum length are eligible