11

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


7

You may want to read up on assembly before attempting to reverse engineer. esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi is used. Still, better safe than sorry.) mov eax,0cccccccch moves the value 0CCCCCCCCh into register eax. Which is actually kind of self-explanatory. That ...


7

You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No. Update Ok, as the author updated it with a more clearer question... this is what one can do: Strip symbols from the binaries. At the very least. Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...


6

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6. http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...


6

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. All kinds of information that is contained in an assembly such as type names, variable names, method names, strings, and constants can be obfuscated. This makes ...


5

DCoder already referenced his own answer in a comment. The chunks in the control flow graph are usually referred to as basic blocks or extended basic blocks. The reason why they are being reordered has to with optimizations performed by the compiler. There are several terms for what you are asking about: function chunking basic block reordering partition ...


5

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: Newer Visual Studio also supports building with clang) I get that it's officially undocumented, but it's arguably the most publicly well-known and documented ...


5

Trying to provide a more general answer that would hopefully complement this answer linked in the comments. To those who are unsure, the .rodata section in an executable contains all read-only variables and constants with a global scope (i.e. will be defined for the entire duration of the program's execution) although the lines are becoming a little blurry ...


5

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-compilability is often not the goal.


4

As for C compiler (gcc), first make sure you do not make a mistake of compiling it with -g option (adds symbols for debugging, basically whole source code). -g Produce debugging information in the operating system's native format Secondly, try with -s option: -s Remove all symbol table and relocation information from the executable. Without ...


4

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.


4

Very often functions like this will be listed within a vtable. This is where, within a language like C++, class objects can inherit functions and variables from other class objects. If class A, the parent class, implements a function getCount, class B can inherit from this class and change the return value of that function. Very often, developers will ...


4

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h They can change but very rarely. Applying this we can see that 0x241 == O_WRONLY | O_CREAT | O_TRUNC


4

The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom names (UPX00 etc.) or even garbage. AFAIK the only section name that is somewhat enforced is .rsrc - I think Explorer may not show the file icon if resources ...


3

I personally enjoy Reverse Engineering for Beginners (by Dennis Yurichev). The book shows (among other things) lots of common code patterns being compiled to different architectures and using different compilers. This way you can learn about the idiosyncrasies of the individual compilers by comparing how they transform the same code. NOTE: Please don't let ...


3

This is a common pattern in assembly generated by gcc at least. When it is not asked to optimize the generated code, the translation between C and asm is really straightforward. One statement in C produces a few lines of asm. Next statement: a few more lines of asm, and so on. In your case: mov [ebp+var_4], ecx is probably the end of a line of C, ...


3

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone https://github.com/gremwell/chainbreaker.git && cd chainbreaker $ python2 chainbreaker.py -f ~/Library/Keychains/login.keychain-db -p <PASS> $ ...


3

This is just a bit of optimization. A call xxxx followed by a ret can be optimized to a jmp xxxx.


3

Soot can give you a Jimple IR of an apk and inject instrumentation into it. It's not dynamic though, although I don't see why it couldn't be used for data dependency analysis. Unless your target app does weird things with reflection or JNI you should still be able to perform the analysis you want. There's a tutorial on using Soot with Dalvik executables ...


3

Normally the linker will leave the functions in their original order. However, techniques like Working-Set Tuning (see also Profile-Guided Optimization) can profile the program to see which parts are called the most often, then re-link it with that information in mind. This will clump the most frequently used code together (not only reordering functions, ...


3

Old versions of link.exe supported the /debugtype argument that used these options: /debugtype:coff use COFF format /debugtype:cv use CodeView or Program Database format (depends on /pdb option) /debugtype:both use both COFF and CodeView/Program Database formats According to the MSDN docs for Visual Studio 2008's linker, that option was no ...


3

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there, I won't list them all. Disassemble .class to "assembly" (usually Jasmin syntax), modify it, assemble back. Krakatau is a good tool that should be able to do ...


3

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by default on modern gcc compilers. How to disable relro? Pass following flag -Wl,-z,norelro Difference between full and partial relro: partial relro makes partial ....


2

Often times you will see patterns like this in a binary. It's certainly not guaranteed by any means, but you will typically see like functions placed near each other. What do I mean by that? Well consider how a typical C program might be laid out: foo.c static foo_1() static foo_2() use_foo() bar.c static bar_1() static bar_2() ...


2

Probably with full intent from MS, not only does syscall numbering change between versions, but also many DLL ordinal values do too. Need to bind to WIN32 and use the full function name if you want your code to work across os releases.


2

In addition to what others have already mentioned with respect to Compiler Optimizations, there is another possibility. At times, malwares can perform control flow obfuscations by making use of a lot of opaque predicates (in this case, unconditional jumps). In fact, if you perform an instruction trace using a pintool (DBI) on a malware, at times you will ...


2

I believe the best thing to do would be to learn about compilation in general and code generation in particular. The dragon book would be a good start. Then you can check Engineering a Compiler by Cooper & co. About common compiler patterns, this would require a bit of extensive reverse engineering which, I believe, few people in the research and ...


2

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible? Well it could be possible if it's your code and you know what you are doing (basically making a new library that is a subpart of the first one), but ...


2

TL;DR: Hope for some magic numbers, or string constants you can xref, or you're in for a lot of manual work. Searching for an arithmetic statement that doesn't include a very specific magic number, or searching for a loop without any surrounding context, is bound to fail. There's just too much code that's way too similar in your program. So you should at ...


2

I'll assume you have a general understanding of the x86 processor architecture, registers, and how the stack works. If you don't, there are a lot of introductions, tutorials, and books out there, which explain things much better than I could in this post. The first 2 and last 3 instructions are standard function entry/exit code: push ebp mov ebp, esp .... ...


Only top voted, non community-wiki answers of a minimum length are eligible