9

If you're asking about PE files, and by "no dependencies" you mean "no statically imported DLLs", then yes. See \yoda\NoImports.exe in https://corkami.googlecode.com/files/BinaryCorpus_v2.zip as an example.


4

For me not very comfortable to run Reversing\analysis tools thru Wine, so there are few options to choose from: Use for windows-style programs virtual machines [VirtualBox\Vmware] Move to Linux-based tools for same operations [for Pe\Hex\Static analysis] I found myself, that for most of research operations you may found tool or set of tools for Linux OS, ...


4

Not an issue I myself do the same thing, however I don't have Hexrays. I can tell you it works great. I use VirtualBox however. This mainly has to do with Seamless mode, this allows me to do great things :) System Requirements However I DO recommend to use a decent system. I tried to do this with my old-laptop and it was horrid. Atleast 8GB of RAM, and VT-...


3

This isn't a very portable trick, but kernel32.dll is always loaded at the same address when the executable is launched, that means LoadLibraryA and GetProcAddress are always at the same address. You could hard-code those offsets and go from there.


2

Yes. Find the address of kernel32 using anyone of the known tricks (PEB or any other way) Implement a simple export section parser and find the address of LoadLibrary and GetProcAddress. Use those to load any other API you want.


2

Yes, a program that has no dependencies is possible. To imports APi, it needs first to locate kernel32 (via stack+MZ scanning, or PEB) then locate exports (via exports parsing or hard-coded values).


2

I figured it out by trial and error. From the main Eclipse window: Click on the dropdown arrow on the "Debug As..." button in the toolbar. Select "Debug Configurations..." In the Configuration Editor: You can edit your existing Ghidra configuration for your project or you can make a duplicate of it like I did. Then select that project in the left side. ...


1

“Reload input file” only refreshes the byte values, it does not reanalyze the file. So if, for example, you added some functions and the code moved, it may interfere with the existing analysis. If you don’t actually need to analyze the binary but just debug it, you can used IDA in so called “instant debugging” mode. Open IDA without loading anything, then ...


1

I (a random bloke on the internet) would do these: read the EULA and terms&conditions. Do they explicitly prohibit/allow all/some parts of the API? is the API you're using internal or merely undocumented? depending on the country/jurisdiction you might not be able to use the results of RE. It can be questionable how much of an RE it is to guess the API ...


1

Where I would start... Start by reading about QR codes. I would guess that QR codes aren't that far off from Snapcodes, but Snapcodes probably carry very little information. As in, they only contain a pointer to a Snapchat ID. A Micro QR code can hold 35 characters, which is probably about the capacity of a Snapcode and rather than an anchor point you have ...


Only top voted, non community-wiki answers of a minimum length are eligible