76

The .so file is a compiled library, in most cases from C or C++ source code. .so stands for Shared Object, it doesn't have anything to do with obfusation, it just means someone wrote parts of the app in C. In some cases, there is existing C code and it's just easier for the programmer to build a JNI interface to call the library from java; in other cases, ...


67

Raymond Chen (Microsoft) has a blog post discussing this in detail: http://blogs.msdn.com/b/oldnewthing/archive/2011/09/21/10214405.aspx In short, it's a compile time addition applied in order to support run time hot patching, so the function can have the first two bytes overwritten with a JMP instruction to redirect execution to another piece of code.


42

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


42

Reverse engineering is commonly used in many ways. Here is a list of just some of the most common professional activities where reverse engineering is involved. Malware research. Withouth doing reverse engineering, it's hard to determine what an actual piece of malware does, how and, more important, how to clean it or prevent infections. Plagiarism ...


39

Index (shortened) Gentle Intro - binary executable code, how does it look? Why it is a hard task to compare binary executable code? Conclusion Solutions TL;DR TL;DWTR (too long, don't want to read): skip ahead to the section Why it is a hard task to compare binary executable code? if you feel comfortable with the basics around assembly and disassembly. ...


39

(reposting my SO answer to a similar question) In many cases it is possible to identify the compiler used to compile the code, and from that, the original language. Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...


37

First Unfortunately we don't seem to have MathJax turned on in this stackexchange so the math parts below are pretty horribly formatted. I'm also far from a mathematician so the notation may be off in some places. Understanding the magic number and code The goal of the code above is to rewrite a division into a multiplication because division takes more ...


30

To answer the first question. The biggest problem is that you can't really separate data from code. There are basically two approaches to dissasembly: Linear sweep Recursive traversal Dissasemblers using linear sweep start at some address and dissasemble instructions one by one until the end, without following jumps or reasoning about the dissasembled code ...


25

Lets go over the instruction piece by piece: mov movqword ptr ds:[rax+18],r8 This is the opcode part of the instruction. It describes the base operation the CPU is required to perform. mov is an opcode instructing a CPU to copy data from the second operand to the first operand. The first operand on the mov instruction is a target operand, and the second ...


25

It is assumed here that Linux ELF32 binaries are being analyzed. Code and data such as strings are stored in separate parts of ELF binaries. To disassemble the parts containing code, use objdump -dj .text <binary_name>. To examine hard-coded string data, use readelf -x .rodata <binary_name> Instructions and Data are located in separate areas ...


25

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an approach for digging into x86 chips and extracting hidden machine instructions. Title: Breaking the x86 ISA Abstract: A processor is not a ...


22

Have a look at the var_4 definition at the start of the function: var_4 = dword ptr -4 So it's actually negative as expected. For a more complete picture, use Ctrl+K or double-click/Enter on the stack var to see the stack frame layout: -00000018 ; Two special fields " r" and " s" represent return address and saved registers. -00000018 ; Frame size: 18; ...


22

Finding undocumented features of a product. for instance for locating a registry key or setting to turn on a debug mode. Finding how exactly a poorly documented feature works. Debugging sometimes i find myself loading my own software in IDA to find what code the compiler produced, either to find bugs, or to see how an optimization worked out. Cracking ...


21

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


20

Community wiki: feel free to edit As a main skill malware analysis digital forensics and Incident response security assessment, pen testing is this website/software/cpu really secure? which one is the most secure? exploit development si vis pacem, para bellum plagiarism detection (if a company sues another one because they claim they stole their source ...


20

I'm answering from a C++ viewpoint, other languages have different reasons. There are legitimate uses for these functions, even if they are nothing more than void func(/* any args */) {} One example that comes to mind is a virtual function that does nothing in a base class but is overridden in a derived class. A similar example would be a template ...


20

Radare 2 is a GPL software, with a good API, and is not using linear disassembling. See visual mode (Vp command) example:


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


20

The .bss has no content. It's simply a tip to the loader to preallocate some space when starting the program. It will be all 0s at the execution and won't hold any useful information until the program writes to it. After that, you can use a debugger to dump the memory and explore its content. Check the Wikipedia page for more information.


19

It's intended to jump to a specific location, 5 bytes before the mov instruction. From there, you have 5 bytes which are intended to be modified to a long jump to somewhere else in 32-bit memory space. Note that when hot-patching, that 5 bytes jump should be placed first, and then the mov can be replaced. Going the other way, you risk the replaced mov-jmp ...


19

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly. Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout ...


19

The traditional way to determine the function pointed to by [edi+1Ch] is as follows: Find the Interface Definition Language (IDL) file for the given interface. In your case, the interface is IShellWindows. According to the documentation for IShellWindows, its interface is defined in IDL file Exdisp.idl. That IDL file is included in the Windows SDK (...


19

Besides Guntram's suggestions, check out the retargetable decompiler aka retdec. It can decompile the binary to Python or C code. At least for me, it reads easier than pure assembly (and it works for ARM binaries). It works very well for sketching you the rough workings of the shared object. A plugin for select IDA versions exists, but the main limitation ...


18

It is very simple in some architectures, and not very obvious in others. I'll describe a few I'm familiar with. SystemV x86_64 (Linux, OS X, BSD) Probably the easiest to recognize. Because of the boneheaded decision to specify the number of used XMM registers in al, most vararg functions begin like this: push rbp mov rbp, rsp sub ...


18

Moving esp into ebp is done as a debugging aid and in some cases for exception handling. ebp is often called the frame pointer. With this in mind, think of what happens if you call several functions. ebp points to a block of memory where you pushed the old ebp, which itself points to another saved ebp, etc. Thus, you have a linked list of stack frames. ...


18

(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex) Few ways to find the other structures come to mind: Scanning memory for signatures Once you have a few examples of the structures, maybe the ...


18

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-transformation.org/Transform/PcExeFormat), and at that position you can see the correct signature P3. According to the header info, the executable's length is ...


17

potential (but untested) suggestions: CrowdRE IDA Toolbag BinCrowd CollabREate


17

Parameters Not only does it depend on the platform but different functions have different calling conventions. The calling convention basically tells you how you know where the arguments are. It says nothing about the local function stack frame layout. It's also extremely important to understand that when a function or method can be proven by the compiler ...


17

I like Robert explanation, it has a very good example, but.. I think it misses the point of which is the real purpose of this instruction. is done as a debugging aid and in some cases for exception handling Well.. not really, not only. It is part of the standard function prologue for x86 (32 bit), and it is the (common) technique to set up a function ...


Only top voted, non community-wiki answers of a minimum length are eligible