Skip to main content
8 votes
Accepted

Manually unpacking upx

You said that the base address changes so I assume your system and target executable have ASLR enabled. This sometimes causes problems when unpacking due to relocations not being fixed. Easiest ...
Anonymous's user avatar
  • 126
6 votes
Accepted

Why to dump precisely at OEP while manual unpacking?

But how does knowing OEP relate to IAT? OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer. When ...
NirIzr's user avatar
  • 11.8k
4 votes

Why to dump precisely at OEP while manual unpacking?

I think there is something mixed up here. But how does knowing OEP relate to IAT? It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware ...
Nordwald's user avatar
  • 2,906
4 votes

Help mounting jffs2 dumped from NAND flash.

It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong. Instead of mounting it maybe try just extracting the files ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

Retrieve & dump type information from IDA Pro

It's obviously doable (you already noted the Create C header file functionality), but if you want to customize the output, you'll have to code it yourself. Here's what you'll need: ida_typeinf....
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

Decoding algorithm with checksum

Looks like it's just addition for the checksum, so nice job on that. The mystery byte is part of the checksum. The accumulator is 2 bytes. data = """...
pythonpython's user avatar
3 votes
Accepted

How to examine/edit stack memory contents using radare2 in debug mode?

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with ...
Ricardo's user avatar
  • 501
3 votes

Manually unpacking upx

Just set a breakpoint in 0x00ef674c. Press F9. When it hit the breakpoint, press F7 to go the original Entrypoint of the unpacked file. Just make sure that the EIP is the OEP.
ismael_akez's user avatar
3 votes

How to dump a firmware from an old cell phone with Linux?

Looks like Wiko use Android as OS [based on http://www.wikogeek.com/], so Android tricks should work here as well. If you need access to SoC on RDA8851CL in more "user-friendly" way, try to connect ...
Denis Laskov's user avatar
  • 2,438
3 votes
Accepted

Router flash dump unknown filesystem

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out ...
cimarron's user avatar
  • 1,341
3 votes
Accepted

Process Dumping and Ida

If your binary is allocating a new memory page & writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new ...
user2823000's user avatar
2 votes

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options : 1 - Untick it in options ...
Dessloch's user avatar
2 votes

Fixing dump files in ida

If possible, please try to dump modules together. If that is not possible, load any of them in IDA and go to File -> Load file -> Additional binary file to load each file one after another. ...
Nordwald's user avatar
  • 2,906
2 votes

Dump a child process created by malware with an ALTERNATIVE process hollowing process

The technique you described above is known as "dynamic forking" or "process hollowing". You can find the entry point of the child process by following the steps described in https://...
Jason Geffner's user avatar
2 votes

Dumping Memory to Raw File

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever ) the code below is rubbish hack you may need to declare proper ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

Dump Sequence Data from Casio electronic keyboard

First Step: Research First off just do some research on your product. See if anyone has done any research or reverse engineering on your particular keyboard model. If no one has done any work on it ...
Brandon Bryant's user avatar
2 votes

How to wrap dump process and execute it in another PC

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to ...
knowmalware's user avatar
2 votes

Custom nanddump and nandwrite tools

Don’t know what swap is about, but spare area, or OOB area is an additional area at the end of each page storing metadata such as: bad block markers ECC (error checking and correcting) code custom ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

Rebuild IAT after manually unpacking DLL

I solved this by manually fixing each missing import API. First I did a text dump of the unpacked dll using BinText where I found a list of imported API's. I then compared it to the list of API ...
majidarif's user avatar
  • 235
1 vote
Accepted

How to keep symbols when taking memory snapshot with IDA?

Two options: Include the targets of the pointers into the snapshot (can be done by enabling the target segment’s loader flag in segment properties, or via “Analyze module” from the Modules context ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Manufacturer interface on OCZ Agility 4 SSD

J5 looks like a UART connector and the JT_ pins are likely JTAG. UART should give you console access to manufacturing/diagnostic commands, and JTAG should allow you to the debug the code (firmware) ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Can a program's memory be dumped and then reinserted?

Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by ...
Johann Aydinbas's user avatar
1 vote
Accepted

Dumping Memory to Raw File

I have recently made an API in python to read and write memory - could be useful for a quick solution. https://github.com/samsonpianofingers/pymem you could use this like this import pymem handle = ...
Samson's user avatar
  • 196
1 vote

How can I determine if NAND blocks are good blocks?

I don't know if it applies exactly but the following document from QNX suggests that: spare is made up of "sequence #", "file ID", "offset", "CRC" and "ECC" there are special blocks that contains ...
Amaury Pouly's user avatar
1 vote

Dumping ipa file on iOS 10.2

So Installing ipainstaller through Cydia and then dumping with command (through ssh) ipainstaller -b com.example.targetapp -o /tmp/example.ipa does the work
cre8eve's user avatar
  • 11
1 vote
Accepted

Dumping Flash Memory Using Bus Pirate

Sounds like you're good to go. Yes the Raspberry has a SPI interface so you can connect the Winbond to it and use the "flashrom" to dump it. Attach the SOIC clip to the chip and connect the pins to ...
amgnet's user avatar
  • 105
1 vote

Unpacking and dumping executable from DLL

I would recommend using the starting address of the lpbuffer from WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) : After that if needed you can fix ...
GelosSnake's user avatar
1 vote

Unpacking and dumping using ollydump

As there are little data about the unpack flow, here is the general approach you should follow in most packed malwares. This will probably be more complicated if we are talking about some custom and ...
PhoeniX's user avatar
  • 3,062

Only top scored, non community-wiki answers of a minimum length are eligible