Skip to main content
9 votes
Accepted

Emulating Routers and other Embedded Devices with QEMU

Emulating a complete physical device is always going to be more of an experimental exercise. In this regard you can use firmadyne which aims to emulate Linux based embedded firmware for MIPS and ARM ...
0xec's user avatar
  • 6,090
8 votes
Accepted

Unicorn and QEMU: Example use cases to understand the differences

What does "(not) emulating hardware other than the CPU" mean? This means that whenever the software being emulated accesses hardware, it won't work in Unicorn in the same way as on actual hardware. ...
Guntram Blohm's user avatar
6 votes
Accepted

Dealing with instructions that are accessed by multiple pieces of data

The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic ...
dsasmblr's user avatar
  • 2,234
5 votes
Accepted

How can I view in-memory strings of a process on Linux (Ubuntu)?

You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.
w s's user avatar
  • 8,508
5 votes
Accepted

What is ObjectStublessClientXX in ole32dll?

COM is very abstract idea in Object Oriented Programming (OOP). To understand this well, you need some in-depth knowledge of Inheritance in OOP, Virtual Method Table, COM in separate process and Data ...
Biswapriyo's user avatar
  • 1,569
5 votes

Most efficient way to begin analyzing malware binary

I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be ...
GelosSnake's user avatar
5 votes
Accepted

Dynamic analysis (Frida) reveals instance of a class that doesn't exist in the source code (dex2jar)

There are multiple possibilities how this might happen. The code is loaded dynamically at run-time, e.g. for an [obfuscated/encrypted] dex file that is present in the APK file but does not follow the ...
Robert's user avatar
  • 1,077
4 votes
Accepted

Call Android method without running whole Android-App

You should be able to write a separate application that dynamically loads the dex file from the app that you are interested in using DexClassLoader, allowing you to construct classes and call methods ...
JesusFreke's user avatar
4 votes

Exe protection by TLS callback, trying to understand the behaviour

It is an old anti-debugging trick to use the TLS callback. The code in the TLS gets executed before the executables entry point and the debugger gains control. This allows the TLS to check for the ...
Crudd's user avatar
  • 41
4 votes

How to watch communication between 2 processes?

There are multiple ways two processes can communicate. The general term for this is IPC (Interprocess Communications). On Windows, the following forms of IPC are commonly used: COM Window messages (...
Igor Skochinsky's user avatar
  • 36.8k
4 votes

Most efficient way to begin analyzing malware binary

You may consider reading Practical Malware Analysis Book which describes in depth malware analysis process and techniques and contains in depth answers to your questions. Chapter 3 briefly describes ...
bart1e's user avatar
  • 3,409
4 votes
Accepted

How to call a func in an executable binary?

LIEF If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object. ...
julian's user avatar
  • 7,176
3 votes

Hybrid binary analysis tool

The basic idea is not new and has been done several times before. Probably the first working tool was Process Stalker by Pedram Amini. IDA also has its own little-known tracing feature which can ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Test malware files in host machine?

I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual ...
Megabeets's user avatar
  • 8,999
3 votes

Dealing with instructions that are accessed by multiple pieces of data

Kind of a shot into the blue here, but here are some thoughts which may help you and that won't fit into the comments: 3D Engines often work with entity-Objects in flexible inheritance hierarchies. I ...
Nordwald's user avatar
  • 2,906
3 votes

Could not find ld-linux-x86-64.so.2 in strace output

A very similar question to this can be found on stackoverflow: How does execve call dynamic linker/loader (ld-linux.so.2) The reason there is no strace output associated with the dynamic linker is ...
julian's user avatar
  • 7,176
3 votes

No apparent entry point for stripped, PIE binary using radare2

How can I find the entry point of this binary? There's a special radare2 command for this, ie: $ r2 /program_name -- Change the registers of the child process in this way: 'dr eax=0x333' [...
Megabeets's user avatar
  • 8,999
3 votes

How to get better in re?

https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315/ is a very good book, especially if you're interested in Windows. Practical Malware Analysis and especially ...
Vitaly Osipov's user avatar
3 votes

What is the relationship between the Windows API and the C run time library?

To answer the main question, some C functions call WinAPI functions. Some don't. There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient ...
Shmuel Fomberg's user avatar
3 votes

.NET: How to debug or decompile a DanamicMethod with dnSpy?

You can debug DynamicMethod's using the EventPipe API. I've written a library that uses it to allow for code injection via DynamicMethod that can be debugged: https://github.com/damieng/DamienG....
user42194's user avatar
3 votes
Accepted

other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?

Api Monitor is a great tool to hook api's, watch parameters and return values and optionally modify them before/after call. API Monitor is a free software that lets you monitor and control API calls ...
Remko's user avatar
  • 3,273
2 votes
Accepted

How to get the runtime memory region information when instrumenting using Pin?

As you're saying you're using ELF code, i assume you're running under Linux, or another unix-y system. And proc/self/maps (you don't have to getpid() and use /proc/XXX/maps, really) hints at Linux as ...
Guntram Blohm's user avatar
2 votes
Accepted

How to unpack and decrypt malware?

To add to what Hector said, I'd like to offer a couple of excellent tools, as well as an illuminating YouTube channel from an industry expert who shows you techniques and tools used to reverse modern ...
dsasmblr's user avatar
  • 2,234
2 votes

How to unpack and decrypt malware?

Dependent on how the packing/encryption works one common approach is to run the malware (in a sandboxed environment) and then take a dump of it while in memory. If the malware only temporarily ...
Hector's user avatar
  • 121
2 votes

Exe protection by TLS callback, trying to understand the behaviour

Exceptions in TLSCallbacks are discarded by Windows, but stop further callbacks from being called, and then control is transferred to the main entrypoint. However, the code that you've shown for the ...
peter ferrie's user avatar
  • 4,709
2 votes
Accepted

How can I circumvent rdtsc when used as an anti-debugger technique?

there are a few fake rdtsc drivers floating around or if you have windbg attached in kernel mode you can toggle cr4.TSD bit and catch the exception iirc there is a script floating for that too ...
blabb's user avatar
  • 16.4k
2 votes

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I used to use https://github.com/gdbinit/Gdbinit for tuning GDB but it's getting a bit dated, so I'd recommend https://github.com/hugsy/gef now as a modern alternative.
Mega Tonnage's user avatar
2 votes

Hybrid binary analysis tool

It seems what you're describing is, or at least very similar to, Dynamic Binary Instrumentation and there are a bunch of tools that do that. DynamoRIO, frida and Pin tool are three widely known tools ...
NirIzr's user avatar
  • 11.8k
2 votes

bypassing anti-VM inside protected samples

There is no exact way to bypass them but when I have to deal with them, I first try to figure out all those places where anti techniques have been present in assembly code by generally looking at ...
shubham0d's user avatar
2 votes

How can I view in-memory strings of a process on Linux (Ubuntu)?

Another way to read a process's memory in Linux isto read the psaudo-file /proc/<PID>/mem, which provides raw access to the memory space, as seen by the process, at offsets retrieved from /proc/&...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible