Hot answers tagged

4

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


2

I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download a payload on your system... And, yes, there have been some examples where security analysis software have been pinpointed with security threats. The last I ...


1

After posting the question, I started to think about the difference in the libc I was using. I compiled the basic test binary again but with musl, and also saw the unexpected behavior there. This seems to be due to the printf implementation in musl: if (isdigit(s[1]) && s[2]=='$') { l10n=1; argpos = s[1]-'0'; ...


1

If I get your question right This link can help you to get the password of office files.


1

I found the solution when reading these two articles: https://pentest-tools.com/blog/bluekeep-exploit-metasploit/ (Extracting the NPP Address) https://medium.com/@alexandrevvo/testing-bluekeep-cve-2019-0708-metasploit-module-on-windows-7-ef3f28217b7b (Finding the NPP)


Only top voted, non community-wiki answers of a minimum length are eligible