6

Your problem seems to be related to what Sibyl aim at doing (https://github.com/cea-sec/Sibyl). It tries based on the side effects of the function (return value, memory writes, ...) to identify a known function. Of course, you will need a kind of database to "learn" the function !


5

If you have all the possible input and all the expected outputs, and they're not indistinguishable from encrypted/compressed data, you can find more efficient storage mechanisms than just having a large lookup table. Even a simple genetic algorithm can very quickly get you to "use a * b, unless a == 234" (I've actually made a solver specifically for this ...


4

Unless you try all the input possibilities, as you suggested, you can only get an approximation of the function. This is basically one of the basic problems in the machine learning field, so I would look that way instead of trying to generate a lookup table for 2^32 * 2^32 values. You should obviously be careful that you won't have 100% guarantee that the ...


2

This problem essentially describes the field of sequential analysis coupled with curve fitting. If you are able to make some assumptions about the inputs to the secret function that your model needs to be good for, you can use this to guide your choice of algorithm for generating new values to try as inputs to the function. If you are able to make some ...


1

K, I'll take a stab at an answer. If you create a DLL that gets loaded by a process, of which there are numerous different methods, you can execute your code in the context of the remote process, not strictly what the question is about, but some groundwork. The common techniques are: Calling VirtualAllocEx, WriteProcessMemory and CreateRemoteThread. Writing ...


1

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which will log the module name, address and the instruction after a space. As far as I am concerned, there is unfortunately no support for string comparison in x64dbg, so ...


Only top voted, non community-wiki answers of a minimum length are eligible