Hot answers tagged

20

Correct disassembly of an executable is known to be undecidable in the general case (this problem can obviously be related to the famous halting problem of a Turing machine). So, extracting all the basic blocks of a binary program is a very difficult problem. Yet, there are several techniques to try to approach a best effort coverage of the instructions. ...


16

If you need null bytes, you can write them to a file and use the file as input for the program, e.g.: echo -e -n "\x00\xFF\xAB" > file.bin program < file.bin You can use also use xxd to convert hex to binary: echo "00 FF AB" | xxd -r -p | program


9

Use echo -e and pipe to your program's input. Example: echo -e "\x41\x42\x43\x44" | <executable> Will write ABCD as input. edit: You can pass null-bytes


9

This is code from the vDSO which is mapped by the kernel into every process, not from the wget binary. You could probably figure it out by inspecting the /proc/<pid>/maps file. Here's what I have in IDA for gettimeofday from it: .text:FFFFFFFFFF700D17 mov rbx, 0FFFFFFFFFFDFF000h .text:FFFFFFFFFF700D1E lsl r11d, eax .text:FFFFFFFFFF700D22 ...


5

You can write an IDA script or create an IDA plugin to gather all basic blocks in a program. Sample plugin code to gather all basic blocks can be found in http://www.hexblog.com/ida_pro/files/coverit.zip - ... // Find all basic blocks in the specified area static bool gather_basic_blocks(ea_t ea1, ea_t ea2) { show_wait_box("Finding basic blocks"); ea_t ...


3

it is not clear if you are using windbg and you have a bunch of .dmp files that you want to auto analyze for access-violation if that is the case you could check this out original contents of directory :\>ls -l total 96 -rw-rw-rw- 1 HP 0 96698 2016-01-29 21:27 CRASH.DMP duplicating the same file 10 times to simulate a bunch of crash dumps :\>for /...


3

Adobe Reader uses the following two methods to determine if another instance is running: CreateSemaphoreW(NULL, 0, 1, L"Acrobat Viewer") followed by GetLastError() == ERROR_ALREADY_EXISTS FindWindowW(L"Acrobat Viewer", NULL) != NULL So as long as you hook those two functions appropriately or patch the code that performs those checks, you will be able to ...


3

Some time ago I wrote minblox for that exact purpose. It relies on DynamoRIO. Compared to minset which uses pin tool, there isn't much of a difference. Tho I think actual set minimization part works faster than minset. Minblox tool is comprised of two parts. A DynamoRIO instrumentation part (libbbcoverage) tasked with recording all basic block executed ...


3

When dealing with multi-threaded program, you may end up getting instructions from different threads. You can for example check the current thread ID to make sure you're getting what you need. Even if the program itself does not use threads, they may be created by system libraries. One of the most common examples is the TppWaiterpThread. RPC functions also ...


3

There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic Taint Analysis, using SMT solvers, etc... are good tools for small or specific problems but almost unusable for whole projects + real targets, for the average ...


2

The best thing you can do is to learn how to read assembly. Start at the crash, see what type of memory is being used, values in registers, and previous instructions. Learn how to use windbg. Taint analysis and smt solving is intended for pure binary data, it sucks for interpreters or abstract state machines. In other words, its great when the ...


2

First of all you should write script to lower the difference between your mutated(fuzzed) file and original in order to know the main byte/bytes that make program crash. This would be a byte by byte compare,change,check to make sure you have the minimal difference needed to crash the app.(It's possible that you found new crashes this way. believe me!) ...


2

Page 4 of https://www.nccgroup.com/media/190706/usb_driver_vulnerabilities_whitepaper_january_2013.pdf gives a good introduction to setting up a USB-fuzzing test platform. Testing USB drivers on host machines is not a straightforward process, because you either need to emulate a USB device or proxy the traffic between a device and the host. As a ...


2

Apart from the FaceDancer from Goodspeed, I have never been able to find anything similar. I personally use the FaceDancer[11 & 21] and now I built my own emulator (not that easy if your electronics skills are rusty). But depending on the kind of analysis you want to perform you could find different other types of hardware, or software for that matter. ...


2

Peach Fuzzer performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than !exploitable. If neither Peach Fuzzer nor !exploitable meets your needs and you can't find anything else, you're best off grouping crashes by exception code and exception address (RVA if the program uses ASLR). Then if ...


2

Binary-level code coverage analysis can be done either statically or dynamically. Static instrumentation can, among other things, offer drastic performance improvements over dynamic tools like Pin. However, it is considered, somewhat traditionally, to be brittle, i.e., it breaks binaries. For example, see the last note on static rewriting in afl-qemu. Hence, ...


2

CreateToolhelp32Snapshot() would help for creating a snapshot of program state, especially fuzzing a la this paper Also, Peter Van Eeckhoutte covered what you're attempting to do in (in-memory fuzzing) in this blogpost Both are outlined step by step


1

Thanks to @julian's comment, I was able to search for more relevant terms. For this particular case, I decided to use AFL's dictionary mode, where you can give it a list of words that make up the target application's accepted syntax. For example, let's pretend the target application is an interactive calculator, which supports all basic mathmatical ...


1

Great tool to achieve this in Windows is Application Verifier. The general idea is that you run your program with different heap inspections, using the verifier. For example - each allocation made on a separate memory page, Freed memory is not just returned to the pool but marked as freed, and any later access to it will cause an excpetion and so on. This ...


1

This is not a question about reverse engineering, but you can use the DARPA Cyber Grand Challenge binaries that have been ported to Linux, Mac OS and Windows by the Trail of Bits team: The DARPA Challenge Binaries (CBs) are custom-made programs specifically designed to contain vulnerabilities that represent a wide variety of crashing software flaws. They ...


1

If you want to discover new test cases (or check that a test case is valuable) on a binary, the good way to go is to use tools such as KLEE (see this small tutorial). The point is too use symbolic execution to try to cover a maximum of the possible execution paths which are in the binary. So, I would advise you to take a deeper look at the symbolic ...


1

try reading this book to get some answers:- iOS Hacker's Handbook http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118204123.html Covers iOS security architecture, vulnerability hunting, exploit writing, and how iOS jailbreaks work Explores iOS enterprise and encryption, code signing and memory protection, sandboxing, iPhone fuzzing, exploitation, ROP ...


1

Just find points of interest and reverse the flow back to find if there is something in the environment you can manipulate to your will alter the poi. Eg, if you find a memcpy(a, b, c); check where b and c are coming from, are they from user generated input or system generated input, maybe they are statics. If it they are generated from user input you can ...


1

As far as I know, there is nothing like this public. However, you can use DrCov and do yourself the same thing as Minset does and even more powerful things. Indeed, I commonly use this DynamoRIO's tool, DrCov, for doing this exact same thing and others.


Only top voted, non community-wiki answers of a minimum length are eligible