Hot answers tagged

258

You didn't mention a platform (Windows, Linux, macOS, etc), but here are some great disassemblers. Ghidra Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. Windows, Mac OS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting,...


51

If you were looking for a contender, I believe ImmunityDebugger and OllyDbg can compete in part for dynamic-analysis and Hopper in part for static-analysis. That said, there is a big gap between the capabilities you get with the aforementioned software and IDA. IDA Pro is pretty unique with its capabilities and if you add the Hex-Rays Decompiler Plugin ...


48

Some other disassemblers / decompilers W32Dasm W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003 Capstone Capstone is a lightweight multi-platform, multi-architecture disassembly framework. BORG Disassembler BORG is an excellent Win32 Disassembler with GUI....


43

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


25

FLIRT stands for Fast Library Identification and Recognition Technology. Peter explained the basics, but here's a white paper about how it's implemented: https://www.hex-rays.com/products/ida/tech/flirt/in_depth.shtml To address those issues, we created a database of all the functions from all libraries we wanted to recognize. IDA now checks, at each ...


24

I gave a talk at Recon in 2011 ("Practical C++ Decompilation") on this exact topic. Slides and video (mirror) are available. The basic approach is simple: represent classes as structures, and vtables as structures of function pointers. There are some tricks I described that allow you to handle inheritance and different vtables for the classes in the same ...


23

Another framework to check out is Vdb and Vivisect Vdb - Python based debugger and programatic debugging API VdbTargetVMWare32 - Kernel debugging using the vmware hypervisor VdbOnAndroid - Using vdb to debug android processes Vivisect - Python based static analysis and emulation framework


23

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5). Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...


22

You can't. In C, structs are there for the readers of the C program and their use in the program image is kinda optional. It's entirely possible that in the original program some crazy jerk decided to do everything with perfectly-sized char* buffers and cast and add appropriately, and you would never know the difference. The 'struct' labeling is entirely ...


22

Have a look at the var_4 definition at the start of the function: var_4 = dword ptr -4 So it's actually negative as expected. For a more complete picture, use Ctrl+K or double-click/Enter on the stack var to see the stack frame layout: -00000018 ; Two special fields " r" and " s" represent return address and saved registers. -00000018 ; Frame size: 18; ...


22

you can add a function type by editing it (Key Y) and adding the name. I wrote a page to remind me about calling conventions at ASM level. Introduction the original call is myfunc(0,1,2,3,4). standard order is first argument is pushed last. standard stack adjusting is 'callee cleanup' - after returning, the stack should be without its calling arguments. ...


22

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the only one I have experience with, and since it provides a hidden compiler switch printing how classes will be layouted in memory which I'm going to use for illustration. As you ...


21

There are very common patterns that you will find in code that denote structure usage. Dereferencing offsets: If you have a pointer which is dereferenced at some non-zero offset, you are probably dealing with a structure. Look for patterns like: mov eax, [ebp-8] ; Load a local variable into eax mov ecx, [eax+8] ; **Dereference a dword at eax+8** In ...


21

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


21

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it's not just a simple continuation of the material posted in my answer above. I have spent over 2 hours on this post to avoid just cutting and pasting content ...


20

I'm answering from a C++ viewpoint, other languages have different reasons. There are legitimate uses for these functions, even if they are nothing more than void func(/* any args */) {} One example that comes to mind is a virtual function that does nothing in a base class but is overridden in a derived class. A similar example would be a template ...


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


20

Well, I managed to figure it out. If you click on the small gray bar just below the titlebar, you can drag it back to the main window. If you hover over the gray bar, it will tell you as much, but the fact that it's just below the titlebar (which is what you'd normally click to drag the window around), it's easy to miss. Edit: If you want to reset all tabs ...


19

Press Alt-A to bring up the "string style" dialog, from which you can create a string of various types (including Unicode). Through this dialog, you can optionally set the default string type that is created when you press a (i.e., you can make it such that Unicode is the default if you want). Alternatively use Alt+A U as pointed out by joxeankoret in the ...


19

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly. Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout ...


19

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK. Start with menu Debugger, Start Process or F9. Your breakpoint should be hit.


17

potential (but untested) suggestions: CrowdRE IDA Toolbag BinCrowd CollabREate


16

Just to expand on @ange's answer, IDA Toolbag is a lightweight solution for collaboration using their "Queues" feature. I have tested that it does work, and I believe it provides all the features you mentioned in your question.


16

As suggested by DCoder, I use the following helper class to efficiently resolve addresses to basic blocks: # Wrapper to operate on sorted basic blocks. class BBWrapper(object): def __init__(self, ea, bb): self.ea_ = ea self.bb_ = bb def get_bb(self): return self.bb_ def __lt__(self, other): return self.ea_ < other.ea_ # Creates a ...


16

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. and static analysis of a binary. Static program analysis is the analysis of computer software that is ...


15

I put this together quickly in the File > Python command... dialog: tgtEA = idaapi.askaddr(0, "Enter target address") if tgtEA is None: exit f = idaapi.get_func(tgtEA) if not f: print "No function at 0x%x" % (tgtEA) exit fc = idaapi.FlowChart(f) for block in fc: if block.startEA <= tgtEA: if block.endEA > tgtEA: print "0x%x is ...


15

A flirt signature is a pattern used to match known function headers. As an example consider the following: push ebp mov ebp, esp sub esp, 4Ch mov [ebp+var_4], eax push ebx push edi ... The compiler is free to change any register to another one or move anything around so it all depends on what the compiler thinks is most optimal. ...


15

IDA Pro offers two tracing options: Instruction tracing Debugger->Tracing->Instruction Tracing It is very slow tracing process, since IDA monitors registers and has to record the address, the instruction, and changes values of registers, that were changed by the instruction. Function tracing Debugger->Tracing->Function Tracing. It is a subcategory of ...


15

I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array. Here is the output after this change: _this->ConfigSpace1 = configSpaceBuffer[1]; _this->ConfigSpace0 = configSpaceBuffer[0]; ...


15

It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer. This is relevant because Delphi 2009 introduced native unicode string support and mapped the ...


Only top voted, non community-wiki answers of a minimum length are eligible