Hot answers tagged

52

Some other disassemblers / decompilers W32Dasm W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003 Capstone Capstone is a lightweight multi-platform, multi-architecture disassembly framework. BORG Disassembler BORG is an excellent Win32 Disassembler with GUI....


47

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


34

Well, I managed to figure it out. If you click on the small gray bar just below the titlebar, you can drag it back to the main window. If you hover over the gray bar, it will tell you as much, but the fact that it's just below the titlebar (which is what you'd normally click to drag the window around), it's easy to miss. Edit: If you want to reset all tabs ...


33

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have experience with, and since it provides a hidden compiler switch printing how classes will be layouted in memory which I'm going to use for illustration. As you might ...


31

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it's not just a simple continuation of the material posted in my answer above. I have spent over 2 hours on this post to avoid just cutting and pasting content ...


24

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5). Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...


24

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK. Start with menu Debugger, Start Process or F9. Your breakpoint should be hit.


22

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


21

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and would not properly fit in with either of the two answers that I posted above. Addressing his first issue : In this case though, the whole settings is a ...


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


18

The easiest way to get this done is simply by opening the Options -> General -> Disassembly window, and setting the "Number of opcode bytes (Graph)" field to the number of opcode bytes you wish IDA to show you in the both the graph and linear disassembly listing views. This is how the configuration change should look: And the result of doing that will be ...


18

Enter the "strings window" by either press shift+F12 or go to View > Open Subviews > Strings in the toolbar. Then, in the strings window, press Right Click and choose "Setup...". Check "Unicode" and press "OK".


16

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. and static analysis of a binary. Static program analysis is the analysis of computer software that is ...


15

I lack 9 reputation points, so sadly I can't comment the great answer by w_s. ;) Just for completeness, the concept described is known in graph theory as "Tarjan's Algorithm" for finding strongly connected components. Wikipedia has a nice animation that helps following the steps. For study, here is another (more formal) Python implementation, it's the ...


15

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl main(int argc, const char **argv, const char **envp) That's from an ELF file, x86 abi; stuff is passed on the stack. Then, I can do the following: Python>...


15

In x86-64, any operation that affects only the lower 32 bits of a register automatically zeros out the upper 32 bits. The relevant part in the Intel Architecture manual is in Volume 1, 3.4.1.1, which states: When in 64-bit mode, operand size determines the number of valid bits in the destination general-purpose register: 64-bit operands ...


14

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...


14

I highly recommend radare2 which seems to suit you the best: radare2 is an open source framework for reverse engineering and binary analysis which implements a rich command line interface for disassembling, analyzing data, patching binaries, comparing data, searching, replacing, visualizing and more. It has great scripting capabilities, it runs on ...


13

funcap uses IDA's debugging API to record function calls in a program together with their arguments (before and after). This is very useful when dealing with malware which uses helper functions to decrypt their strings, or programs which make many indirect calls.


13

There are some tricks you can use to speed up the process. IDA's Functions window, as well as some other windows, presents sorted data. This means that for every function added, it sorts the entire view. When operating on >100k functions, this can take a considerable (>1sec) amount of time. So if you have ~200K functions, the analysis will take forever, ...


13

In C, and many other low-level programming languages the term NULL is equivalent to 0. The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...


13

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


12

It is not trivial task. You can do it relatively easy if you not taking in account indirect calls (for example such as virtual functions in C++) and calls from another function like this: int f() { g(); } int g() { f(); } It can be much more complicated if one of your functions is in another binary (dll for example). So, there are two ways to do it,...


12

This aligns the stack pointer to 8 byte boundary. This is done by the compiler to improve performance, as reads from non-aligned addresses results in performance degradation.


12

The byte 3Eh is the encoding of the segment override DS:. You observe it in an instruction like cmp byte ptr ds:3BEh, 'C' The hex encoding of this instruction is (I did this manually, some bit might be wrong) 3E - segement override prefix 80 - 8 bit ALU instruction 3E - mod/rm byte (reg = 7 -> instruction is CMP, mod = 0/rm = 6 -> ...


12

Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False". R stands for "Returns" and is True (has an "R" in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the ...


11

There is SmartDec, a native-code to C/C++ decompiler. It has two versions. Standalone and plugin to IDA. The latter supports all IDA's architectures, provides full GUI integration - is easy to work with -, makes use of IDA Flirt signatures and will make use of runtime information if you use it together with funcap. There is also Retargetable Decompiler, an ...


11

idaapi.get_imagebase() is your friend. Just in case you didn't know, all the reference documentation for idapython is here Example: Python>hex(idaapi.get_imagebase()) 0x100000L


11

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark here on Read-The-Docs. As mentioned before by @CrazyFrog, you can use: Alexander Hanel's book and blog; Ero Carrera's Intro to IDAPyton; Additionally, there ...


11

What you're seeing is an efficiency trick that compilers like to use. Internally, the CPU doesn't make a difference between numbers and addresses - 32 bit integers and pointers are the same thing. (Or 64 bit, if you're using newer architecture, but as your register names start with e, you're using 32 bit). The lea instruction loads the address of its ...


Only top voted, non community-wiki answers of a minimum length are eligible