Hot answers tagged

4

The third one is an array to environment variables that this program has access to. If you read the documentation of execve it reads as follows: The argument vector and environment can be accessed by the called program's main function, when it is defined as: int main(int argc, char *argv[], char *envp[]) Note, however, that the use of a third ...


1

The supported processors are listed in the publicly available source code on GitHub. Ghidra and IDA Pro both support quite a wide variety of architectures and processors. It's hard for me to tell which one supports more, and I am not sure how meaningful that kind of comparison is. For more information, see this presentation and associated materials: ...


1

Quoting the Ghidra Wiki, What processors are currently supported? X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro, 68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64, CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, and variants of these processors. The latest IDA pro supports more than 60 families of processors....


1

You can't just remove bytes since that would shift the following opcodes and invalidate all relative jumps/calls. The usual approach in such cases is patching the junk instructions with NOPs (0x90 for x86/x64). You can write a smalls script to do it (e.g. using patch_byte).


1

Procedure: Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab. Find the binary name in info column. Then copy the address with the right click on it. For example, in the following screenshot, the x86_64 PE binary name is Project1.exe and the base address is 0x00007FF6A4850000. Rebase in IDA: Open the binary in IDA. Click on Edit >...


1

Here are the required steps using Igor Skochinsky's answer: Clone musl git repository: git clone --depth=1 git://git.musl-libc.org/musl Compile the code: cd musl; ./configure; make -s -j2 Extract Flair tool from IDA SDK. Run pelf (ELF parser) with the musl static library which is compiled in above step: cd ./lib ~/flair/bin/linux/pelf libc.a The ...


Only top voted, non community-wiki answers of a minimum length are eligible