Hot answers tagged

7

From everything I've read pseudo code can't be edited in realtime but can be edited as assembly This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation step looses too much information). Hence they need some help by a human (the reverse engineer). Giving this help is, at least in my opinion, the most important ...


6

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by: Opening the regular Import File... dialog Clicking Options inside ...


5

Following cites, answering your first question come from Windows Internals Sixth Edition Part 1, page 225: Wow64 (Win32 emulation on 64-bit Windows) refers to the software that permits the execution of 32-bit x86 applications on 64-bit Windows. It is implemented as a set of user-mode DLLs, with some support from the kernel for creating 32-bit versions ...


4

The third one is an array to environment variables that this program has access to. If you read the documentation of execve it reads as follows: The argument vector and environment can be accessed by the called program's main function, when it is defined as: int main(int argc, char *argv[], char *envp[]) Note, however, that the use of a third ...


4

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As per IDA documentation: This command allows you to specify how the stack pointer (SP) is modified by the current instruction. You cannot use this command if ...


4

In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block). The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks). For more info check my OpenRCE article.


4

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of the call like this 280600000A let's go one by one. 0x28 - is the value for opcode 'call' and it takes one operand. the rest of the opcode is the metadata ...


4

This general pattern of exclusive-access instructions is usually seen when atomic variables are modified. C++ Example (C++11 or later) #include <atomic> void release( std::atomic<int>& refcount ) { refcount--; } You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code. C Example (C11) #...


4

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


3

There doesn't seem to be a straightforward way to achieve this. But you can take a look at this page of the IDA SDK documentation. According to the description of the previous page, we can write a little helper function: def size_of_operand(op): tbyte = 8 dt_ldbl = 8 n_bytes = [ 1, 2, 4, 4, 8, tbyte, -1, 8, 16, -1, -1, 6,...


3

Although you can use several tools, I would suggest you to use GDB if possible, since it has a built-in feature of breaking at each function call. Now, what you can do, is to run your program two times - first, without pressing buttons, and second, with doing so. I'm attatching a python script that will print each function call with a number of calls to it, ...


3

Here are the required steps using Igor Skochinsky's answer: Clone musl git repository: git clone --depth=1 git://git.musl-libc.org/musl Compile the code: cd musl; ./configure; make -s -j2 Extract Flair tool from IDA SDK. Run pelf (ELF parser) with the musl static library which is compiled in above step: cd ./lib ~/flair/bin/linux/pelf libc.a The ...


3

Quoting the Ghidra Wiki, What processors are currently supported? X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro, 68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64, CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, and variants of these processors. The latest IDA pro supports more than 60 families of processors....


3

The supported processors are listed in the publicly available source code on GitHub. Ghidra and IDA Pro both support quite a wide variety of architectures and processors. It's hard for me to tell which one supports more, and I am not sure how meaningful that kind of comparison is. For more information, see this presentation and associated materials: ...


3

I am assuming that the malware is already on your disk (not all malware hits the disk!). So keep that in mind when following this answer. If this is not the case, please provide more information. On Windows many files that are in use and therefore cannot be deleted can be dealt in one of two ways: rename the file (the ren command on the command prompt ...


3

You need to load the last 64KB of the ROM at linear address 0xF0000 (0xF000:0000) and create there a 16-bit segment with the base 0xF000. Then all your “low addresses” will line up (they point into the current segment with CS=0xF000). In case you get references to E000, load the second 64KB chunk and so on. Once you get to 32-bit code, it will likely be ...


3

Most RTOS code is usually a single monolithic binary and is not split into separate binaries like a high-level OS. Usually there is some startup code, some library routines and user-provided code in forms of tasks which are nothing more than simple functions performing the necessary work in a simple infinite loop. The “main function” called by the RTOS ...


3

MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction. The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's composed of two instructions. lui gp, 0x2 addiu gp,gp,-29952 Screenshot from Online Disassembler The lui (Load Upper Immediate) instruction loads a 16-bit ...


3

As commented, incrementing a maximum value indeed wraps back to 0. However, I’d like to explain a little about why the code looks like this. The original source probably looked similar to: int pos = 0; while (buf[pos]==0) pos++; Now, a naive/literal translation to assembly would have the check and conditional jump out of the loop at the start and an ...


3

Any switches after the input filename are ignored. Just move the filename to the end.


3

using windbg you can set an sxe ld:Modname event break assuming you are running this which will pop up a help gui for printers rundll32.exe printui.dll PrintUIEntry /? if you want to Break on this printUI.dll's CrtMain or AddressOfEntryPoint you can do it like this C:\WINDOWS\system32>cdb rundll32.exe printui.dll PrintUIEntry /? Microsoft (R) ...


3

There can be multiple reasons. the FLIRT signatures which have been loaded automatically do not have a pattern for this specific function. You can check which signatures have been applied and try loading additional ones via Signatures view (Shift-F5). the function pattern was conflicting with another function(s) and has been dropped from the final signature ...


3

Please see Batch Operation In the decompiler’s manual.


3

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - Set R5 to equal the value in R4 r5 >>= 14; // shr r5, #14 - Shift R5 14 bits to the right r5 <<= 1; // shl r5, #1 - Shift ...


2

I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download a payload on your system... And, yes, there have been some examples where security analysis software have been pinpointed with security threats. The last I ...


2

There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly. Original Section ...


2

There's a couple of likely possibilities for how the value of Pi is included in the code - 1) It is calculated using trig functions. e.g. 4.0 * atan( 1.0 ) 2) It is stored as a floating-point constant. In hexadecimal representation these could be - 0x40490FDB // 32-bit floating point 0x400921FB54442D18 // 64-bit floating point However, ...


2

Returning a static value from any function is quite easy. I assume that your calling convention takes return value in the (e|r)ax register. So to return some value, just patch your function to look like mov rax, <value> ret Lets consider an example. #include <stdio.h> int test(int n) { int i, sm = 0; for (i = 1; i <= n; i++) ...


2

not sure what methodology you are looking for if the said gui is under some debugger you can simply detour a patch or if you are under the wndproc Thread of the gui You can use apis (for example for checking the menu wordwrap in notepad use CheckMenuItem(); ) or use the oldest trick SendMessage From an external App a demo and src of the third method ...


2

You can go to function A and press y on the call to B, and edit to int B(int a, int b)


Only top voted, non community-wiki answers of a minimum length are eligible