Hot answers tagged

12

In C, and many other low-level programming languages the term NULL is equivalent to 0. The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...


7

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, ...


5

esp register is the stack pointer and it points to the head of the stack, which is the lowest address in the binary. #1 Initial stack frame: |local var 1| <- esp (lowest address) |local var 2| |-----------| |-----------| |-----------| |local var n| <- ebp After the push instructions the stack will look at: #2 Stack frame just before the call: |a| <...


5

ISO C and C++ allow implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite requiring that a literal 0 or (void*)0 in the source (in a pointer context) is evaluated as a null pointer, equivalent to NULL. Reasoning based on source definitions like #define NULL 0 is not sufficient in C or C++. But fortunately for ...


5

When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h #ifndef NULL #ifdef __cplusplus #define NULL 0 #else #define NULL ((void *)0) #endif #endif However if you are looking at higher level languages NULL will not necessarily be zero, for example within ....


4

It is also easy using x64dbg. When you break on the WriteProcessMemory the handle will be at [esp+0x4] in the memory. After you write down the handle (in this case 0xDC) you may go to the Handles tab in the x64dbg main window, then Right click -> Refresh. All the handles associated with your debugged process will be listed. Now you need to find the ...


4

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of the call like this 280600000A let's go one by one. 0x28 - is the value for opcode 'call' and it takes one operand. the rest of the opcode is the metadata ...


4

If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing. A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary ...


3

Try enabling break on module load: sxe ld rootkitDriverName See also https://reverseengineering.stackexchange.com/a/2638/60


3

It all depend of what you plan to reverse and how. For purely static analysis, your operating system don't really matter, since there are great tools for both Windows and Linux systems(and nowadays you can even run Linux tools in the Windows linux subsystem, or use wine to emulate Windows utils on a Linux native system). But if you have to run what your are ...


3

You might have a look here It says: off_ data, contains offset value


3

which debugger are you using ? most debuggers will decipher the handle on the spot that is you can find out the handle info when you have broken on the WriteProcessMemory() Call itself here is how you can do it with windbg i am debugging ollydbg and olllydbg ais debugging calc.exe ollydbg is setting a breakpoint in calc.exe (uses WriteProcessMemory() ) ...


2

First of all, I want to clarify some of the concepts about "API calls." I will explain these concepts, mainly thinking of WinAPI and PE files. I'm not claiming these definitions are correct for all systems. Operating system programming interfaces I assume you are referring to OS API libraries as API. OS API is consists of different interfaces that ...


2

Many programs, especially malware, start a suspended child process (CreateProcess variants), overwrite its code with their own (WriteProcessMemory with or without VirtualAllocEx) and resume the main thread (ResumeThread). Also look for ReadProcessMemory, it is possible that the call to OpenProcess that you see is actually the same process reading from its ...


2

The -b switch specifies the format as binary, telling objdump to ignore the header and treat everything as instructions. The -D switch is also present in your question and this one means that objdump will treat the content of all sections as instructions even if it did take the header/file type into account. If you onlt specify -D then it will treat all ...


2

In general, the compilation process removes most of the information not necessary for actual execution. This usually includes: comments local and global variable names local (to the program) function names any code deemed dead (not being executed in any situation) code exhibiting undefined behavior The names you are observing are Windows API names; because ...


2

Yes, Windows 10 can be used for malware analysis. All the modern RE tools, such as IDA Pro, Ghidra, Binary Ninja, etc. run on it.


2

The channel capacity of a single byte samples has a maximum of 8 bits. Another way of thinking about it: If a single byte has the same value for every sample, you need 0 additional bits of information to describe the values. If a single byte takes on 256 different values, [0 to 255], then for every sample you will need 8 additional bits of information to ...


1

Just to add to the previous answer, “cleaning” here is not used in the literal sense but to indicate the the code returns the stack pointer (esp) to the value it had before the call. Unfortunately this term is quite entrenched so will probably continue to confuse new learners in future as well.


1

According to the documentation Page 1320 The result is stored in register AX, register pair DX:AX, or register pair EDX:EAX (depending on the operand size), with the high-order bits of the product contained in register AH, DX, or EDX, respectively. If the high-order bits of the product are 0, the CF and OF flags are cleared; otherwise, the flags are set. In ...


1

Nobody is going to publish their source code for active ransomware, there are various reasons for that: Its a business and the author makes money from it, and by giving away the source code there is a competitor. Of course that is not wanted It is possible that someone will find weaknesses, obviously that is possible for binaries aswell but usually it's ...


1

There are several ways you can achieve this. I assume you don't have source code of the executable, otherwise you would just tell the compiler to for example generate few nops for you after the call opcode, so you would simply patch the call without any data shifting. As you said, you could replace the call with long call (but as far as I know all calls on ...


1

Turns out: adb shell uiautomator dump adb pull /sdcard/window_dump.xml path/to/output or adb shell uiautomator dump --compressed adb pull /sdcard/window_dump.xml path/to/output


1

I figured it out: Right click and go to hex editor, then search the bytes you are looking for, then after finding it right click and select go to code reference.


1

Try to learn the structure of the apk, learn SMALI, understand how the apk works, after understanding what your calls are like and learning smali, it is essential to be able to make calls from resources, but stay tuned for apk protections , even considering a somewhat rare factor, there are also several online tools to assist in this factor, with a simple ...


1

Some ideas: Try using Image File Execution Options registry key to automatically run the debugger when the process starts. Patch an infinite loop (EB FE) at the entry point, start the binary, then attach to it from a debugger started as admin. Use kernel debugger or hypervisor-based debugger to debug the process without relying on user mode debugging ...


1

Agree with Robert - The common way to avoid false positives is having a large software pool of known benign software you can check your rules with. If you are just starting to write yara rules then concentrate on the easy way that is strings, write yara rules based on the unique strings. To answer this: Can anyone tell me which code is suitable and which ...


1

There are probably better answers I'd love to know about but let's say you're looking for instructions that have 0x10 as second operand like: cmp eax, 10 mov esi, 10 You could do something like: for func in idautils.Functions(): flags = idc.get_func_attr(func, FUNCATTR_FLAGS) if flags & FUNC_LIB or flags & FUNC_THUNK: continue ...


1

You can write values to the $zero register, it will simply remain zero. These 3 instructions are NOPs.


1

So, objdump's -d will only disassemble known code sections, usually .text and possibly other sections marked executable. If the section table is corrupted or missing, this will fail. However, the section table is not actually required for a file to be executable by the OS, so it can be removed or modified without affecting the file's behavior. In such ...


Only top voted, non community-wiki answers of a minimum length are eligible