Hot answers tagged

2

What should I learn before I start to learn reverse engineering? Assembly is a must. Without deep understanding of assembly you cannot reverse engineer anything seriously. Additionally, you'll have to become familiar with relevant tools, depending on the platform; not knowing every detail of them, just basic use - you will learn more complex things in ...


2

First of all, welcome to the fascinating and frustrating world of malware reversing. What should I learn before I start to learn reverse engineering? I believe that the best way is start to learn basic reverse engineering and improve as you go. Is learning programming with C/C++ a MUST? No, it's not a "MUST." However, if you don't know how to program,...


2

This may either be packed multiple times or contain additional obfuscations or anti-analysis. Use the "PUSHAD, breakpoint on ESP, run" method to find the tail transition, as you have. Then set a breakpoint on the tail transition (in your case, JMP 0002A99E) and run to that. The single-step to take the jmp and you'll be at the OEP, or the next stage of ...


1

OllyDbg is interpreting numbers as hex by default. But 0x55000 is larger than 0xFFFF so it cannot be stored in a 16bit register, which ax is, hence it complains. If you meant the decimal number 55000, I think you can enter it as "55000." with the trailing dot. If that doesn't work enter the number as hex: mov ax, 0D6D8 The leading 0 is necessary otherwise ...


1

It's a matter where you want to break. The address 0x770B0D54 is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before main is executed and you want to step through that. On the other hand 0x00043b33 is int user code and it's probably the address of the main function so that is the real code ...


1

Out of the box, x64dbg doesn't have a feature to show Win API call descriptions unlike OllyDbg. For that, you need to use a plugin like xAnalyzer or the older APIInfo Plugin.


1

ctrl+t -> Set Trace Condition checkmark condition is true check box and enter the condition in your case ecx == 12345678 and start tracing with either ctrl+f11 or ctrl+f12 snap shot shows trace record for condition ecx == eip


1

(Not exactly an answer but too long for a comment) This sounds like a simple problem but technically it isn't! I'd like to explain why and how if there is a solution for it, it is probably going to be very very slow. A debugger does not actually know all the register values at every single point in the program. It doesn't know any register values until a ...


1

I assume that you don't have any more information about this Secret dialog window than what you have written (that is you don't know how it looks like and the strings it contains, etc.). In such a case, you can search for GetKeyboardState function that may be used to obtain the keys pressed at a given time. After finding it, just look at the subsequent ...


1

If you are using OllyDbg, I suggest installing an anti-anti-analysis plug such as ScyllaHide. For ScyllaHide, grab the latest from the releases and follow the instructions in the ScyllaHide.pdf document. Then you can try the various techniques simply through a set of checkboxes. Generally, if you suspect that a particular anti-analysis technique is being ...


1

version used: ollydbg v2 but method is similar for v1 too ollydbg allows you to log the trace i have done some crude diffs in the past as below you can try improvise here is the source code that's used for demo keep in mind i had the source so i compiled it and linked with with /FIXED linker switch to vs 2017 linker so that ASLR doesn't get into ...


1

Switch to graph mode, then go to menu Options-General, Disassembly tab and enable [x] Line Prefixes (graph) Other disassembly options : https://www.hex-rays.com/products/ida/support/idadoc/605.shtml. You can also check the status bar, it displays the current address.


1

In general, stepping back for a debugger is a hard problem. gdb has a limited step back feature but it comes with a cost, see here. But, when you think about it, the whole difficulty solved by the programmer when debugging is to step-back until it reach the bug. This is the whole difficulty and we do not have a nice and automated solution for it right now.


1

Win32 debugger is IDA's internal debugger, whereas WinDbg is Microsoft's debugger. They both effectively do the same thing. IDA's debugger is probably better integrated with IDA. I'm going to make a recommendation here to use x64dbg. Ollydbg is outdated and unsupported. IDA's debugger works but the interface is clunky and isn't as easy to use as x64dbg. Plus ...


1

There's also the possibility to set a screen to full screen with the function SetRect I found this spot on the mentioned executable: 0x004619bf mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics] 0x004619c5 push 1 0x004619c7 call esi 0x004619c9 push eax 0x004619ca push 0 0x004619cc call esi 0x004619ce push eax 0x004619cf push 0 0x004619d1 push 0 ...


Only top voted, non community-wiki answers of a minimum length are eligible