13 votes

Struggling between syscall or sysenter ( Windows )

The Intel and AMD instruction sets are similar but not identical. There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc. The fast system call interface is yet ...
  • 632
11 votes
Accepted

Setting a breakpoint at system call

In gdb you can set a syscall breakpoint with catch syscall. If this is in 32-bit x86 (IA-32), check the syscall number in your_linux_source_dir/usr/include/asm/unistd_32.h. There is no syscall called ...
  • 425
7 votes
Accepted

Why/how is GDB allowed to attach to a process and read/write to attached process' address space?

2) The system call is ptrace. That call has lots of functionality, including "copy a section of the tracee's memory into a local buffer in my address space" and the reverse "copy my buffer to the ...
5 votes
Accepted

How to reverse engineer a setjmp/longjmp sequence?

I'll start with answering a few basic questions, some of which you didn't even ask! What are segment registers doing in modern code? It's been a while since we've needed extra registers to address a ...
  • 11.4k
4 votes

Why are certain functions from kernel32.dll always imported?

At a guess (since you don't provide much detail), the binaries you're looking at were compiled using a recent version of Microsoft Visual C++. The listed APIs are used by its CRT (C runtime) library ...
  • 35.1k
3 votes
Accepted

Does the operating system you use matter?

It all depend of what you plan to reverse and how. For purely static analysis, your operating system don't really matter, since there are great tools for both Windows and Linux systems(and nowadays ...
  • 639
3 votes
Accepted

How to make sense of RTOS in firmware?

Most RTOS code is usually a single monolithic binary and is not split into separate binaries like a high-level OS. Usually there is some startup code, some library routines and user-provided code in ...
  • 35.1k
3 votes

Taking up reverse engineering as a research topic, need advice

Bachelor's project is supposed to be a showcase of a person's strengths in computer science ... I don't have any first hand experience of [reverse engineering] Given your two statements ...
2 votes

Instrumenting syscall by static binary rewriting

PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation. Snippet using theses APIs : (credits to Jurriaan Bremer) #include <stdio.h> #include "...
  • 578
2 votes
Accepted

Patch driver loading process

Yes, you would need to patch ci.dll (which contains the list of hardcoded Root CAs) and winload.exe (which validates the integrity of ci.dll). You can find this discussed in http://www.programdevelop....
2 votes
Accepted

Extra bytes between clusters in FAT12

Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format. There's a newer specification of the file format as well, ...
2 votes
Accepted

pintool to intercept writes and VirtualProtect

Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on ...
  • 261
2 votes

System programming and reverse engineering

Generally a reverse engineer translates assembly code to a higher level language, for that reason it is quite a necessity to be familiar with that language (or at least a similar language), usually ...
  • 11.4k
2 votes
Accepted

Is there any ready-to-go malware analysis/reverse engineering OS? (That is capable of installing on hard disk, preferably)

FireEye's FLARE VM FLARE VM is a freely available and open sourced Windows-based security distribution designed for reverse engineers, malware analysts, incident responders, forensicators, and ...
  • 6,889
2 votes
Accepted

Windows 10 will not run hex edited application

I think “notepad.exe” has been digitally signed by Microsoft. You cannot change it because the signature will ( very very probably) be invalid. The OS doesn’t trust it anymore.
1 vote

Where are the intel manual x86-16?

The Intel processors still support 16-bit real mode so the latest manuals do describe it as well, although not as prominently as protected or long mode. Look for mentions of “Real-Address or Virtual-...
  • 35.1k
1 vote

Is relocation table only used for absolute addresses?

Sections are always mapped to the same location relative to each other (the section table in the file describes the layout, via the VirtualAddress field). Only the starting address for the entire ...
  • 4,511
1 vote

How to dump firmware from car head-unit (VW Radio)

It is a bit of a chicken and egg issue here. While it may be possible that there is some custom USB command to dump the firmware, you’re unlikely to discover it by chance without analyzing actually ...
  • 35.1k
1 vote

System programming and reverse engineering

Generally system programming is not required, but recommended... It is also important to understand the application flow, the CPU architecture (stack, heap, exceptions), file format (PE, ELF). I ...
1 vote
Accepted

Get bindiff of operating system or modified files post upgrade

I would like to see the actually files that were patched ... Old-school: Winalysis New-school: Attack Surface Analyzer ... and see what in the code might have been changed and see what the problem ...
1 vote

Taking up reverse engineering as a research topic, need advice

Visit a site with legal reverse engineering challenges like e.g. crackmes.de, solve at least five challenges up to a level of three (level one being the easiest, 5 and up are difficult even for the ...
  • 1,814
1 vote

Taking up reverse engineering as a research topic, need advice

I would also not recommend it. Reverse Engineering is a topic that's too advanced for many/most senior IT professionals in the industry. It would be a very risky experiment on your behalf!

Only top scored, non community-wiki answers of a minimum length are eligible