9

It's a false positive. There is no LZMA-compressed data in the binary. Running binwalk without any arguments other than the firmware binary file name is equivalent to running it with the -B or --signature arguments, which directs binwalk to perform a signature scan. Since a signature scan is essentially search for particular byte sequences, false positives ...


7

In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for encoding.


6

You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:


6

You can modify strings or other bytes within the hex editor (⇧⌘H) or click on the hex edit panel. Then modify whatever you want You'll need to write a new executable back (⇧⌘E) if you want to save it. Also, be aware that if it is a signed binary, you will need to remove any code signature or resign it as the binary won't match the signature after a change....


5

"File Size" is the size of the file on disk, according to the file system. "PE Size" is the value of the SizeOfImage field in the IMAGE_OPTIONAL_HEADER structure in the PE file. Its value is calculated as described here: IMAGE_OPTIONAL_HEADER.SizeOfImage is the size of the loaded executable/dll in virtual memory. It is not the same as the size on ...


5

The answer is no. Unlike bitwise XOR, bitwise AND can't be reversed: 0 & 1 = 0 0 & 0 = 0 Both AND and OR are not reversible. This is in contrast to XOR and NOT operators which are reversible.


4

You can get low-level bytecode source of .beam file with beam_disasm:file(module_name) It's not easy to read it and takes time to figure it out. But it's much verbose and easier to comprehend than any real hardware assembly code. You can give it a try. For example, if you have a .beam file called "my_module.beam", open erl and type file:write_file("/tmp/...


4

The MessageBox API just creates a windows dialog and spins in a message loop until it is closed. A program can do this themselves without using MessageBox, you can look for calls to either CreateDialog, or CreateWindow.


4

In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, etc. into this address range, and you'll see the same memory - and the same contents - no matter if you access cs:[something], ds:[something] or ss:[something]*. ...


4

These are not real strings, thats just binary data that can be interpreted as strings. That's how tools like BinText work - by trying to evaluate any sequence of bytes as a string and accepts it as one when a threshold is passed (usually around 4 characters). I'm not familiar with BinText, but the tool I frequently use for such tasks is 010 Editor (http://...


4

First you need to determine if it is windows message box or not. What kind of message is in the message box (custom/standard win32/compilation of system strings)? Also an screen-shot would be nice if possible (so we can see more...) If you can make it work on some test machine then check also the CLASS_ID of the message box it can reveal if it is windows ...


4

The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1. The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example using nasm and then objdump or simply this site) - this way you don't have to remember anything about the opcodes which are sometimes weird. However, you want ...


3

Open the executable file with a hex editor, search for the string "Continue", and overwrite those bytes with the string "Carry on".


3

A Lame brute forcer with an arbitrary seed value using the code you provided finds a few collisions under an hour #include <stdio.h> #include <windows.h> int bitXor(int a,int b) { return (a & ~b) | (~a & b); } void hashit( void) { SYSTEMTIME st; unsigned long specialNum=0x4E67C6A7,savedspecialNum=0x4E67C6A7; unsigned int ...


3

Well, I was tying few weeks ago to implement an ollyscript which triggers conditional beakpoints on each line where a desired alpha/numerical value is found. This program gives the user the choice of following one of 3 methods: 1- Trace methode (which works with numbers) 2- Memory breakpoints 3- Smart research by setting unconditional breakpoints (works ...


3

possibilities: Maybe the protection has been changed as @Guntram Blohm said. Have you checked your OllyDBG version. I guess this problem might have been occurred because your version doesn't support OS architecture or to be more specific, it doesn't have the proper plugins. Suggestions: Try to use "R4ndoms_OllyDBG" mod of OllyDBG... it's compatible with ...


3

There are a lot of way to hide strings to the debugger. A simple encryption at runtime can daunt new reverser to work on it. Try this plugin sometimes it helps to find strings that Ollydbg doesn't show: https://tuts4you.com/download.php?view.107 If also with Ultra string reference you don't get results, run the software in the debugger and then search for ...


3

It may be generated dynamically, loaded from a file, be there, but obfuscated or encrypted, in the original .exe, or something else. The easiest way to get the url is probably using Fiddler, as you're on windows. Listening to network communication with wireshark or a similar program might work as well, but if the application uses TLS, encryption will get in ...


3

To understand what's happening, you need to learn about Position Independent Code (PIC). In a nutshell, the compiler wants the executable code to be correct independent of where in memory it gets loaded. In the case of a shared library, the OS may load it at a different place every time; even if statically linked, PIC will make the linker's life easier. ...


3

The Win32 resource data is usually not referenced directly from the code; resource APIs such as FindResource, LoadResource and LockResource are used to access that data. You can use a resource editor to view or edit the resources (and then look for their IDs used in the above APIs). If you do want to figure out how the resources are stored on the binary ...


3

The parts you've commented are mostly related to exception handling. The compiler has to guard for possible exceptions which may happen at any time, even if your program does not explicitly use exceptions. In particular, var_4 is the so-called "trylevel" of the current execution point and var_C is the exception registration record for the SEH mechanism. ...


3

I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called "Evolving Exact Decompilation" published at the Workshop on Binary Analysis Research 2018, where the researchers claimed to have learned/evolved the ability to decompile a C program. See the paper here.


3

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them. For example instead of do this const char *msg = "Good morning"; You can do const char *msg = "R29vZCBtb3JtaW5nCg==";...


3

Following quote comes from unix.stackexchange: To patch a file means to modify it, with the connotation that the modification is generally small. So, patching the executable is a process of changing its content usually performed for changing its original behaviour. Patching is obviously not allowed means that the author of a particular crackme wants you ...


2

PatchDiff2 is open-source, so you can edit it yourself to write the output to a file.


2

The answer lays within the comments, read Binary Diffing by Nicolas A. Economou (CoreImpact) 2009 to see why. Good Binary Diffing is in fact a way harder subject that does a lot more than compare bytes or bits. Making a Binary Diff with objdump and meld is really not the way to go. Read the CoreImpact document and it will show some of the issues with ...


2

Whatever you enter in the "Condition" field is executed as an IDC script. According to the IDA debugger documentation, the action is supposed to be a test. It's unclear if it explicitly allows assignments or if it's just a side effect that sometimes works. Try something like this instead: SetRegValue(al-1, "al") I don't have IDA on hand to test this out, ...


2

Code before This is my string relies on addresses/offsets of data (and possibly code) after This is my string. When you insert the string new, you're effectively shifting the code/data after This is my string to the right by 4 bytes. When code before This is my string tries to access that content, it access the wrong content since the location has been ...


2

The windows that says disassembly is from ollydbg version 1.10. The windows that says command the one you are looking at is from ollydbg 2.01.


2

To search for strings you could always use radare2 once installed use a terminal to navigate to the directory the file is in then type rabin2 -z filename


Only top voted, non community-wiki answers of a minimum length are eligible