16

It's a false positive. There is no LZMA-compressed data in the binary. Running binwalk without any arguments other than the firmware binary file name is equivalent to running it with the -B or --signature arguments, which directs binwalk to perform a signature scan. Since a signature scan is essentially search for particular byte sequences, false positives ...


10

In x64, any operation on a 32-bit register clears the top 32 bits of the corresponding 64-bit register too, so there's no need to use xor rax, rax which would necessitate an extra REX byte for encoding.


7

You can modify strings or other bytes within the hex editor (⇧⌘H) or click on the hex edit panel. Then modify whatever you want You'll need to write a new executable back (⇧⌘E) if you want to save it. Also, be aware that if it is a signed binary, you will need to remove any code signature or resign it as the binary won't match the signature after a change....


6

You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:


5

"File Size" is the size of the file on disk, according to the file system. "PE Size" is the value of the SizeOfImage field in the IMAGE_OPTIONAL_HEADER structure in the PE file. Its value is calculated as described here: IMAGE_OPTIONAL_HEADER.SizeOfImage is the size of the loaded executable/dll in virtual memory. It is not the same as the size on ...


5

The answer is no. Unlike bitwise XOR, bitwise AND can't be reversed: 0 & 1 = 0 0 & 0 = 0 Both AND and OR are not reversible. This is in contrast to XOR and NOT operators which are reversible.


5

If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in place of unneeded bytes) or equal to the number of bytes of an instruction or group of instructions that you'd like to patch. Take this instruction, for example:...


4

It may be generated dynamically, loaded from a file, be there, but obfuscated or encrypted, in the original .exe, or something else. The easiest way to get the url is probably using Fiddler, as you're on windows. Listening to network communication with wireshark or a similar program might work as well, but if the application uses TLS, encryption will get in ...


4

You can get low-level bytecode source of .beam file with beam_disasm:file(module_name) It's not easy to read it and takes time to figure it out. But it's much verbose and easier to comprehend than any real hardware assembly code. You can give it a try. For example, if you have a .beam file called "my_module.beam", open erl and type file:write_file("/tmp/...


4

The MessageBox API just creates a windows dialog and spins in a message loop until it is closed. A program can do this themselves without using MessageBox, you can look for calls to either CreateDialog, or CreateWindow.


4

These are not real strings, thats just binary data that can be interpreted as strings. That's how tools like BinText work - by trying to evaluate any sequence of bytes as a string and accepts it as one when a threshold is passed (usually around 4 characters). I'm not familiar with BinText, but the tool I frequently use for such tasks is 010 Editor (http://...


4

In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, etc. into this address range, and you'll see the same memory - and the same contents - no matter if you access cs:[something], ds:[something] or ss:[something]*. ...


4

First you need to determine if it is windows message box or not. What kind of message is in the message box (custom/standard win32/compilation of system strings)? Also an screen-shot would be nice if possible (so we can see more...) If you can make it work on some test machine then check also the CLASS_ID of the message box it can reveal if it is windows ...


4

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them. For example instead of do this const char *msg = "Good morning"; You can do const char *msg = "R29vZCBtb3JtaW5nCg==";...


4

The opcode you are interested in is a9 01 00 00 00 standing for test eax, 1. The easiest way to get the opcode of assembly instruction is just to compile it and disassemble the result (for example using nasm and then objdump or simply this site) - this way you don't have to remember anything about the opcodes which are sometimes weird. However, you want ...


3

A Lame brute forcer with an arbitrary seed value using the code you provided finds a few collisions under an hour #include <stdio.h> #include <windows.h> int bitXor(int a,int b) { return (a & ~b) | (~a & b); } void hashit( void) { SYSTEMTIME st; unsigned long specialNum=0x4E67C6A7,savedspecialNum=0x4E67C6A7; unsigned int ...


3

If you are running Linux, you can run the strings command to view the hardcoded strings within the binary you are analyzing. Example: $ strings my_executable The strings program is also available for Windows here. You would run it the same way you would on Linux: C:> strings my_executable.exe I would also like to point out that some strings are ...


3

Open the executable file with a hex editor, search for the string "Continue", and overwrite those bytes with the string "Carry on".


3

Well, I was tying few weeks ago to implement an ollyscript which triggers conditional beakpoints on each line where a desired alpha/numerical value is found. This program gives the user the choice of following one of 3 methods: 1- Trace methode (which works with numbers) 2- Memory breakpoints 3- Smart research by setting unconditional breakpoints (works ...


3

possibilities: Maybe the protection has been changed as @Guntram Blohm said. Have you checked your OllyDBG version. I guess this problem might have been occurred because your version doesn't support OS architecture or to be more specific, it doesn't have the proper plugins. Suggestions: Try to use "R4ndoms_OllyDBG" mod of OllyDBG... it's compatible with ...


3

There are a lot of way to hide strings to the debugger. A simple encryption at runtime can daunt new reverser to work on it. Try this plugin sometimes it helps to find strings that Ollydbg doesn't show: https://tuts4you.com/download.php?view.107 If also with Ultra string reference you don't get results, run the software in the debugger and then search for ...


3

Something is wrong here, since the original push ebp; mov ebp, esp is 32 bit code, and the modified pop rax is 64 bit code. You might want to sort that out before proceeding. That said, in IDA: locate the method in the graph view, or disassembly view. The bottom line in this view will show you the load address of the current instruction as well as the ...


3

To understand what's happening, you need to learn about Position Independent Code (PIC). In a nutshell, the compiler wants the executable code to be correct independent of where in memory it gets loaded. In the case of a shared library, the OS may load it at a different place every time; even if statically linked, PIC will make the linker's life easier. ...


3

The Win32 resource data is usually not referenced directly from the code; resource APIs such as FindResource, LoadResource and LockResource are used to access that data. You can use a resource editor to view or edit the resources (and then look for their IDs used in the above APIs). If you do want to figure out how the resources are stored on the binary ...


3

The parts you've commented are mostly related to exception handling. The compiler has to guard for possible exceptions which may happen at any time, even if your program does not explicitly use exceptions. In particular, var_4 is the so-called "trylevel" of the current execution point and var_C is the exception registration record for the SEH mechanism. ...


3

Can you post the classfile, as well as the changes you want made to it? Depending on the changes, it should be possible. Obviously if you want to add a lot of new code or data, that won't be possible without changing the size, unless you delete a corresponding about of existing code from the classfile. Anyway, Krakatau is capable of editing a classfile ...


3

I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called "Evolving Exact Decompilation" published at the Workshop on Binary Analysis Research 2018, where the researchers claimed to have learned/evolved the ability to decompile a C program. See the paper here.


3

Since you have already spent a lot of time on it, I will just show you how to solve it step by step. I recommend you to repeat steps I'm describing, since the best way to learn is to practice. Tool I will use radare2 for solving this challenge, but it's of course possible to use other tools as well. The reason I chose it is simple: it recognises go library ...


3

Following quote comes from unix.stackexchange: To patch a file means to modify it, with the connotation that the modification is generally small. So, patching the executable is a process of changing its content usually performed for changing its original behaviour. Patching is obviously not allowed means that the author of a particular crackme wants you ...


3

The encryption key is stored in the variable f4800b. It comes out to the following byte array. 43, 57, 97, -68, -63, -61, -40, 9, 50, 87, -104, 101, 63, 34, -78, 60 The cipher algorithm used is Triple-DES in ECB mode. It can be decrypted by the following snippet. Note that it requires the BouncyCastle Crypto provider for Java. import java.security.*; ...


Only top voted, non community-wiki answers of a minimum length are eligible