11 votes

What causes the need for NOP sleds?

On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
user avatar
  • 6,859
6 votes

DLink LIF firmware: Error reading block 1191378964 from file. (Success)

There is no LIF file in the D-Link binary file containing the firmware image. file returns a false positive. Since there is no LIF file present, tools in the lifutils package will fail or produce ...
user avatar
  • 6,859
5 votes
Accepted

How to obfuscate x86 assembly code?

You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or ...
user avatar
  • 1,814
5 votes
Accepted

How to disable relro while compilation?

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by ...
user avatar
  • 1,447
3 votes

__security_cookie for function pointers in Windows 10

Look for the writes to the qword_18009FBD0 to see where it's initialized. Apparently it's a part of an array called __encodedKERNEL32Functions where various pointers to kernel32 functions are ...
user avatar
  • 34.9k
3 votes

Is MD5 hashing of files a valid method of creating an anti-virus program?

Not in the long run. Hashing of certain parts of files is still used to push data updates quickly when a new malicious sample shows up in the wild, to get the clients protected as soon as possible. ...
user avatar
  • 151
3 votes

Is MD5 hashing of files a valid method of creating an anti-virus program?

This paper shows why it is not the best choice using MD5 for virus signatures. You should avoid SHA-1 also, because practical collision may be possible within years. So, consider using SHA-256 or SHA-...
user avatar
  • 1,731
3 votes
Accepted

Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)?

The import table can theoretically have as many references to a DLL as there are imports. It is a function of the linker that produces this effect, and in some cases, the linker does not perform any ...
user avatar
  • 4,511
3 votes

Taking up reverse engineering as a research topic, need advice

Bachelor's project is supposed to be a showcase of a person's strengths in computer science ... I don't have any first hand experience of [reverse engineering] Given your two statements ...
user avatar
2 votes

Is the security of this .net application flawed?

If the whole purpose of your application is to let the user input some data and then create a file in a specific file format from that data and you want to prevent unauthorized users from doing that, ...
user avatar
  • 400
2 votes
Accepted

LastPass Android javascript behaviour

In short, no. If they're going to implement the "crypto" in Javascript in this way there isn't anything you can do beyond more obfuscation. This is 100% applicable to this situation but see MataSano's ...
user avatar
  • 972
2 votes

Sniffing TCP packets using Wireshark

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -...
user avatar
  • 141
2 votes
Accepted

Detecting cracked Themida packed malware

From Oreans KB: The Taggant System is a cryptographic signature added to a software to fight against antivirus false positives in protected applications. The Taggant information in your Themida/...
user avatar
  • 34.9k
2 votes

How would I go about finding the 'flag' in this QR image(Capture the Flag)?

Its a base64 that once decoded will give you a HEX string, that if converted to chars will let you find your reversed flag string: Redacted reversed flag: }6b4d**********05b{galf Redacted flag is: ...
user avatar
1 vote

How to read data from android.car.cluster

I'm going to guess this is MPEG Streaming of some manner. Here's what file run at various byte offsets into the first 10k bytes of the file produces: 598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 ...
user avatar
1 vote

Linux encryption/luks/pymouth password scripts corruption

Relax. Don't panic. Those "highly suspicious binary bytes" are the UTF-8 representation of U+2026, which is the Ellipsis .... It's just to print exactly that string that you're quoting. It probably ...
user avatar
  • 2,274
1 vote
Accepted

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

During Kernel Initialization ntKiSystemCallSelector is Initialized from LOADER_PARAMETER_BLOCK 0: kd> dt nt!_LOADER_PARAMETER_BLOCK Extension->VsmConfigured +0x0f0 Extension ...
user avatar
  • 15k
1 vote

What causes the need for NOP sleds?

As you mentioned, many things can leave you with a different memory layout than the one you expect: The name of the binary is one. The environment variables the binary gets is another one. If it's ...
user avatar
  • 127
1 vote

How to find vulnerabilities in stripped binaries?

Generally speaking finding vulnerabilities is not only about static reverse engineering, there are also dynamic techniques such as fuzzing. There are some fuzzing frameworks/products that can be used ...
user avatar
  • 7,875
1 vote

Is MD5 hashing of files a valid method of creating an anti-virus program?

No form of hashing, when used alone, is a good way of developing an AV solution. While hashes can be useful for finding instances of a known sample across a network, heuristic and behavioural AV ...
user avatar
1 vote

Taking up reverse engineering as a research topic, need advice

Visit a site with legal reverse engineering challenges like e.g. crackmes.de, solve at least five challenges up to a level of three (level one being the easiest, 5 and up are difficult even for the ...
user avatar
  • 1,814
1 vote

Taking up reverse engineering as a research topic, need advice

I would also not recommend it. Reverse Engineering is a topic that's too advanced for many/most senior IT professionals in the industry. It would be a very risky experiment on your behalf!
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible