Skip to main content
11 votes

What causes the need for NOP sleds?

On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely ...
julian's user avatar
  • 7,176
6 votes
Accepted

How to disable relro while compilation?

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by ...
R4444's user avatar
  • 1,807
6 votes

DLink LIF firmware: Error reading block 1191378964 from file. (Success)

There is no LIF file in the D-Link binary file containing the firmware image. file returns a false positive. Since there is no LIF file present, tools in the lifutils package will fail or produce ...
julian's user avatar
  • 7,176
5 votes
Accepted

How to obfuscate x86 assembly code?

You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or ...
josh's user avatar
  • 1,974
4 votes

__security_cookie for function pointers in Windows 10

Look for the writes to the qword_18009FBD0 to see where it's initialized. Apparently it's a part of an array called __encodedKERNEL32Functions where various pointers to kernel32 functions are ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Is MD5 hashing of files a valid method of creating an anti-virus program?

Not in the long run. Hashing of certain parts of files is still used to push data updates quickly when a new malicious sample shows up in the wild, to get the clients protected as soon as possible. ...
Calmarius's user avatar
  • 171
2 votes

Sniffing TCP packets using Wireshark

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -...
CherryDT's user avatar
  • 141
2 votes
Accepted

Detecting cracked Themida packed malware

From Oreans KB: The Taggant System is a cryptographic signature added to a software to fight against antivirus false positives in protected applications. The Taggant information in your Themida/...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How would I go about finding the 'flag' in this QR image(Capture the Flag)?

Its a base64 that once decoded will give you a HEX string, that if converted to chars will let you find your reversed flag string: Redacted reversed flag: }6b4d**********05b{galf Redacted flag is: ...
Soufiane Tahiri's user avatar
1 vote
Accepted

Is this a Bank security device?

This is a Vasco DIGIPASS 260 series code generator. It can be used by banks and any other online or offline service as an authentication device. Since it is a generic device, it may be possible to ...
Yotamz's user avatar
  • 1,272
1 vote
Accepted

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

During Kernel Initialization ntKiSystemCallSelector is Initialized from LOADER_PARAMETER_BLOCK 0: kd> dt nt!_LOADER_PARAMETER_BLOCK Extension->VsmConfigured +0x0f0 Extension ...
blabb's user avatar
  • 16.4k
1 vote

How to read data from android.car.cluster

I'm going to guess this is MPEG Streaming of some manner. Here's what file run at various byte offsets into the first 10k bytes of the file produces: 598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 ...
pythonpython's user avatar
1 vote

How to reverse engineer an exe built using nexe?

Yes. nexe embeds the code in the built binary. Here's a simple example root@67989c78b131:/tmp# echo "console.log('habibibibi');" | nexe --build ℹ nexe 4.0.0-beta.17 ✔ Already downloaded... ✔ ...
sudhackar's user avatar
  • 2,709
1 vote

Linux encryption/luks/pymouth password scripts corruption

Relax. Don't panic. Those "highly suspicious binary bytes" are the UTF-8 representation of U+2026, which is the Ellipsis .... It's just to print exactly that string that you're quoting. It probably ...
Jongware's user avatar
  • 2,364
1 vote

What causes the need for NOP sleds?

As you mentioned, many things can leave you with a different memory layout than the one you expect: The name of the binary is one. The environment variables the binary gets is another one. If it's ...
newlog's user avatar
  • 127
1 vote

How to find vulnerabilities in stripped binaries?

Generally speaking finding vulnerabilities is not only about static reverse engineering, there are also dynamic techniques such as fuzzing. There are some fuzzing frameworks/products that can be used ...
w s's user avatar
  • 8,508
1 vote

Is MD5 hashing of files a valid method of creating an anti-virus program?

No form of hashing, when used alone, is a good way of developing an AV solution. While hashes can be useful for finding instances of a known sample across a network, heuristic and behavioural AV ...
Andy Dove's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible