13

Such questions rarely have straightforward answers but I'll try to point you on a right path. Firstly, Build a toolbox : gather as much tools as you can & start playing. Then, master the ones which you find useful or develop your own when you can do better. By tools, I mean disassemblers, hexeditors, decompilers, debuggers, automation scripts, ... ...


13

First of all, I have bad news for you ! Doug Lea's malloc is almost no more used in any C library implementation (even if understanding dlmalloc can help a lot to understand new ones). The new implementation that is most widely used is ptmalloc2 and the best way to learn about it is... to read the code... So, if you are using a Debian(-like) distribution, ...


7

You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No. Update Ok, as the author updated it with a more clearer question... this is what one can do: Strip symbols from the binaries. At the very least. Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...


7

There's always some special kind of software that requires specific mathematical skills. For example, if you want to reverse some malware that encrypts files, skills in cryptography will help you identify algorithms. Or, if you want to reverse some software that calculates, say, antennas, knowing equations from radio engineering will help you. But, to ...


7

If your application can decrypt the files, then you should assume that anyone sufficiently interested can do so as well. End of story. Obfuscation can slow people down, but it won't stop everyone, and it probably won't be as effective as you think it will be.


5

you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image. In very old binaries, this structure might be not used, or SecurityCookie RVA is 0 even though the binary may be using /GS. In such case you can scan for the characteristic code signature of the @__security_check_cookie@4 function: ...


4

As for C compiler (gcc), first make sure you do not make a mistake of compiling it with -g option (adds symbols for debugging, basically whole source code). -g Produce debugging information in the operating system's native format Secondly, try with -s option: -s Remove all symbol table and relocation information from the executable. Without ...


3

I don't know about deep learning, but if you are looking for general results on using machine learning for reverse engineering, there was a paper called "Evolving Exact Decompilation" published at the Workshop on Binary Analysis Research 2018, where the researchers claimed to have learned/evolved the ability to decompile a C program. See the paper here.


3

Hiding the keys anywhere in the apk (including .so files) is definitely not enough to keep the keys secret for the long time. The code that can be executed definitely can be reverse engineered, and the key could be extracted - even without having fancy decompiler and knowing ARM architecture well (by the way, there is a non-commercial decompiler for arm32). ...


3

We are using a C library in our application, however. We are using a .so file of this library compiled for the ARM architecture. We use the SWIG interface from our application's main Java code to interact with this library. I am wondering if I can store the private keys in this library's source code and then access these keys via SWIG binding functions. I'm ...


3

the latest visual studio compilers use runtime checks to detect overflows it performs them using a variety of run-time checks you can use them in un-optimized builds only /Od (these don't work in optimized builds not with /O1 or /O2 or /Ox) these can be either #pragmas or /RTC1 /RTCS | U | C command-line switches the stack corruption is detected by ...


3

Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion. otkloadr.dll is a library used for Visual Studio / office integration, as part of a package called "Microsoft Visual Studio Tools for the Microsoft Office System". That package is used to incorporate Visual Studio ...


2

If the whole purpose of your application is to let the user input some data and then create a file in a specific file format from that data and you want to prevent unauthorized users from doing that, then yes, moving the file creation to a server will prevent that. Though there are still some things to keep in mind: You need to secure your server. If an ...


2

Your wireshark logs should tell you if the game tries to resolve some DNS entries that don't exist anymore (or maybe even some that do exist), and to which IP addresses it connects. If you're lucky, it'll connect to a port 80 somewhere, so you'd know it's trying to talk to a web server. Next, you could set up your own web server, and use tricks like an ...


2

What you pasted is Visual C++'s /GZ switch or for newer versions /RTC. It fills the stack for local variables with 0xCC. What I couldn't find is if there's an actual function that checks at runtime if any of the gaps have been tainted. I assume there is because the compiler should be able to generate those at compile time knowing the stack layout, so at ...


2

I've checked the mentioned chapter and there's also an info about detecting an execution of the instruction on the stack. This is I think more common scenario. As for the overflow detection I can only speculate, but for me it's easier to check, in one place, if all the values that should be 0xCC are still in fact intact the same than to do this every time ...


2

There is no perfect answer for this, it will greatly depend on your tolerance to false positives. Though there are three answers that come to mind depending on you level of effort you're willing to put in. The options are listed from easiest/least work to hardest/most work - if each one is done correctly - the risk of FP also should go down as well. The ...


1

For my knowledge , HASP has a USB pen with something inside and two different drivers running as a service to accept remote and local request of license verification... And the other one is something I do not recall . Probably you could sniff protocol (port 1943 for example) . Sorry but I had not access to the phisical USB pen Probably you can also clone ...


1

I am not sure there is a definitive answer to this. For example, anyone with physical access to the system can do a whole manner of things that TPM may not be able to prevent. For example, the TPM itself could be reverse engineered: http://gcn.com/articles/2010/02/02/black-hat-chip-crack-020210.aspx?m=1 Then you have timing attacks and other side ...


1

Does the book actually use this as an example? This is not going to work in general. The theory behind the snippet is that the code will be compiled in such a way where all of the functions are situated in the assembly language output in the same order in which they were situated in the C code. That is a broken assumption in general. The compiler is under ...


1

First, make sure the app is crashing because you're running it inside of an emulator, Maybe your device is really incompatible. After you made sure your device is compatible with the app your next step would be to try and trace where the function checks if it's an emulator or not. You could try and use stack traces printed to log or decompile the app and ...


1

Such a problem is common with executables having overlay. An overlay is extra data appended at the end of a PE. The overlay is located at the end of the sections. When a PE is loaded the overlay is not mapped into the memory of the process. An overlay is common with installers, self extracting archives etc. In order to extract the overlay, you can use any ...


Only top voted, non community-wiki answers of a minimum length are eligible