New answers tagged

3

This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select option "Rename all occurrences" and give everything human readable name. You can search for how a variable or function is generally used and give it a name based ...


0

There is no easy way to do that. Several approaches: Build your own libc for ARM and then do a compare using IDA FLIRT, bindiff, diaphora or similar, or just use is as a reference to see how those function should look like. Look for the most referenced functions, a good chance that some of them will be libc. After finding some, look at the neighbor ...


0

It depends on what you are achieving: source code extraction (say to replicate it with minor modifications) program patching For the first case, I normally try to use a non invasive debugger attached after suspending the process. If this does not work, I dump the whole process with SysInternals Process Explorer or WinDbg after suspending the process. The I ...


0

I would try to determine the OOP language it was written there might be tools/IDA scripts to help with static analysis I have found the easiest way to reverse this kind of app is using time travel debugging trace (or similar) On Windows platform this is achieved by downloading WinDbg Preview from Windows 10 store. Once downloaded you can copy the files and ...


Top 50 recent answers are included