Hot answers tagged

36

Compiler The choice of a compiler has minimal effects on the difficulty to reverse engineer your code. The important things to minimize are all related to information leaks from your code. You want to at least disable any runtime type information (RTTI). The leakage of type information and the simplicity of the instruction set of the virtual machine is one ...


18

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-transformation.org/Transform/PcExeFormat), and at that position you can see the correct signature P3. According to the header info, the executable's length is ...


13

There are several approaches to locating strings in an unknown file. One you already tried: strings. This looks for plain, unencoded ASCII text: Strings looks for ASCII strings in a binary file [..] A string is any sequence of 4 (the default) or more printing characters ending with a newline or a null. (man strings) But there are many reasons why ...


9

The IDAScope plugin has similar functionality to rename functions based on the Windows API functions they are calling. You can find a standalone script here that does that http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html it should give you an idea how to implement what you are looking for.


9

At 0xC02860F0 hit Alt+A and select unicode to define it as a unicode string. IDA should recognize the reference after you do so.


7

The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a reference to text1 to be written to the stack text1 must be passed as an argument to a function which is called. When a function is called and a new stack frame ...


7

Writing your example, aaa b in binary, and as well the encoded string, 0xb0 0xb0 0x30 0x10 0x31: a a a ' ' b 01100001 01100001 01100001 00100000 01100010 10110000 10110000 00110000 00010000 00110001 it looks like every byte of the encoded string being the original byte shift right by one bit, with the last bit of the next ...


6

It's a lot of questions, here are a few answers: How can we write something in memory with a format string vulnerability ? For this, you need to know two specific features used in the printf format string specifications. First, %n is a format specifier that has the following effect (according to the manual page): %n The number of characters written so ...


6

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform reverse() on the function. We can domnstrate it using python's maketrans method: The method maketrans() returns a translation table that maps each ...


5

There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida. The fact that your memdumpbin uses the address 180:0 hints that the game uses a dos extender, so the "real" program is a 32 bit program which runs in protected mode - 180 is ...


5

Press O (or Ctrl+O, depending on segmentation setup).


5

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)


4

(From user11623's answer): Upon opening your file on OllyDbg, press Alt+M. This will show you the whole memory map for your file. Press Ctrl+B for the search window. Try both ASCII and Unicode. If the text is generated on runtime, you can use a tool that prevents process termination(such as this). Run your file. If your file is now in the memory, you can ...


4

If you think the encoding is wrong then you can try these 2 things: Try using x/hs as described here Each time you specify a unit size with x, that size becomes the default unit the next time you use x ... Use x /hs to display 16-bit char strings set the character set in gdb as described here gdb has no way to automatically recognize which ...


4

You can write an IDC script to do this: IDA Online Help - IDC Language


4

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x length($_))' and what happens when you apply it to your test strings: $ cat test.txt AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz 1234567890 1 2 123 ? ...


4

there are API's that are required to write to a file an example of documented apis used to open and write to a file are file open -> kernel32.CreateFile file write -> kernel32!WriteFile these apis require kernelmode transition and it happens at ntdll.NtCreateFile and ntdll!NtWriteFile you can use ctrl+g in ollydbg to follow these apis and set a ...


4

To understand how to use pf the way you want, we should go over it step-by-step. I opened an empty memory for a radare2 playground: $ r2 malloc://200 [0x00000000]> Next, I wrote date to this playground, inspired by your example: [0x00000000]> wx AABBCCDD @ 0 [0x00000000]> w ccccccccccccccc @ 4 [0x00000000]> wx 11223344 @ 19 Basically, I ...


4

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them. For example instead of do this const char *msg = "Good morning"; You can do const char *msg = "R29vZCBtb3JtaW5nCg==";...


3

I think the API you're looking for is idaapi.make_ascii_string(start, len, strtype) It's not really documented on https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html but an example blog post showing how to use the API for a similar circumstance is here: http://security.my/post/38222980198/decrypting-strings-in-a-binary-with-an-...


3

Here's a way to do that using Perl: perl -pi -e 's/pattern/replacement/g' binaryfile For example, I created this trivial C++ program: // silly.cpp #include <iostream> #include <string> int main() { std::string name("Mellowcandle"); std::cout << "The name is " << name << std::endl; std::cout << "One could ...


3

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional field denoting the type of the object. Anyways, This looks like the Most significant bit of the first byte is not part of the length and has the special ...


3

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any additional code handling user input (servlets?) Analyze the code and try to find where the recovery mode is triggered and how the code is checked. If it's Java, ...


3

As confirmed in a comment, these strings appear in the Resources section of the executable. See this image (taken from the related IDA Pro can't view part of the file, which I can see exists WinHEX and adjusted to highlight this option): It is likely disabled by default because they are not important to the process of disassembling, and they might be ...


3

You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.


3

If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with LD_PRELOAD to hook/overload the function which prints it and display the address of the buffer. If you disable ASLR, you should be able to set a memory breakpoint on the string address and then figure out how it was 'encrypted'. Another solution is ...


2

OllyDbg isn't very good at finding "referenced strings". I'd recommend doing the following: Use a hex editor to search for the given string, in both ASCII and Unicode formats. If you find the static string in your hex editor, then disassemble the binary in IDA, go to the string's address in IDA, and see if IDA found any static cross-references to that ...


2

I Know IDA-PRO has some good plugins to find Crypt algorithms such as AES, DES, Triple DES and others.. As well as cryptography algorithms, it can find Hashing algorithms as well as MD5, this is pretty easy because the MD5 algorithm has couple of static intiatiors which are easy to look for in the memory (0x67452301 0xefcdab89, 0x98badcfe, 0x10325476). ...


2

http://www.fileformat.info/tool/strings.htm ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​


2

I think you should review this blog post about Custom data types and formats. This would allow you to define a new type of string and provide the algorithm to use for "printing" it. Custom data type: A custom type is basically just a way to tag some bytes for later display with custom format, when the built-in IDA types (dt_byte, dt_word, etc) are not ...


Only top voted, non community-wiki answers of a minimum length are eligible