7
votes
Accepted
Cannot locate a variable on the stack
The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a ...
- 7,058
7
votes
Accepted
Is this a known encoding or cipher? (multiplayer game network traffic)
Writing your example, aaa b in binary, and as well the encoded string, 0xb0 0xb0 0x30 0x10 0x31:
a a a ' ' b
01100001 01100001 01100001 00100000 01100010
10110000 ...
- 12.9k
6
votes
Accepted
How can I identify how this string is being encoded so I can replicate it?
Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer)
The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
- 8,909
5
votes
Accepted
How can I view in-memory strings of a process on Linux (Ubuntu)?
You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.
- 8,353
4
votes
How can I identify how this string is being encoded so I can replicate it?
Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this:
perl -lne 'print reverse($_) ^ ("\x04" x ...
- 326
4
votes
Accepted
How do you print fixed width strings with radare's print format `pf`?
To understand how to use pf the way you want, we should go over it step-by-step.
I opened an empty memory for a radare2 playground:
$ r2 malloc://200
[0x00000000]>
Next, I wrote date to this ...
- 8,909
4
votes
What other methods can be used to find file paths in an executable?
there are API's that are required to write to a file
an example of documented apis used to open and write to a file are
file open -> kernel32.CreateFile
file write -> kernel32!WriteFile
these apis ...
- 16.2k
4
votes
I'm would like to view this malicious payload, but am having trouble decoding it
On a linux machine
Try:
$ cat enc_payload.txt|base64 -d > dec_payload
Then you'll get
$ file dec_payload
dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
- 395
4
votes
Accepted
Not able to find Hard coded strings in the mac executable file
Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can ...
- 254
4
votes
Accepted
Identify strings shared between multiple files from the Linux command line
Here's one approach, for malicious files in a directory named malware:
find malware/ -type f | xargs -n1 -P1 -I{} sh -c 'strings {} | sort | uniq' | sort | uniq -c | sort -n
The output will look ...
- 195
3
votes
How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?
There's not much information to go on, but I would probably try to proceed like this:
Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
- 36.2k
3
votes
Accepted
Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?
As confirmed in a comment, these strings appear in the Resources section of the executable.
See this image (taken from the related IDA Pro can't view part of the file, which I can see exists ...
- 2,354
3
votes
Accepted
Problem with converting hex values to decimal
This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields.
It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
- 11.7k
3
votes
obtaining string value from Unknown elf-x86-64 binary with gdb
If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with LD_PRELOAD to hook/overload the function which prints it and display the address of the ...
- 1,124
3
votes
Why does Ghidra show no references to any strings?
My problem was that the boot loader code gets loaded into SRAM, which has a base address of 0x20000. So that means the code can access data based at 0x0 and also the same data starting at offset ...
- 171
3
votes
Accepted
GNU strings with --encoding=S
Works for me with strings version 2.37:
$ strings --encoding=S bin1.bin
precondition failed
����invalid argument
$ strings --encoding=S bin2.bin
����precondition failed
invalid argument
- 786
3
votes
Accepted
Ghidra 16-Bit DOS Strings
I managed to solve this one myself thanks to @Blabb's comment (thanks again!).
The first identifiable string was MS Run-Time Library - Copyright (c) 1992, Microsoft Corp.
For some reason, this managed ...
- 165
2
votes
Can't find "referenced string" in OllyDBG
OllyDbg isn't very good at finding "referenced strings".
I'd recommend doing the following:
Use a hex editor to search for the given string, in both ASCII and Unicode formats.
If you find the static ...
- 20.6k
2
votes
Find a string in an object file
I Know IDA-PRO has some good plugins to find Crypt algorithms such as AES, DES, Triple DES and others..
As well as cryptography algorithms, it can find Hashing algorithms as well as MD5, this is ...
- 668
2
votes
Need help with searching for reference for a string in IDA Pro
This is a long shot, but i assume what happened is something like this:
Your firmware does not have any ELF or similar headers (this isn't really a problem, it's expected to be this way), but is ...
- 12.9k
2
votes
Is it possible to make a string bigger on an executable without breaking it?
In this case you will likely need to add a new section (dont think a code cave can be 1MB.. on any architecture) and overwrite the code to read from the the original string location to the new string ...
- 586
2
votes
Problem with converting hex values to decimal
This looks like the LEB128 encoding.
Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
- 2,503
2
votes
Using HEX editor and making 4 chars from 3 chars
As Far As i Know there isn't another way
assume you have a program like this
the hex for this function will look like this
0:000> db main l21
00111260 55 8b ec 6a 00 eb 04 74-68 69 00 68 67 ...
- 16.2k
2
votes
Accepted
Find out string encoding/shift of proprietary binary file format
It's a simple exclusive-or (^) operation with the byte 0x5A.
With your examples -
'a' 0x61 ^ 0x5A = 0x3B
'b' 0x62 ^ 0x5A = 0x38
'z' 0x7A ^ 0x5A = 0x20
Plus some others you should be able to check -
...
- 2,503
2
votes
How can I view in-memory strings of a process on Linux (Ubuntu)?
Another way to read a process's memory in Linux isto read the psaudo-file /proc/<PID>/mem, which provides raw access to the memory space, as seen by the process, at offsets retrieved from /proc/&...
- 11.7k
2
votes
Accepted
IDA 7 does not recognize/reference Delphi 16bits Strings correctly
It's not only Delphi problem, it's a generic unicode detection problem of IDA.
I can't be sure how exactly it works, but I feel like IDA has an issue, when detecting the data type. And it's related to ...
- 1,830
2
votes
2
votes
How to find who use these strings?
If you're using IDA, you can select the string (e.g. aImportSites_0), right click and select Jump to xref to operand... (keyboard shortcut -> x) and that will show you where (and which functions) ...
- 51
2
votes
In IDA's strings window, how to run MakeStrLit on all the selection
You can try copy-pasting the following code into the built-in Python interpreter:
import idautils
for s in idautils.Strings():
ida_bytes.create_strlit(s.ea, 0, ida_nalt.STRTYPE_TERMCHR)
This ...
- 41
2
votes
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The page you linked states that the ENCODING directive in the cfg file only applies to 1-byte-per-unit (1bpu) encodings, which this is not. UTF-16 is a 2bpu format.
The ENCODING directive is important ...
- 1,252
Only top scored, non community-wiki answers of a minimum length are eligible