Hot answers tagged

18

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-transformation.org/Transform/PcExeFormat), and at that position you can see the correct signature P3. According to the header info, the executable's length is ...


13

There are several approaches to locating strings in an unknown file. One you already tried: strings. This looks for plain, unencoded ASCII text: Strings looks for ASCII strings in a binary file [..] A string is any sequence of 4 (the default) or more printing characters ending with a newline or a null. (man strings) But there are many reasons why ...


9

The IDAScope plugin has similar functionality to rename functions based on the Windows API functions they are calling. You can find a standalone script here that does that http://hooked-on-mnemonics.blogspot.fr/2012/06/automated-generic-function-naming-in.html it should give you an idea how to implement what you are looking for.


7

Writing your example, aaa b in binary, and as well the encoded string, 0xb0 0xb0 0x30 0x10 0x31: a a a ' ' b 01100001 01100001 01100001 00100000 01100010 10110000 10110000 00110000 00010000 00110001 it looks like every byte of the encoded string being the original byte shift right by one bit, with the last bit of the next ...


7

The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a reference to text1 to be written to the stack text1 must be passed as an argument to a function which is called. When a function is called and a new stack frame ...


6

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform reverse() on the function. We can domnstrate it using python's maketrans method: The method maketrans() returns a translation table that maps each ...


6

There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida. The fact that your memdumpbin uses the address 180:0 hints that the game uses a dos extender, so the "real" program is a 32 bit program which runs in protected mode - 180 is ...


6

It's a lot of questions, here are a few answers: How can we write something in memory with a format string vulnerability ? For this, you need to know two specific features used in the printf format string specifications. First, %n is a format specifier that has the following effect (according to the manual page): %n The number of characters written so ...


5

(From user11623's answer): Upon opening your file on OllyDbg, press Alt+M. This will show you the whole memory map for your file. Press Ctrl+B for the search window. Try both ASCII and Unicode. If the text is generated on runtime, you can use a tool that prevents process termination(such as this). Run your file. If your file is now in the memory, you can ...


4

You can write an IDC script to do this: IDA Online Help - IDC Language


4

I think the API you're looking for is idaapi.make_ascii_string(start, len, strtype) It's not really documented on https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html but an example blog post showing how to use the API for a similar circumstance is here: http://security.my/post/38222980198/decrypting-strings-in-a-binary-with-an-...


4

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x length($_))' and what happens when you apply it to your test strings: $ cat test.txt AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz 1234567890 1 2 123 ? ...


4

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)


4

there are API's that are required to write to a file an example of documented apis used to open and write to a file are file open -> kernel32.CreateFile file write -> kernel32!WriteFile these apis require kernelmode transition and it happens at ntdll.NtCreateFile and ntdll!NtWriteFile you can use ctrl+g in ollydbg to follow these apis and set a ...


4

To understand how to use pf the way you want, we should go over it step-by-step. I opened an empty memory for a radare2 playground: $ r2 malloc://200 [0x00000000]> Next, I wrote date to this playground, inspired by your example: [0x00000000]> wx AABBCCDD @ 0 [0x00000000]> w ccccccccccccccc @ 4 [0x00000000]> wx 11223344 @ 19 Basically, I ...


4

You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.


4

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can find this types of techniques on them. For example instead of do this const char *msg = "Good morning"; You can do const char *msg = "R29vZCBtb3JtaW5nCg==";...


4

Here's one approach, for malicious files in a directory named malware: find malware/ -type f | xargs -n1 -P1 -I{} sh -c 'strings {} | sort | uniq' | sort | uniq -c | sort -n The output will look something like the following, where the first number on each line is the number of files containing the string: ... 1 Sleep ... 2 JFIF ...


3

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional field denoting the type of the object. Anyways, This looks like the Most significant bit of the first byte is not part of the length and has the special ...


3

Here's a way to do that using Perl: perl -pi -e 's/pattern/replacement/g' binaryfile For example, I created this trivial C++ program: // silly.cpp #include <iostream> #include <string> int main() { std::string name("Mellowcandle"); std::cout << "The name is " << name << std::endl; std::cout << "One could ...


3

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any additional code handling user input (servlets?) Analyze the code and try to find where the recovery mode is triggered and how the code is checked. If it's Java, ...


3

As confirmed in a comment, these strings appear in the Resources section of the executable. See this image (taken from the related IDA Pro can't view part of the file, which I can see exists WinHEX and adjusted to highlight this option): It is likely disabled by default because they are not important to the process of disassembling, and they might be ...


3

If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with LD_PRELOAD to hook/overload the function which prints it and display the address of the buffer. If you disable ASLR, you should be able to set a memory breakpoint on the string address and then figure out how it was 'encrypted'. Another solution is ...


2

OllyDbg isn't very good at finding "referenced strings". I'd recommend doing the following: Use a hex editor to search for the given string, in both ASCII and Unicode formats. If you find the static string in your hex editor, then disassemble the binary in IDA, go to the string's address in IDA, and see if IDA found any static cross-references to that ...


2

I Know IDA-PRO has some good plugins to find Crypt algorithms such as AES, DES, Triple DES and others.. As well as cryptography algorithms, it can find Hashing algorithms as well as MD5, this is pretty easy because the MD5 algorithm has couple of static intiatiors which are easy to look for in the memory (0x67452301 0xefcdab89, 0x98badcfe, 0x10325476). ...


2

http://www.fileformat.info/tool/strings.htm ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​


2

I think you should review this blog post about Custom data types and formats. This would allow you to define a new type of string and provide the algorithm to use for "printing" it. Custom data type: A custom type is basically just a way to tag some bytes for later display with custom format, when the built-in IDA types (dt_byte, dt_word, etc) are not ...


2

In this case you will likely need to add a new section (dont think a code cave can be 1MB.. on any architecture) and overwrite the code to read from the the original string location to the new string location (at least) or write your own code to do that. Also, depending on the architecture and implementation its very much likely that you can make the string ...


2

This looks like the LEB128 encoding.    Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not the last byte. The successive 7-bit values are stored in little-endian order.   For more details, and especially for how signed numbers are handled, see either ...


2

This is a long shot, but i assume what happened is something like this: Your firmware does not have any ELF or similar headers (this isn't really a problem, it's expected to be this way), but is supposed to be loaded at a specific location in memory, which is not 0. Or, maybe it does have some headers, which IDA fails to recognize, so it loads those headers ...


Only top voted, non community-wiki answers of a minimum length are eligible