Hot answers tagged

18 votes
Accepted

How can I find the source of a string in an old DOS game?

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
  • 2,304
7 votes
Accepted

Cannot locate a variable on the stack

The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a ...
  • 6,929
7 votes
Accepted

Is this a known encoding or cipher? (multiplayer game network traffic)

Writing your example, aaa b in binary, and as well the encoded string, 0xb0 0xb0 0x30 0x10 0x31: a a a ' ' b 01100001 01100001 01100001 00100000 01100010 10110000 ...
6 votes
Accepted

How can I identify how this string is being encoded so I can replicate it?

Edit: The encryption is Bitwise XOR with the key 0x04 (see the bottom of this answer) The application uses a simple Substitution Cipher (Or, to be exact Caesar Cipher with shift 4) and then perform ...
  • 8,749
6 votes

How can I find the source of a string in an old DOS game?

There's an ida plugin that connects to (a patched version of) DosBox and allows you to debug DosBox games from ida. However, i doubt you'd get that to work with the free version of ida. The fact that ...
5 votes

Looking for the specific text in EXE file

(From user11623's answer): Upon opening your file on OllyDbg, press Alt+M. This will show you the whole memory map for your file. Press Ctrl+B for the search window. Try both ASCII and Unicode. If ...
  • 117
5 votes
Accepted

How can I view in-memory strings of a process on Linux (Ubuntu)?

You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.
  • 8,040
4 votes

Declaring block as a string in IDA

I think the API you're looking for is idaapi.make_ascii_string(start, len, strtype) It's not really documented on https://www.hex-rays.com/products/ida/support/idapython_docs/idaapi-module.html but ...
4 votes

How can I identify how this string is being encoded so I can replicate it?

Based on your examples, it looks like the strings are reversed and each byte is XORed with the byte 4. Here's a quick Perl one-liner to demonstrate this: perl -lne 'print reverse($_) ^ ("\x04" x ...
4 votes

What other methods can be used to find file paths in an executable?

there are API's that are required to write to a file an example of documented apis used to open and write to a file are file open -> kernel32.CreateFile file write -> kernel32!WriteFile these apis ...
  • 15.4k
4 votes

I'm would like to view this malicious payload, but am having trouble decoding it

On a linux machine Try: $ cat enc_payload.txt|base64 -d > dec_payload Then you'll get $ file dec_payload dec_payload: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
4 votes
Accepted

How do you print fixed width strings with radare's print format `pf`?

To understand how to use pf the way you want, we should go over it step-by-step. I opened an empty memory for a radare2 playground: $ r2 malloc://200 [0x00000000]> Next, I wrote date to this ...
  • 8,749
4 votes
Accepted

Not able to find Hard coded strings in the mac executable file

Some binaries hide the string on base64, with basic encryption algorithms rc4 or even with xor just for avoid what you are trying to achieve. Depending on the design of the owner of the binary you can ...
  • 244
4 votes
Accepted

Identify strings shared between multiple files from the Linux command line

Here's one approach, for malicious files in a directory named malware: find malware/ -type f | xargs -n1 -P1 -I{} sh -c 'strings {} | sort | uniq' | sort | uniq -c | sort -n The output will look ...
  • 185
3 votes

How can I generate the recovery password on a legacy system (Original company is out of business) running on my local machine?

There's not much information to go on, but I would probably try to proceed like this: Figure out how the web server is running (e.g. what is the server process?) and where are the pages and any ...
  • 35.3k
3 votes
Accepted

Problem with converting hex values to decimal

This is not the pascal/delphi string format, as those are either constant 1 byte or 4 bytes long length fields. It does have some resemblance to the ASN1 format, except ASN1 comes with an additional ...
  • 11.5k
3 votes
Accepted

Why can I see certain strings when PE is opened with a hex editor or a simple static analysis tool but not with IDA?

As confirmed in a comment, these strings appear in the Resources section of the executable. See this image (taken from the related IDA Pro can't view part of the file, which I can see exists ...
  • 2,304
3 votes

obtaining string value from Unknown elf-x86-64 binary with gdb

If the executable is not compiled statically, I think the easiest way is to inject a shared object (.so) with LD_PRELOAD to hook/overload the function which prints it and display the address of the ...
  • 1,084
3 votes

Why does Ghidra show no references to any strings?

My problem was that the boot loader code gets loaded into SRAM, which has a base address of 0x20000. So that means the code can access data based at 0x0 and also the same data starting at offset ...
  • 171
2 votes

Can't find "referenced string" in OllyDBG

OllyDbg isn't very good at finding "referenced strings". I'd recommend doing the following: Use a hex editor to search for the given string, in both ASCII and Unicode formats. If you find the static ...
2 votes

Find a string in an object file

I Know IDA-PRO has some good plugins to find Crypt algorithms such as AES, DES, Triple DES and others.. As well as cryptography algorithms, it can find Hashing algorithms as well as MD5, this is ...
  • 658
2 votes
Accepted

Is there a website that hosts the strings application?

http://www.fileformat.info/tool/strings.htm ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​
2 votes

Declaring block as a string in IDA

I think you should review this blog post about Custom data types and formats. This would allow you to define a new type of string and provide the algorithm to use for "printing" it. Custom data ...
2 votes

Using HEX editor and making 4 chars from 3 chars

As Far As i Know there isn't another way assume you have a program like this the hex for this function will look like this 0:000> db main l21 00111260 55 8b ec 6a 00 eb 04 74-68 69 00 68 67 ...
  • 15.4k
2 votes

Is it possible to make a string bigger on an executable without breaking it?

In this case you will likely need to add a new section (dont think a code cave can be 1MB.. on any architecture) and overwrite the code to read from the the original string location to the new string ...
  • 586
2 votes

Problem with converting hex values to decimal

This looks like the LEB128 encoding.    Essentially, this is a variable length encoding where the lowest 7 bits of each byte store part of the value and highest bit of each byte is set if it's not ...
  • 2,294
2 votes

Need help with searching for reference for a string in IDA Pro

This is a long shot, but i assume what happened is something like this: Your firmware does not have any ELF or similar headers (this isn't really a problem, it's expected to be this way), but is ...
2 votes
Accepted

IDA 7 does not recognize/reference Delphi 16bits Strings correctly

It's not only Delphi problem, it's a generic unicode detection problem of IDA. I can't be sure how exactly it works, but I feel like IDA has an issue, when detecting the data type. And it's related to ...
  • 1,760
2 votes

How can I view in-memory strings of a process on Linux (Ubuntu)?

Another way to read a process's memory in Linux isto read the psaudo-file /proc/<PID>/mem, which provides raw access to the memory space, as seen by the process, at offsets retrieved from /proc/&...
  • 11.5k
2 votes
Accepted

Find out string encoding/shift of proprietary binary file format

It's a simple exclusive-or (^) operation with the byte 0x5A. With your examples - 'a' 0x61 ^ 0x5A = 0x3B 'b' 0x62 ^ 0x5A = 0x38 'z' 0x7A ^ 0x5A = 0x20 Plus some others you should be able to check - ...
  • 2,294

Only top scored, non community-wiki answers of a minimum length are eligible