Hot answers tagged

52 votes

Is there any disassembler to rival IDA Pro?

Some other disassemblers / decompilers W32Dasm W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003 ...
user avatar
  • 5,850
29 votes

How do I acquire SoftICE?

After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why ...
user avatar
  • 391
24 votes

Is there any disassembler to rival IDA Pro?

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 ...
user avatar
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
15 votes

how can I diff two x86 binaries at assembly code level?

There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a ...
user avatar
  • 4,315
14 votes

Is there any disassembler to rival IDA Pro?

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call ...
user avatar
  • 2,441
12 votes
Accepted

What is the meaning of single letters in IDA's functions window?

Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False". R stands for "Returns" and ...
user avatar
  • 11.4k
10 votes

Is there any disassembler to rival IDA Pro?

Just for completeness: one more disassembler, Binary Ninja: As for now (9/26/2016) it has the following properties: Commercial ($99 as introductory price for personal use license) Handles x86, x64, ...
user avatar
  • 7,720
10 votes

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on ...
user avatar
  • 34.7k
9 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
user avatar
9 votes
Accepted

What is the info displayed by radare2's afl?

First, I'll answer your question straightly: 2nd column: The number of basic blocks in the function 3rd column: The size of the function (in bytes) 4th column: The function's name You might have ...
user avatar
  • 8,629
8 votes
Accepted

Are there any Windows alternatives to INetSim?

Not a GUI tool, but FakeNet is a good alternative. FakeNet is a tool that aids in the dynamic analysis of malicious software. The tool simulates a network so that malware interacting with a ...
user avatar
  • 7,322
7 votes

Is there any disassembler to rival IDA Pro?

ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ...
user avatar
  • 275
7 votes
Accepted

What is a FAT header?

A fat header is the header of a fat binary. See pages 67-68 in Mac OS X Internals: Note that a fat binary is essentially a wrapper—a simple archive that concatenates Mach-O files for multiple ...
user avatar
7 votes
Accepted

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
user avatar
  • 2,486
7 votes
Accepted

Any tool for finding IP that a process use/access?

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
user avatar
  • 8,629
6 votes

Decompilation techniques for DOS .COM files

My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool: https://...
user avatar
5 votes

Is anyone building a python/ruby module to reuse 010 Editor templates?

I was searching for something similar and I found pfp! pfp is a python-based interpreter for 010 template scripts. Also take a look at the blog post.
user avatar
  • 51
5 votes
Accepted

Is BinNavi available? If not, can I get the source from anywhere?

BinNavi was just released as open source today by Google, so you can get it for free. About using it with something else than REIL, if you're fearless, you can give a try to radare2, since it can ...
user avatar
5 votes

What are the tools to analyze Python (obfuscated) bytecode?

A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants). ...
user avatar
  • 193
5 votes

What is a good Java decompiler and deobfuscator?

Try taking a look at Bytecode Viewer https://github.com/Konloch/bytecode-viewer It has the option to decompile using 5 different decompilers: FernFlower Procyon CFR Krakatau JD-GUI
5 votes

Decompilation techniques for DOS .COM files

IDA Pro and a number of other disassemblers will disassemble your file, assuming that it isn't compressed or otherwise obfuscated. But this is only the first step in producing a working assembly ...
user avatar
5 votes
Accepted

Check if binary was compiled with security checks (/GS)

you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image. In very old binaries, this structure might be not used, or ...
user avatar
  • 34.7k
5 votes

binwalk zlib data

The differences between the binwalk results may be caused by the different version of the binwalk you use. So, check the version of your binwalk by simply running binwalk without any parameter. ...
user avatar
  • 1,731
5 votes

Is there an actively maintained collaboration plugin for IDA?

At #SSTIC 2017, a french security conference, we will reveal a new solution : https://www.sstic.org/2017/presentation/YaCo/ Last commit (in our private repo as of now...) was 5 minutes ago :-) The ...
user avatar
  • 151
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
user avatar
  • 8,629
4 votes

Are there ready-to-go reverse engineering VMs?

Another option is Fireye's Windows-based Flare VM. Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows ...
user avatar
4 votes

Determining if a file is managed code or not

In addition to peter ferries answer, some python code to check for the same: import sys def unpack(byte): return sum([ ord(b) << (8 * i) for i, b in enumerate(byte) ]) if len(...
user avatar
4 votes

Decompiling .pyc files

I, of course, use uncompyle6. Disclaimer: I work on this project. I've written at length about the uncompyle6 and pycdc here.
user avatar
  • 193
4 votes

How to get IDA Pro Free to automatically change segment on retf?

Apologies for bringing this up after half a year; hope the question is still relevant. If this is occurring in multiple places, I would suggest to write a simple IDC script to solve the issue. The ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible