30
votes
How do I acquire SoftICE?
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why ...
- 401
19
votes
What is a good Java decompiler and deobfuscator?
Old and Lacking Entries
JAD
Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
16
votes
Is there any disassembler to rival IDA Pro?
Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call ...
- 2,561
15
votes
how can I diff two x86 binaries at assembly code level?
There are various great alternatives here. However, all of them seem to be unmaintained. The tool I recommend you is Diaphora https://github.com/joxeankoret/diaphora (Disclaimer: I'm the author). Is a ...
- 4,415
12
votes
Accepted
What is the meaning of single letters in IDA's functions window?
Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False".
R stands for "Returns" and ...
- 11.7k
11
votes
Is there any disassembler to rival IDA Pro?
Just for completeness: one more disassembler, Binary Ninja:
As for now (9/26/2016) it has the following properties:
Commercial ($99 as introductory price for personal use license)
Handles x86, x64, ...
- 8,215
9
votes
Accepted
When to use OllyDgb over Immunity Debugger
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
- 20.6k
9
votes
Accepted
What is the info displayed by radare2's afl?
First, I'll answer your question straightly:
2nd column: The number of basic blocks in the function
3rd column: The size of the function (in bytes)
4th column: The function's name
You might have ...
- 8,839
8
votes
Is there any disassembler to rival IDA Pro?
ScratchABit is an open-source, interactive, incremental, direct-manipulation(*) disassembler with IDAPython-compatible API, allowing reuse of multitude of the plugins developed by the community. ...
- 285
7
votes
Accepted
Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user
You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
- 2,506
7
votes
Accepted
Any tool for finding IP that a process use/access?
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
- 8,839
6
votes
Decompilation techniques for DOS .COM files
My answer is a little late; newcomer to this site. The Decompiler project was initiated in order to decompile MS-DOS EXE and COM binaries. The project has both a command-line and a GUI tool:
https://...
- 1,040
5
votes
Is anyone building a python/ruby module to reuse 010 Editor templates?
I was searching for something similar and I found pfp! pfp is a python-based interpreter for 010 template scripts. Also take a look at the blog post.
- 51
5
votes
Accepted
Is BinNavi available? If not, can I get the source from anywhere?
BinNavi was just released as open source today by Google, so you can get it for free.
About using it with something else than REIL, if you're fearless, you can give a try to radare2, since it can ...
- 400
5
votes
What are the tools to analyze Python (obfuscated) bytecode?
A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants).
...
- 193
5
votes
binwalk zlib data
The differences between the binwalk results may be caused by the different version of the binwalk you use. So, check the version of your binwalk by simply running binwalk without any parameter.
...
- 1,749
5
votes
Is there an actively maintained collaboration plugin for IDA?
At #SSTIC 2017, a french security conference, we will reveal a new solution :
https://www.sstic.org/2017/presentation/YaCo/
Last commit (in our private repo as of now...) was 5 minutes ago :-)
The ...
- 151
5
votes
Accepted
Change sending IP of only certain executable
Following OP's other questions, assuming Windows OS
This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs:
Proxifier
Proxifier allows ...
- 8,839
4
votes
Are there ready-to-go reverse engineering VMs?
Another option is Fireye's Windows-based Flare VM.
Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows ...
- 853
4
votes
Decompiling .pyc files
I, of course, use uncompyle6. Disclaimer: I work on this project.
I've written at length about the uncompyle6 and pycdc here.
- 193
4
votes
Accepted
How to disassemble .NET after using Confuser
Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on ....
- 259
4
votes
Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user
A thought - Visual Studio has good accessibility features (according to their blog at least) and it can display assembly code for a compiled app. This is good if you want to learn what complied ...
- 843
4
votes
Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user
Sorry for the late answer but I only now noticed this question.
Disclaimer: I work at Hex-Rays, mainly on IDA development.
It so happens that we have a few blind users. With their help, in recent ...
- 35.8k
4
votes
Tools for RE OpenCL Kernel
You may use cuobjdump, nvdisasm, or nvprune, three CUDA binary tools.
You can find a full explanation of how to use it on this page.
See also this question in SO (Disassemble an OpenCL kernel?).
- 18.6k
4
votes
Accepted
How to unpack kkrunchy executables?
For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip.
Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
- 1,632
4
votes
Accepted
How do reverse engineers commonly detect the format of binary data?
The problem being addressed here is commonly called the semantic gap.
If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to ...
- 2,886
4
votes
Binwalk extracted images corrupt?
Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the ...
- 1,820
4
votes
Accepted
Lipo alternate for linux
Here’s a port of Apple’s cctools to Linux, it should include lipo:
https://github.com/tpoechtrager/cctools-port
- 35.8k
3
votes
What are the tools to analyze Python (obfuscated) bytecode?
The Flare-bytecode graph project can help with graphical bytecode CFG representation. Taken from the project README:
...
It is also possible to create control flow diagrams using GraphViz. The ...
- 31
3
votes
What tools exist for excavating data structures from flat binary files?
Hexinator
has a similar feature to binary templates of 010 Editor that is called a "grammar". It allows to insert numbers, strings, structs and binary blobs. If that's not enough, it has scripting ...
- 970
Only top scored, non community-wiki answers of a minimum length are eligible