Hot answers tagged

30 votes

How do I acquire SoftICE?

After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why ...
Rick Papo's user avatar
  • 401
19 votes

What is a good Java decompiler and deobfuscator?

Old and Lacking Entries JAD Some time ago, everyone’s decompiler of choice was jad. Currently, the project is dead (in addition, it wasn’t open source), but still you see a lot of people referring to ...
13 votes
Accepted

What is the meaning of single letters in IDA's functions window?

Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False". R stands for "Returns" and ...
NirIzr's user avatar
  • 11.8k
11 votes

Is there any disassembler to rival IDA Pro?

Just for completeness: one more disassembler, Binary Ninja: As for now (9/26/2016) it has the following properties: Commercial ($99 as introductory price for personal use license) Handles x86, x64, ...
w s's user avatar
  • 8,448
9 votes
Accepted

What is the info displayed by radare2's afl?

First, I'll answer your question straightly: 2nd column: The number of basic blocks in the function 3rd column: The size of the function (in bytes) 4th column: The function's name You might have ...
Megabeets's user avatar
  • 8,959
7 votes
Accepted

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

You can use gdb on Linux, WinDBG, and could give a try to radare2: it's not as rock-stable as the two previous ones, but it's tailored for reverse engineering, and supports gdb:// and windbg:// ...
jvoisin's user avatar
  • 2,516
7 votes
Accepted

Any tool for finding IP that a process use/access?

Linux As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it ...
Megabeets's user avatar
  • 8,959
5 votes

binwalk zlib data

The differences between the binwalk results may be caused by the different version of the binwalk you use. So, check the version of your binwalk by simply running binwalk without any parameter. ...
ebux's user avatar
  • 1,759
5 votes

Is there an actively maintained collaboration plugin for IDA?

At #SSTIC 2017, a french security conference, we will reveal a new solution : https://www.sstic.org/2017/presentation/YaCo/ Last commit (in our private repo as of now...) was 5 minutes ago :-) The ...
Goulou's user avatar
  • 151
5 votes

What are the tools to analyze Python (obfuscated) bytecode?

A challenge in writing a tool to extract the control flow of python bytecode is that there are so many Python bytecodes versions to choose from, about 25 or so by now (if you include pypy variants). ...
rocky's user avatar
  • 213
5 votes
Accepted

Change sending IP of only certain executable

Following OP's other questions, assuming Windows OS This can be achieved with many 3rd-party solutions for Windows, choose the one which fits best to your needs: Proxifier Proxifier allows ...
Megabeets's user avatar
  • 8,959
4 votes

Are there ready-to-go reverse engineering VMs?

Another option is Fireye's Windows-based Flare VM. Unlike the Linux-based examples on this page, Flare VM only provides an installer script, not the VM itself. Fortunately, you can get a free Windows ...
hairlessbear's user avatar
4 votes

Decompiling .pyc files

I, of course, use uncompyle6. Disclaimer: I work on this project. I've written at length about the uncompyle6 and pycdc here.
rocky's user avatar
  • 213
4 votes

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

A thought - Visual Studio has good accessibility features (according to their blog at least) and it can display assembly code for a compiled app. This is good if you want to learn what complied ...
Vitaly Osipov's user avatar
4 votes

Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user

Sorry for the late answer but I only now noticed this question. Disclaimer: I work at Hex-Rays, mainly on IDA development. It so happens that we have a few blind users. With their help, in recent ...
Igor Skochinsky's user avatar
  • 36.5k
4 votes

Tools for RE OpenCL Kernel

You may use cuobjdump, nvdisasm, or nvprune, three CUDA binary tools. You can find a full explanation of how to use it on this page. See also this question in SO (Disassemble an OpenCL kernel?).
perror's user avatar
  • 19k
4 votes
Accepted

How to unpack kkrunchy executables?

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...
mrexodia's user avatar
  • 1,652
4 votes
Accepted

How do reverse engineers commonly detect the format of binary data?

The problem being addressed here is commonly called the semantic gap. If you stumble across any binary snippet like the one you posted, it's nearly impossible to deduce the way the value is meant to ...
Nordwald's user avatar
  • 2,896
4 votes

Binwalk extracted images corrupt?

Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the ...
Anton Kukoba's user avatar
  • 1,840
4 votes
Accepted

Lipo alternate for linux

Here’s a port of Apple’s cctools to Linux, it should include lipo: https://github.com/tpoechtrager/cctools-port
Igor Skochinsky's user avatar
  • 36.5k
4 votes

What are the substantive differences between radare2 and rizin?

Since your questions kind of overlap, allow me to attempt to answer them in a different order. As it's been a while since I've used both tools, and topics were chosen randomly, please forgive the ...
feldspar's user avatar
3 votes

What tools exist for excavating data structures from flat binary files?

Hexinator has a similar feature to binary templates of 010 Editor that is called a "grammar". It allows to insert numbers, strings, structs and binary blobs. If that's not enough, it has scripting ...
Thomas Weller's user avatar
3 votes

Is there an actively maintained collaboration plugin for IDA?

As mentioned here, IDArling was released recently and is still being actively maintained (last commit was just over a week ago). Notably, it also won the 2018 IDA Plugin Contest. EDIT July 2021 From ...
hairlessbear's user avatar
3 votes

What are the tools to analyze Python (obfuscated) bytecode?

The Flare-bytecode graph project can help with graphical bytecode CFG representation. Taken from the project README: ... It is also possible to create control flow diagrams using GraphViz. The ...
MaciejTe's user avatar
3 votes

What is a good Java decompiler and deobfuscator?

I'm using https://github.com/JetBrains/intellij-community/tree/master/plugins/java-decompiler/engine It's the decompiler from IntelliJ, it decompile codes where JD-GUI fail. It's a unofficial mirror ...
3 votes

Tools to work cooperatively on the same binary

A new tool that's actively developed on github is IDArling (Previously called IDAConnect). According to its developers, Alexandre Adamskiand and Joffrey Guilbon, it's inspired by SolIDArity (which ...
NirIzr's user avatar
  • 11.8k
3 votes

Bindiff matching algorithm

I've started using bindiff recently and struggle to understand matching algorithm. (...) So how the signatures differs from attributes? I think you are confusing at least 3 things: There is not a ...
joxeankoret's user avatar
  • 4,489
3 votes

How to label local variables in x64dbg

Local variables labeling is not yet supported by x64dbg and as far as I know there's no plugin to achieve that. However, you can still label a specific memory address. You can do this by selecting ...
Megabeets's user avatar
  • 8,959
3 votes
Accepted

How to label local variables in x64dbg

Two ways to label local variables in x64dbg: In x64dbg, follow in dump at address of local var (like this [ebp-4]). Right click at this address and select Add label, then name the label. Now in the ...
m4n0w4r's user avatar
  • 54

Only top scored, non community-wiki answers of a minimum length are eligible