Skip to main content
3 votes

Decompress and Analyse VMWARE EFI64 bios

Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file. Here is the signature scan output for your file: $ binwalk ...
julian's user avatar
  • 7,158
3 votes

IDA Pro v7 installation problem in VM

IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.
Anton Kukoba's user avatar
  • 1,850
2 votes
Accepted

Decompress and Analyse VMWARE EFI64 bios

Most UEFI implementations use a standard ROM layout (FFS - Flash File System), described in the UEFI's PI (Platform Initialization) specification. There are many tools and scripts which can parse this ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

IDA Pro 7, idc script to copy 8KB ROM to F000 Segment?

Although I would still very much like to know the significance of each of the values in the .idc script file I displayed above, and how to edit it for 128 KiB, 256 KiB or even files larger than 512 ...
TheStarman's user avatar
1 vote

VMware Dynamic Analysis on Chosen Executable within VM

There is a a difference between debugging and tracing, basically you can debug an executable by using tools such as Immunity Debugger, OllyDbg, WinDbg, x64dbg etc. While debugging you can use ...
rotem.salinas's user avatar
1 vote

VMware Tools list of all installed files with it

First step in understanding installer is identifying what product the installer was created with, then look is there any known extract command lines. Tools such as Universal Extractor 2 can also help ...
chentiangemalc's user avatar
1 vote

VMware Tools list of all installed files with it

Possibly it's checking for the drivers (e.g. network card, mouse, or display), or for a registered service (even if it's not running). Check the devices and services list before and after uninstalling....
Igor Skochinsky's user avatar
  • 36.7k
1 vote

Decompress and Analyse VMWARE EFI64 bios

It's not compressed, it's just has some format IDA doesn't recognize, so it makes a wrong assumption that it's code for zilog processor. You should select Meta PC processor instead, and then specify ...
Anton Kukoba's user avatar
  • 1,850

Only top scored, non community-wiki answers of a minimum length are eligible