Gilles 'SO- stop being evil'
  • Member for 8 years, 10 months
  • Last seen more than 1 year ago
How can I analyse an executable with no read permission?
Accepted answer
27 votes

I initially thought you wouldn't be able to dump the program, but it turns out that you can — see the second section of this answer. Running the program Most of the usual methods won't work because ...

View answer
How do I add functionality to an existing binary executable?
18 votes

Very often, you can change the behavior of a program by carefully hooking into it. Whether you can add the functionality you want this way depends on how the program is constructed. It helps if the ...

View answer
Malware in virtual machines
Accepted answer
12 votes

The malware can propagate from the VM to the host in several circumstances: If there's a bug in the VM software. That's not very common, but it's possible. If there's a bug in the host OS. A bug that ...

View answer
Trying to reverse engineer dump of a timestamp
Accepted answer
11 votes

The numbers in the third column do increase over time, which is a good start. Let's check the differences between numbers on consecutive lines, to see if the progression is linear: #!/usr/bin/env ...

View answer
What can I do with a SSH certificate?
10 votes

I hope you recognized base64. The first few bytes in a hexadecimal dump are 30 82 04 a3 02 01 00 02 82 01 01 00 a2 9f 9e 9e 30 82 screams “ASN.1 DER” — 30 means “sequence”, 82 means “followed by a ...

View answer
Can a debug-apk be reverse engineered to make it a release-apk?
Accepted answer
7 votes

The difference between a debug apk and a release apk is that a debug apk is signed by a particular key which is provided with the SDK, whereas a release apk is signed by some other key. There's ...

View answer
What does the text in angle brackets refer to (From objdump)
7 votes

PLT stands for Procedure Linkage Table. It is effectively a table of function addresses. More precisely, as illustrated here, the PLT is a table where each entry consists of a jump instruction to ...

View answer
Obfuscating JavaScript with zero-width characters - pros and cons?
7 votes

Deobfuscating variable names with zero-width characters is as easy as renaming variables. That's something you'd do anyway as part of the deobfuscation process, as you infer the intent behind the ...

View answer
Is the output of the gcc compilers the same for all ARM platforms?
6 votes

There are several different calling conventions around on ARM platforms. They vary both according to the processor features (for example, on processors with floating point registers (VFP), it's more ...

View answer