User langlauf.io

10 votes

2 answers

14k views

Which python library for parsing Linux ELF files?

asked May 6, 2015 at 11:14

7 votes

5 answers

2k views

How to find out if PE executable was compiled with gcc or VisualStudio?

asked Mar 12, 2018 at 12:10

6 votes

1 answer

1k views

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

asked Apr 24, 2015 at 11:46

6 votes

3 answers

4k views

How to get the CPU architecture via Idapython?

asked Nov 25, 2015 at 9:54

6 votes

1 answer

5k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

asked Mar 20, 2016 at 20:47

6 votes

2 answers

3k views

Intel PIN: How to access the INS object from inside an analysis function?

asked Apr 11, 2016 at 19:39

6 votes

1 answer

4k views

Unicorn and QEMU: Example use cases to understand the differences

asked Apr 27, 2016 at 11:13

5 votes

2 answers

5k views

Ida Pro: parsig complex operand expression using Idapython

asked Jun 1, 2015 at 14:00

4 votes

1 answer

1k views

IDA Pro: Platform-independent way to check if an instruction is a jump

asked Jun 22, 2015 at 9:29

4 votes

1 answer

2k views

Limitations of capstone's disassembly capabilities compared to IDA

asked Nov 17, 2015 at 8:47

4 votes

1 answer

5k views

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

asked May 7, 2015 at 12:04

4 votes

2 answers

1k views

IDA basic block type fcb_cndret - what does it mean?

asked Mar 27, 2015 at 8:26

4 votes

1 answer

511 views

Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?

asked Mar 6, 2015 at 10:55

4 votes

1 answer

854 views

Getting list of opcodes from PANDA trace

asked Apr 1, 2016 at 8:34

4 votes

1 answer

2k views

Intel PIN: InsertPredicatedCall and INS_InsertCall

asked Apr 9, 2016 at 10:48

4 votes

4 answers

2k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

asked Feb 16, 2016 at 17:29

4 votes

1 answer

6k views

Setting name of (newly created) functions via IDAPython

asked May 29, 2015 at 9:12

3 votes

1 answer

109 views

How would one find test cases for a self-implemented value set analysis (VSA)?

asked Oct 27, 2016 at 9:40

3 votes

1 answer

50 views

GNU strings with --encoding=S

asked Feb 2 at 17:08

3 votes

1 answer

720 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

asked Mar 22, 2015 at 10:26

3 votes

2 answers

4k views

IDA Pro: Side effects or disadvantages of "Create function"

asked May 27, 2015 at 17:50

2 votes

1 answer

7k views

Idapython: How to get the opcode bytes corresponding to an instruction?

asked Feb 11, 2016 at 19:23

2 votes

1 answer

680 views

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

asked Jan 5, 2020 at 18:09

2 votes

0 answers

437 views

Is there a static data flow analysis tool for .net assemblies?

asked Mar 19, 2017 at 14:36

2 votes

1 answer

313 views

Is all debug information of VS-compiled PE files contained in an external PDB file?

asked Jan 25, 2018 at 13:13

2 votes

2 answers

1k views

ARM assembly: Strange instruction pattern (endless loop?)

asked Oct 14, 2016 at 10:50

2 votes

0 answers

408 views

IDA Pro .til files backward compatibility

asked Jul 6, 2016 at 19:02

1 vote

1 answer

2k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

asked Oct 4, 2016 at 14:00

1 vote

2 answers

692 views

How to programatically extract function names, function arguments and strings from a .NET binary?

asked Jan 19, 2017 at 19:55

1 vote

1 answer

92 views

Name other than ".text" for the main code section

asked Nov 24, 2020 at 15:14

Stack Exchange Network

37 Questions

Which python library for parsing Linux ELF files?

How to find out if PE executable was compiled with gcc or VisualStudio?

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

How to get the CPU architecture via Idapython?

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

Intel PIN: How to access the INS object from inside an analysis function?

Unicorn and QEMU: Example use cases to understand the differences

Ida Pro: parsig complex operand expression using Idapython

IDA Pro: Platform-independent way to check if an instruction is a jump

Limitations of capstone's disassembly capabilities compared to IDA

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

IDA basic block type fcb_cndret - what does it mean?

Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?

Getting list of opcodes from PANDA trace

Intel PIN: InsertPredicatedCall and INS_InsertCall

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

Setting name of (newly created) functions via IDAPython

How would one find test cases for a self-implemented value set analysis (VSA)?

GNU strings with --encoding=S

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

IDA Pro: Side effects or disadvantages of "Create function"

Idapython: How to get the opcode bytes corresponding to an instruction?

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

Is there a static data flow analysis tool for .net assemblies?

Is all debug information of VS-compiled PE files contained in an external PDB file?

ARM assembly: Strange instruction pattern (endless loop?)

IDA Pro .til files backward compatibility

Intel PIN: How to log the value of the fs and gs registers at every instruction?

How to programatically extract function names, function arguments and strings from a .NET binary?

Name other than ".text" for the main code section