Skip to main content
langlauf.io's user avatar
langlauf.io's user avatar
langlauf.io's user avatar
langlauf.io
  • Member for 9 years, 3 months
  • Last seen more than a month ago
11 votes
2 answers
16k views

Which python library for parsing Linux ELF files?

3 votes
1 answer
7k views

Idapython: How to get the opcode bytes corresponding to an instruction?

4 votes
1 answer
7k views

Setting name of (newly created) functions via IDAPython

6 votes
1 answer
5k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

4 votes
1 answer
5k views

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

6 votes
2 answers
5k views

Ida Pro: parsing complex operand expression using IDAPython

6 votes
1 answer
5k views

Unicorn and QEMU: Example use cases to understand the differences

6 votes
3 answers
5k views

How to get the CPU architecture via Idapython?

3 votes
2 answers
4k views

IDA Pro: Side effects or disadvantages of "Create function"

6 votes
2 answers
4k views

Intel PIN: How to access the INS object from inside an analysis function?

7 votes
5 answers
3k views

How to find out if PE executable was compiled with gcc or VisualStudio?

4 votes
4 answers
2k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

1 vote
1 answer
2k views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

4 votes
1 answer
2k views

Intel PIN: InsertPredicatedCall and INS_InsertCall

4 votes
1 answer
2k views

Limitations of capstone's disassembly capabilities compared to IDA

6 votes
1 answer
1k views

Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?

4 votes
1 answer
1k views

IDA Pro: Platform-independent way to check if an instruction is a jump

1 vote
1 answer
1k views

Are there assembly instructions which both read from, and write to, memory?

4 votes
2 answers
1k views

IDA basic block type fcb_cndret - what does it mean?

0 votes
1 answer
1k views

PE: Strange entry in debug directory (Type: 0xc)

2 votes
2 answers
1k views

ARM assembly: Strange instruction pattern (endless loop?)

1 vote
1 answer
1k views

Function dependencies in static libraries

4 votes
1 answer
884 views

Getting list of opcodes from PANDA trace

1 vote
2 answers
856 views

How to programatically extract function names, function arguments and strings from a .NET binary?

2 votes
1 answer
825 views

ildasm on Linux: "original" ildasm.exe same as dotnet-ildasm?

3 votes
1 answer
780 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

4 votes
1 answer
533 views

Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?

2 votes
0 answers
452 views

Is there a static data flow analysis tool for .net assemblies?

2 votes
0 answers
422 views

IDA Pro .til files backward compatibility

2 votes
1 answer
366 views

Is all debug information of VS-compiled PE files contained in an external PDB file?