Chris Tsiakoulas
  • Member for 6 years, 8 months
  • Last seen more than 1 year ago
Malware static rules?
Accepted answer
1 votes

You can create or download tools to scan files with YARA rules. There are many repositories on github with custom rules and you can also get the ClamAV database, which is all in YARA. I think ...

View answer
How to decompile a C# .exe on macOS?
5 votes

Best free tool for the job is ILSpy, but it runs on Windows. This gives you a limited list of options: create a windows virtual machine (with virtualbox or vmware player) and run it in there install ...

View answer
What is a good and reliable C decompiler that support ELF and SH4 Architecture?
-3 votes

One of the most complete decompilers i use for pretty much everything ;) is the Radare2. Very agile, with a browser-based GUI (which you have to install extra :( ), supports python scripting and it ...

View answer
Where can I get systematic problems and solutions for debugging?
1 votes

You can read this, which is an excellent book for reverse engineering and has many different things to try in many well-known arcitectures. If you want challenges, i know that root-me.org has some ...

View answer
Why does program fail to run under several debuggers?
0 votes

Welcome to the world of reverse engineering! What you are facing is differents sorts of anti-debugging techniques. You mentioned "IsDebuggerPresent and ReleaseMutex". Those are records in the windows ...

View answer
Crash after exe modification
0 votes

@Karim's idea is right. Another thought is that your malware might be checking windows' registry debug flags. Since Olly runs dynamic analysis, your .exe recognises it and stops working if any changes ...

View answer
reverse engineering methodology
1 votes

I suggest you took a look at the rest code, too. Finding something in specific can definitely be a breakthrough, but one line of code - especially in assembly - can't do a lot on its own. Look at the ...

View answer
Basic help for reverse engineering for a newbie
3 votes

Download and read Reverse Engineering for Beginners. It is excellent and free to download. It contains lots of theory and examples you can easily understand. Plus, it refers to all major architectures,...

View answer
EXE Encryption Techniques
0 votes

Check out packing and unpacking techniques, find and reverse some known ones to see how they work. Apart from encryption techniques, you can also check other anti-reversing techniques like the good-...

View answer
Can't find the base address of a function with IDA PRO (compiled with vs2015)
0 votes

I am afraid i can't comment yet so i will post my thought as an answer. I have also found myself working with visual studio(2010,2013,2015) and trying to reverse-engineer something I made. Visual ...

View answer
Dumping binary with radare2
-2 votes

I would suggest you tried working with OllyDbg and WINE. Kali linux has this combo pre-installed in its toolbox. It works fine in many platforms (ubuntu, open-suse, etc).

View answer
Static analysis of Windows executable from a Linux platform
0 votes

I would suggest you tried out using OllyDbg with WINE. Kali linux has this combo pre-installed for that puprose and it works in every platform wine supports (ubuntu, open-suse, etc.).

View answer
Stopping at the original entry point in a packed file
-1 votes

My idea is to use LordPE to find what's packed with. Once you have unpacked it, ImportREC can help reconstruct your executable without the packer. I don't know what you 're dealing with, but if you ...

View answer
Packed PE-file, where to start?
1 votes

Well, if the packed program executes itself from a virtual environment, things are very difficult. You have to start with the call stack window of ollydbg. Try to find there in which address does it ...

View answer