0xec
  • Member for 8 years, 10 months
  • Last seen this week
Why is this ARM binary throwing an 'Illegal instruction' error and quitting?
Accepted answer
4 votes

From a preliminary analysis the binary looks to be of atleast ARMv7. It runs under qemu-user without problems. $ qemu-arm --version qemu-arm version 2.11.0 Copyright (c) 2003-2017 Fabrice Bellard and ...

View answer
Inject code into JNI function (Android shared library)
Accepted answer
3 votes

You can use Frida. Frida is a dynamic binary instrumentation tool that allows you to intercept, trace, modify, ... of a running application using a JavaScript debugging logic. For your purpose, you ...

View answer
IDA - Create Process Flow Map Between 2 Sub-Routines
Accepted answer
2 votes

You can use the alleycat plugin to find the path between two functions/basic blocks etc. Example Finding the path between two functions http_init_main and http_parser_set_challenge in a mipsel elf. ...

View answer
How to use Frida on a Java application ? (non Android application)
Accepted answer
1 votes

To my best knowledge, Frida has no support for non-android java applications. For desktop java applications you are better of using Java agents or the lower level JVM-TI interface. There's also the ...

View answer
Area calculations & what about 12.5m?
Accepted answer
0 votes

This is not a question of reverse engineering, but anyway this is how you can proceed. Divide the cross-section into 5 parts - 3 rectangles and 2 trapezoids. Area of rectangle and trapezoids can ...

View answer
Extracting classes from running JVM
Accepted answer
7 votes

I would recommend using a Java Agent to extract classes from the running JVM instance. An agent is a tool that provides instrumentation capability for an application. Speaking of agents, there are two ...

View answer
How does the processor distinguishes processes wrt HW bps?
Accepted answer
2 votes

The various bits in the DR7 (debug control) register determines the applicability of the hardware breakpoint in question. Such breakpoints can be local or global. Global breakpoint, as its name ...

View answer
Linked list in IDA
Accepted answer
2 votes

The instruction mov esi, [esi + 8] copies 4 bytes (DWORD) of data at the location pointed to by esi + 8to register esi. In your case esi is 0804B260 so it copies 4 bytes from 0804B268. Since x86_64 ...

View answer
Randomly picking up a x86 register for an instruction
Accepted answer
18 votes

To better understand this, you need to study instruction encoding formats i.e. x86 for this question. An x86 instruction looks like this +----------------------+--------+--------+-----+--------------...

View answer
Memory Read Access Breakpoint Question
Accepted answer
5 votes

This is a tricky question. On x86 platform the maximum length of an instruction is 15 bytes. You can read 15 bytes backwards from the current EIP and pass it to Disasm function of BeaEngine. This ...

View answer
Firmware extraction problems - binwalk is blank
Accepted answer
4 votes

The firmware image is likely to be encrypted. Entropy scan reveals that it is mostly comprised of random bytes which happens if the firmware is compressed and/or encrypted. Since the binary lacks ...

View answer
nop with argument in x86_64
11 votes

These are multi byte nop instructions. From http://www.felixcloutier.com/x86/NOP.html Description This instruction performs no operation. It is a one-byte or multi-byte NOP that takes up ...

View answer
How to stop IDA debugger when a register is set to a particular value?
Accepted answer
3 votes

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() ...

View answer
Is there a way to set the cursor address in IDA Pro?
Accepted answer
9 votes

Use Jump for IDC or idc.Jump for ida python.

View answer
Limitations of capstone's disassembly capabilities compared to IDA
Accepted answer
3 votes

There is no point in comparing between the two. IDA is more than a disassembler, it is a reversing tool which implements(or could be implemented via plugins) almost every feature you can think of. ...

View answer
Different basic block count when running application several times
1 votes

This behaviour is expected. For ping, the execution trace largely depends on the network at any given run. If one ping succeeds in 0.1 ms there is no guarantee that the next will also succeed within ...

View answer
Automatically decode PUSH+RET call into JMP
5 votes

I wrote a similar sort of script, while solving a crackme. The binary in question obfuscated call imm32 jmp imm32 instructions to push imm32 xor dword ptr [esp], imm32 mov edx, imm32 xor ...

View answer
Windows 7x86 System Freezes when running assembly program with int 3h
Accepted answer
1 votes

This occurs when you have kernel debugging enabled, but have not attached a kernel debugger. In short the freeze occurs when, Kernel debugging is enabled. A kernel debugger is not attached. (If it ...

View answer
Attaching debugger to process IDA Pro privilege problem
Accepted answer
3 votes

AFAIK you cannot debug a 64 bit application locally with IDA Pro. You need to use remote debugging. See this page: https://www.hex-rays.com/products/ida/debugger/#details and this: https://www.hex-...

View answer
Is it dangerous to disassemble malware in IDA?
Accepted answer
5 votes

The recommended workflow is to make the initial database (idb) by running IDA within a VM. That way you are safe even in case of a possible zero day. The idb file can then be taken out of the VM and ...

View answer
Anyone had success with IDA & Windroye/Andydroid/BlueStacks?
1 votes

You cannot debug native code with those emulators as they aren't arm based. The emulator from google will however work. For example BlueStacks uses a proprietary technology called LayerCake which ...

View answer
How can I remove a bbl instrumentation call at a specific address in PIN?
1 votes

PIN does not provide a direct API to remove a basic block instrumentation call on a particular address.What you could do is keep track of basic blocks which have been executed at least once. You ...

View answer
Tracing variable access/usage instructions
4 votes

As @Igor Skochinsky has already commented, the software is indeed written in Visual Basic 6 compiled in native mode (VB6 also supports P-mode). You can verify this with a PE Info tool like Detect It ...

View answer
Which functions of a dll is called in OllyDBG
4 votes

There are quite a few ways to achieve this. In OllyDbg search for all Intermodular calls. This would bring up a list of functions called from the main module. You can the set a logging breakpoint on ...

View answer
Need advice : Reverse engineering a pdf with shellcode
Accepted answer
10 votes

The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script. from binascii import unhexlify as unhx encoded = open('encoded.txt').read() # The ...

View answer
Decent GUI for GDB
4 votes

There is Affnic Debugger GUI. It is not free but a lite version exists. It's available for Windows, Linux & MacOS. From the official website, Affinic Debugger GUI .aka. ADG, is designed as a ...

View answer
Load IE symbols in Immunity Debugger
Accepted answer
6 votes

Immunity Debugger 1.60 and above supports loading of PDB Symbol files both locally or from a symbol server. In order to enable it. Go to Debug menu -> Debugging Symbol Options. Provide the local ...

View answer
Reverse Engineering a python mac application compiled with "freeze"
Accepted answer
2 votes

As per the linked post you can use any debugger to dump frozen modules compiled with freeze. However since you are on a mac, PyCommand and Immunity Debugger will not work. However that does not ...

View answer
How to go back to main thread?
Accepted answer
2 votes

Right Click within the Disassembler window -> Select thread -> Click Main thread Here is an image for reference.

View answer
Java .class bytecode debugger
Accepted answer
13 votes

Bytecode Visualizer Inspect, understand and debug Java bytecode, no matter if you have the corresponding source. JSwat Debugger JSwat is a graphical Java debugger front-end, written to use the ...

View answer