0xec
  • Member for 8 years, 10 months
  • Last seen this week
Reducing PE Headers
4 votes

You need to know about the PE format in detail. There are quite a few header entries which can be removed to make the PE as small as possible. However doing this is generally not recommended as this ...

View answer
How to set a breakpoint at the specific location on the stack in OllyDbg
4 votes

If the arguments of the function on stack is a pointer (such as pThreadId for CreateThread), then follow the steps below. Otherwise if the argument is some value (like CreationFlags) then refer to ...

View answer
Conflict of OllyDbg plugins
Accepted answer
2 votes

It is quite possible for Ollydbg's plugin to interfere with each other. Generally you should only keep plugins that you use. The best anti-debugging plugins for Ollydbg as of now are ScyllaHide for ...

View answer
Can I get the last error using IDA under Windows?
Accepted answer
5 votes

GetLastError simply returns LastErrorValue from the TEB (Thread Environment Block) of the thread concerned. You can access TEB of the current thread through the segment register FS. FS:[0x18] ...

View answer
Running an optimization pass on an IR
2 votes

You can try the Miasm framework which is written in python and has all the capabilities you require. Other than this you have metasm, written in pure ruby with no dependencies. These frameworks ...

View answer
Changing start address of thread using combination of Get- and SetThreadContext?
4 votes

Your intuition is correct. Changing the starting address of the Thread via SetThreadContext will change the entry point. Here is a C++ snippet to verify our claims #include <Windows.h> #include ...

View answer
What tools are available to trace system resources a program is touching in windows?
Accepted answer
6 votes

Process Monitor Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. Windows Performance Toolkit The Windows ...

View answer
Can't change the icon of a .exe file. Seems to be protected?
Accepted answer
1 votes

Such a problem is common with executables having overlay. An overlay is extra data appended at the end of a PE. The overlay is located at the end of the sections. When a PE is loaded the overlay is ...

View answer
Use of Sleep() function (twice)
0 votes

This is a possible scenario in a multithreaded application. Here the anti-debugging check is run in a dedicated thread. When the main thread calls Sleep, it means that it is giving up cpu-time so that ...

View answer
large exe in ollydbg
1 votes

Large exe files are primarily due to large amounts of embedded data. Embedded data may mean binary resources and/or overlay. Large file sizes can also be due to static linking. If it is due to ...

View answer
What are the open source symbolic execution tools for windows binaries
Accepted answer
2 votes

Metasm and Miasm can perform symbolic execution on Windows binaries. Metasm is written in pure ruby with no dependencies. Miasm is written in python. You can find some usages of the above frameworks ...

View answer
Modify py2exe packed executable
1 votes

A py2exe generated executable basically consists of three main parts - PYTHONSCRIPT, the runtime python dll & library.zip. PYTHONSCRIPT can be modified with a decent resource editor. It is ...

View answer
how to attach to a process as soon as it is loaded in memory
Accepted answer
6 votes

One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads. Some other way ...

View answer
Ollydbg and IDA Pro unable to attach to process
Accepted answer
3 votes

Debug the loader. Set a breakpoint on CreateProcess (or ZwCreateProcess if needed) When the breakpoint is hit modify the process creation flags on the stack to include CREATE_SUSPENDED. Make sure ...

View answer
Reverse-engineering of an Unity dll
2 votes

This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport etc present in the source code) with all the real hash logic and ...

View answer
Using a DLL proxy fails due to an unknown error
4 votes

The problem happens due to the fact that the required CRT DLL's are missing on the target machine. To avoid this you can link against the CRT statically. Use the Multi-threaded (/MT) linker flags in ...

View answer
Identifying cryptography algorithm
Accepted answer
5 votes

You can always feed the original binary to IDA and use the plugin Findcrypt2 to identify the algorithms used. Other than this the Kanal plugin for PeiD can also detect cryptography used. Another tool ...

View answer
How to hook the entry point of a DLL?
3 votes

You should not be using IAT overwriting hooking method for the same reasons you mentioned. Use the inline hooking method with a JMP instruction to the target hook. You need to save the overwritten ...

View answer
How to figure out which imported function(s) in a virus determine its behaviour?
Accepted answer
2 votes

Dlls can not only be imported statically but also dynamically. For the dynamic case, it uses LoadLibrary to load the dll, and GetProcAddress to resolve the address of the function it needs. If the ...

View answer
GUI for transforming Java Bytecode based on decompiled source?
6 votes

Some tools you can use. However note that none of them has the ability to recompile classes, i.e you cannot decompile a single class to source, modify it, and then recompile back. It may be possible ...

View answer
Who does construct the stack on process creation in Windows?
Accepted answer
3 votes

Visit these two webpages for information about stack and stack frames what is meaning of the initial stack between EBP and ESP? EBP and ESP are used in conjunction to create a stack frame. To ...

View answer
Extract driver from PE
Accepted answer
1 votes

There is already a ready made tool which scans for embedded PE within another PE. Download Exeinfo PE and use the ripper option. It will automatically scan and dump any embedded PE within the master ...

View answer
Virtual address translation in assembly language
1 votes

Sorry, your question is not very clear. Based on what I could understand, who will translate CALL notepad.0073053 to CALL [Real address 0x??????] ? You will need to look into the Intel ...

View answer
How to decompile python 2.4 bytecode?
8 votes

You just need to search online. Anyways here are some python 2.4 decompilers worth trying, decompyle - http://murphey.org/code/decompyle-2.4.tgz pycdc - https://github.com/zrax/pycdc depython - http:/...

View answer
Reverse Engineering program written in Python, compiled with "freeze"
15 votes

This is how you should proceed in such cases. Step 1 : Load the executable in a debugger like Ollydbg. Step 2 : In the memory dump window, navigate to PyImport_FrozenModules by pressing Ctrl + G ...

View answer
How to understand the "lpStartAddress"-Parameter of the function CreateThread
2 votes

From MSDN lpStartAddress is a pointer to the application-defined function to be executed by the thread. This pointer represents the starting address of the thread. Basically lpStartAddress is ...

View answer
Deobfuscating IDA Pseudocode
Accepted answer
3 votes

IDA Pro is no magic tool to automatically decompile binaries to their source code. The decompiler output should not be relied every time (as compiling leads to loss of information) although IDA boasts ...

View answer
Decompiling/disassembling lua bytecode
Accepted answer
3 votes

There is virtually no difference between the bytecode emitted by loadfile and luac. The only possible reason for the error you are getting is that you are opening the file stringdumped.txt in text ...

View answer
Suspicious breakpoint message in ollydbg
Accepted answer
6 votes

PE files have several sections like .code , .data, .bss etc. Each of the sections have a special purpose, such as the .code section usually contains the programs code i.e. the instructions, the .data ...

View answer
Modified Java byte-code, no difference runtime
Accepted answer
3 votes

Firstly, I would mention that instead of using a general purpose hex editor, a dedicated class editor would be much better. There are plenty of them. You tried editing the class file and to your ...

View answer