0xec
  • Member for 8 years, 10 months
  • Last seen this week
Legality of Decompilation
Accepted answer
3 votes

Legality of decompilation depends on the EULA (End User License Agreement) of the binary you wish to work with. While Open Source License Agreements like GPL may allow to edit/decompile the binary, ...

View answer
Would OllyDbg help recognizing the passed parameters between the caller and the calle?
Accepted answer
2 votes

Ollydbg already shows the parameters passed to a functions in the CPU window. This of course works for standard functions such as printf , CreateFileA which Ollydbg knows about. For example see the ...

View answer
Extract a global variable
Accepted answer
3 votes

Since you say you are trying to reverse an executable which stores some python bytecode in a variable, it means probably the executable embeds python. If the code is likely to be executed at some ...

View answer
kernel32.BaseThreadInitThunk without IAT
Accepted answer
2 votes

It is just a coincidence. It happens sometimes that the value in a register be the address of some valid api which the application has nothing to do about. For reference see these images. I have ...

View answer
Seeing previous register values in ollydbg possible?
3 votes

The Run trace feature of ollydbg can be used to know the values of registers in a previous execution step. During Run trace code is executed step by step, and debugger protocols every command, ...

View answer
Does a JE must follow directly to an CMP?
Accepted answer
10 votes

It is perfectly normal, compilers tend to emit such code for sake of optimization. Moreover delaying the conditional jump is helpful for instruction prefetching & branch handling. The code is ...

View answer
What does _acmdln_dll?
Accepted answer
4 votes

These are global variables provided by the Microsoft run time library. Here is an excerpt of MSDN on-line documentation speaking about the _acmdln variable: _acmdln, _tcmdln, _wcmdln These variables ...

View answer
Where I download plugin StrongOD 0.3.4.639?
Accepted answer
2 votes

I don't know about that version but you can find the latest version (0.4.8.892) here https://tuts4you.com/download.php?view.2028 For more information about OllyDbg plugin system see this and this

View answer
How do you reverse engineer an EXE "compiled" with PyInstaller
4 votes

The one stop solution for all pyinstaller exe things. Use this program to reverse engineer a pyinstaller generated exe file. https://sourceforge.net/projects/pyinstallerexerebuilder/

View answer
Jump back to the caller
13 votes

Here is a way how you would go back to the caller. The following is a small C++ crackme for demonstration #include<stdio.h> #include<string.h> #include<conio.h> int main() { ...

View answer
1 2 3
4