dyasta
  • Member for 8 years, 8 months
  • Last seen more than a month ago
  • USA
2 answers
1 votes
133 views
strange instruction in IDA when debugging malware
1 votes

It is certainly preparing to call it, we can speculate (why else reference it?). RegCloseKey is simply used to close an open handle to the registry. It doesn't 'shut down' the registry, as your ...

View answer
2 answers
1 votes
2k views
Serial output garbage
1 votes

Whenever I had garbage it was due to incorrect baud rate or other settings, but you've tried those. Otherwise, check the connection carefully and make sure it is soldered well. Also ensure your TTL ...

View answer
2 answers
2 votes
264 views
How can I guess hashing or checksum algotrithm which is used?
2 votes

You can dump the ROM, disassemble, find the code that loads and reads the GIF, and you are sure to find the checksum algorithm. Other than that, you pretty much have to run a guessing game, ...

View answer
2 answers
2 votes
704 views
Modify program's registry accesses from HKLM to HKCU in assembly
Accepted answer
3 votes

You are looking to identify all calls to RegCreateKey/Ex and RegOpenKey/Ex calls, then check their first parameter, then change it to HKCU integer definition (0x80000001) instead of HKLM (0x80000002). ...

View answer
3 answers
3 votes
666 views
What is "webcomp" and how does it work?
Accepted answer
6 votes

/* * webcomp -- Compile web pages into C source * * Copyright (c) GoAhead Software Inc., 1995-2000. All Rights Reserved. */ Webcomp Description Webcomp, or 'web compiler', is a very simple tool ...

View answer
4 answers
8 votes
3k views
What's the easiest way to determine the OS contained in a firmware binary?
3 votes

It isn't rocket science. IDA is not the tool to use for making this simple determination. Check the strings found in the firmware image. If you can't find any, it may be encrypted and/or compressed in ...

View answer
5 answers
26 votes
4k views
How do I move from RCE being a hobby to RCE being a profession?
8 votes

Taking your hobby to a profession is a bigger deal than just knowing what you're doing. Suddenly your hobby becomes 'work'. Can you deal with that? Or will the loss of enthusiasm hurt you? Also, you'...

View answer
2 answers
13 votes
10k views
What are the different types of packers?
9 votes

Definition We'll define a packer as an executable compressor. Packers reduce the physical size of an executable by compressing it. A decompression stub is usually then attached, parasitically, to ...

View answer
2 answers
9 votes
1k views
What is "instruction camouflage" obfuscation?
2 votes

This is also commonly known as an encryption wrapper. I'm sure there are several other similar names used in the industry. The actual code isn't as important as the concept. The plaintext code is ...

View answer
1 answers
-6 votes
609 views
What is Data Interleaving?
Accepted answer
1 votes

Data Interleaving is a term I made up to reflect an idea I've been contemplating lately; interleaving the bits of a set of variables into a single binary blob. Any number and types of variables could ...

View answer
2 answers
11 votes
4k views
What techniques are used in reverse engineering embedded firmware?
6 votes

Reversing the firmware format can involve many different things, depending on the level of difficulty. You would start with manual analysis with a hex editor. If the data appears nicely structured, ...

View answer