Ta Thanh Dinh
  • Member for 8 years, 9 months
  • Last seen this week
UPX packing/unpacking information preservation
Accepted answer
9 votes

If you compare the hash values of original/unpacked files, then they are different since upx -d does not restore bit-by-bit of the original file. Indeed, UPX parses the original file and keeps only ...

View answer
Why is there a difference in offset between ida and gdb?
Accepted answer
5 votes

For "Position Independent Executable" binaries, the loader is free to relocate the binary using some base address. In the case of GDB, the binary is mapped already into memory, the offset 0x2013a1 in ...

View answer
Intel PIN: How to access the INS object from inside an analysis function?
Accepted answer
5 votes

You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &...

View answer
Understanding the loop disassembly
5 votes

The var_d8 is the base position of arr in the stack, the size of type int in your machine is 4, so the position of arr[i] in the stack is calculated by: var_d8 + 4 * i

View answer
Inverting functions HOWTO
5 votes

I try to give a very superficial answer for your question because I am quite sure that there are other treatments for this problem. Mathematically, the function f(y) = y^(y >> 11) is invertible ...

View answer
Is it "theoretically" possible/impossible to reverse any binary?
4 votes

I try to give my idea about reversing, not an answer, because I myself hope that I can find it, moreover I am quite sure that any expert here may say that what I think is crappy but I beg a generosity ...

View answer
Intel PIN: InsertPredicatedCall and INS_InsertCall
Accepted answer
3 votes

You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code cond: xor eax, ...

View answer
How to break this reversing exercise
Accepted answer
3 votes

We can define recursive functions in SMT language (e.g. with define-fun-rec), but some popular solvers (e.g. z3) currently cannot handle them yet (I do not know any can support); so it is not direct ...

View answer
Binary Instrumentation of malware binaries?
Accepted answer
3 votes

Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin ...

View answer
Return address on ESP?
3 votes

The comment of Guntram Blohm explains your situation. Since you put the breakpoint at call, the instruction is not executed yet, and you do not see the returned address is pushed in the stack yet. But ...

View answer
32-bit binary stack layout on a x64 Linux OS
Accepted answer
2 votes

The valid stack access range of a (32 or 64 bit) process can be viewed by looking into its memory map. We can observe the memory map of a process with id pid by cat /proc/pid/maps, an example of a 32-...

View answer
What is the "standard" approach to find loop in binary code?
2 votes

You might find this question about finding recursive function helpful, there are very nice answers for it. Under the binary code level, IMHO, there is only little difference about detecting loop (i.e. ...

View answer
Reconstruct control-flow graph from x86 instruction trace
2 votes

I am sorry for this self-advertisement, but I am developing a tool here. My final goal is to recover the original control flow graph of virtualized binaries. But at a step of this, for visualization ...

View answer
Dynamic instrumentation tools which support reverse execution
1 votes

In previous versions of Pin, there was APIs for checkpoint/re-execution; but they are not supported in recent versions. They are instead moved to a more complete framework, called PinPlay. You can ...

View answer
Virtual Method that returns <this>?
Accepted answer
1 votes

The C++ compiler of Visual Studio uses ecx as the default register for this pointer, a virtual method which returns ecx then actually returns this or *this. For example, you can test the following ...

View answer
Expressing trace semantics as a solution for a fixpoint equation
Accepted answer
1 votes

You may consult pages 39-41 in the thesis "Code Obfuscation and Malware Detection by Abstract Interpretation" of M. Dalla Preda about formal obfuscation; or sections 4.4 and 4.5 in the orignal ...

View answer
What is this 'mathematical jigsaw puzzles' obfuscation?
1 votes

I still wonder should I add a comment on this because my knowledge on the cryptography is extremely limited. The paper on the jigsaw obfuscation uses a term named functional encryption, that means ...

View answer
How to design opaque predicates?
1 votes

I do not know any real-life opaque predicate. But there is a very constructive predicate obfuscator in the paper Limits of Static Analysis for Malware Detection. It is proved to be NP-hard for precise ...

View answer
Methods for preventing IDA decompiler
0 votes

The answer of @igor says about algorithm failures of IDA. Beside, I think you can use a function which is not type-able in the type system of the decompilation target language of IDA (I believe it's a ...

View answer
Why do simple x86 instructions confuses IDA Pro
0 votes

In short, distinguish code from data is a undecidable problem. Concretely, your question is a special case of this question where you can find answers with detail explanation.

View answer
Do I have to consider virtual function declaration order?
0 votes

Since I do not think the order of virtual functions in source could affect their order in machine code, I try to give a counter example. The main idea is first to give a layout for the vtable of a ...

View answer