Carlos Garcia
  • Member for 8 years, 9 months
  • Last seen more than 2 years ago
Analyzing a use-after-free bug (taint analysis?)
Accepted answer
5 votes

I would agree with you in that you need to implement some kind of taint tracing, what is tricky statically. Moreover, you need to know whether there are any constraints applied to your controlled ...

View answer
IDA SDK Extract Offset From Instruction
4 votes

Elaborating on existing answers, if you prefer to use IDAPython: decode_insn(here()) print hex(cmd.Op1.addr)

View answer
Which python library for parsing Linux ELF files?
Accepted answer
4 votes

Take a look at radare2. It can parse file formats (see here for an example of parsing the ELF header). Radare2 supports multiple architectures and is being actively developed. On top of that it has ...

View answer
How can i generate function call tree in IDA for non-standart function calls?
Accepted answer
4 votes

In these cases the target of the calls is generated at runtime and can not be determined statically (with very few exceptions). You need to record this information while running the binary and ...

View answer
IDA basic block type fcb_cndret - what does it mean?
Accepted answer
4 votes

I don't know it either so I put together this small script in order to do some empirical analysis. import idaapi import idc import idautils for f in Functions(): fc = idaapi.FlowChart(idaapi....

View answer
Configure and execute Intel's PIN Tool
3 votes

The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code. Open the MyPinTool....

View answer
Code generation patterns of compilers
Accepted answer
3 votes

I personally enjoy Reverse Engineering for Beginners (by Dennis Yurichev). The book shows (among other things) lots of common code patterns being compiled to different architectures and using ...

View answer
Custom gdb output
Accepted answer
3 votes

what you show looks a lot like PEDA (PEDA Github repo) a Python extension to GDB. Although PEDA is very good, it looks like it is not being actively developed anymore. A newer incarnation of this ...

View answer
How to identify code ran when clicking on an object in a game
2 votes

An effective method in these cases (although not necessarily straightforward) is to use differential debugging. The core principle is to run the application twice and record traces of the functions ...

View answer
How to create a IDA FLIRT signature for a PPC library?
Accepted answer
2 votes

AFAIK, you can only create the .pat files from statically linked libraries using the method you describe. It appears your file is dynamically linked (that would explain the 'invalid input file' ...

View answer
Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error
Accepted answer
1 votes

Your analysis machine is Windows 7, ASLR is modifying your module base addresses between different executions. Try calculating the offset to your OEP (that is, address - base) and using this value ...

View answer
Tools for static function discovery
0 votes

From your question is not clear if you mean known functions or arbitrary ones (a way more complicated problem). For the first case you could take a look at Sybil (https://github.com/cea-sec/Sibyl)

View answer
Finding memory breakpoints from debugged executable
-2 votes

AFAIK this is possible, just read your own memory and look for 0xCC bytes. However this poses a problem since several compilers insert 0xCC bytes between functions (as kind of a trap in case of memory ...

View answer