Paweł Łukasik
  • Member for 5 years, 1 month
  • Last seen this week
1 answers
6 votes
696 views
How to tell if a particular .NET assembly was written in C# or F#?
Accepted answer
10 votes

Why does decompiling an F# assembly produce C# code? It doesn't. It produces IL code which then can be interpreted as C#, F# or VB.NET. dotPeek doesn't allow you to use any other language for ...

View answer
1 answers
5 votes
584 views
Why does PE ImageBase address change in memory?
8 votes

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...

View answer
1 answers
2 votes
4k views
What does this assembly language program output?
Accepted answer
8 votes

This is such a small program so this could be followed without converting it back to C. Let's break it down what happens when it's being called with asm(0xb6, 0xc6). push ebp mov ebp, esp ...

View answer
1 answers
7 votes
760 views
Shellcode challenge - shellcode works in test program, segfaults in actual binary
Accepted answer
8 votes

It looks like you have two issues. 1) You are overwriting your input buffer with those push-es so that why you have some junk on the stack and that's why our application crashes. See those two ...

View answer
1 answers
6 votes
751 views
Viewing Radare keybindings for Visual Pane mode (Function hotkeys)?
Accepted answer
7 votes

Those are probably used if you remap the default ones. And those are visible when you press ? in Visual mode, but not in Visual Pane mode (V!). Scrolling down will show the keys for debugging: ...

View answer
2 answers
3 votes
317 views
Why doesn't this retn instruction return from the function?
7 votes

The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...

View answer
1 answers
1 votes
955 views
Way to get all the function prototype using Ghidra
Accepted answer
6 votes

You can use FunctionManager to get all the functions in the current program and then, from it iterate and get signatures of each. fm = currentProgram.getFunctionManager() functions = fm.getFunctions(...

View answer
1 answers
3 votes
1k views
grep -E with Radare2
Accepted answer
6 votes

Radare's grep is done by using the ~ character. ~?<br> |Usage: [command]~[modifier][word,word][endmodifier][[column]][:line] So to have the output you want just run: iI~bits,pic,stripped [...

View answer
2 answers
4 votes
622 views
ASM working as is, but not in a C program
Accepted answer
6 votes

The problem with you shellcode and the why it differs if you run from C program or not is the initial values. The registers that are used when executing execv (second page) are: eax = 0x0b ebx = ptr ...

View answer
1 answers
3 votes
63 views
Confused about the use of the shl instruction in this disassembly
Accepted answer
5 votes

Let's break it down line by line. Assuming x is the thing you want to multiply by 21 and it's stored in eax (as it is in this example after line 34). <39>: mov edx, eax ; so copy the x to edx &...

View answer
1 answers
0 votes
1k views
Extracting Assembly line code from an executable in Ghidra
Accepted answer
5 votes

Not sure if you ask about one line or the whole program. One assembly line can be obtain for example by such script: addr = toAddr(<address>) print(currentProgram.getListing().getInstructionAt(...

View answer
2 answers
3 votes
2k views
Why Ghidra doesn't load the disassembly correctly while radare2 does?
Accepted answer
5 votes

When you have just raw bytes without proper headers tools might not know how to process as the code might not start from offset 0. They could try to analyze the bytes to detect if there's code, data ...

View answer
2 answers
5 votes
1k views
Trace Method Calls in .NET/C# Binary
5 votes

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...

View answer
3 answers
4 votes
299 views
Obfuscated code analysis - can unused variables be ignored?
Accepted answer
5 votes

This might be true that those variables are added only to confuse analysis but remember that in Javascript there are so many ways to access the variable that I would take such info from an automated ...

View answer
2 answers
2 votes
1k views
Can I set more than 4 memory access breakpoints in WinDbg?
Accepted answer
5 votes

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.

View answer
2 answers
2 votes
575 views
How work this obfuscation, and how deobfuscate?
5 votes

It just uses very difficult to read variable names and do some JS trickery to confuse you what it does. If you replace those strange characters you'll get a bit of more readable form a=~[]; a={___:++...

View answer
1 answers
2 votes
68 views
Structure of operand bytes in .NET call and data access IL instructions?
Accepted answer
4 votes

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of ...

View answer
1 answers
3 votes
136 views
Radare2 - what does dot mean in disassembly
Accepted answer
4 votes

Since the number of bytes in the instructions can be different and they had to put some limit on the column width, this is how it is indicated that there are more bytes in the instruction that those ...

View answer
1 answers
2 votes
990 views
Ghidra what's the meaning of _0_4_
Accepted answer
4 votes

It is being used when there's a mismatch between type sizes in the decompiled code and Ghidra cannot show you that the whole variable is being modified. Your PUCHAR - since it is a pointer and this ...

View answer
1 answers
2 votes
144 views
Why is IDA showing three arguments for the main function instead of two in some linux binaries?
Accepted answer
4 votes

The third one is an array to environment variables that this program has access to. If you read the documentation of execve it reads as follows: The argument vector and environment can be accessed ...

View answer
1 answers
1 votes
105 views
Addresses displayed in radare2
4 votes

The difference is that the first address, 0x00602090 is the location from where the value will be loaded into the rax register. The second one, 0x400c60 is what is located in that memory location. r2 ...

View answer
2 answers
6 votes
4k views
What are the difference syscall and int 0x2E instructions?
4 votes

int 2Eh is used on 32bit OS to enter the kernel mode. On 64-bit, the same is obtained by using syscall. The check done on memory address 0x7ffe0300 is one of the ways to detect the bitness.

View answer
1 answers
1 votes
133 views
found easter egg (incl releasing trigger) in as code, but no clue how to fire it
Accepted answer
4 votes

This combination (up, up, down, down, left, right, left, right, A, B) is a well known Konami code so just pressing those keys should trigger it. The real question here is when, or if at all this ...

View answer
4 answers
11 votes
8k views
How can breakpoint be set using offset in ELF file, not virtual address?
4 votes

You can't do this in vanilla gdb but if you are using pwndbg you can. The command is called breakrva or brva for short. You can use it like this: brva 0x520 but the program has to run.

View answer
2 answers
2 votes
297 views
Radare using `pd` without the call graph lines?
Accepted answer
4 votes

Those lines can be disables via r2 option namely by: e asm.lines=false after that, they no longer appear in pd.

View answer
3 answers
4 votes
2k views
Faster Kernel debugging for Windows
4 votes

GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging. The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4. Around 34 min in the stream 1 he mentions ...

View answer
1 answers
1 votes
197 views
Reverse code check
Accepted answer
4 votes

Well the algo is quite simple, let's try to break it down: if (code.Substring(0, 2) != "DC") It has to start with DC if (code.Length != 0x1a) and be of length 26 chars string s = code....

View answer
1 answers
1 votes
46 views
Reversing bit rotations
3 votes

For ror/rol you just use the reverse operation - rol/ror as bits are rotated - nothing is lost. 0xdeadbeef rol 5 -> 0xd5b7ddfb 0xd5b7ddfb ror 5 -> 0xdeadbeef

View answer
1 answers
2 votes
148 views
Can't modify string in radare2 (.rodata section)
Accepted answer
3 votes

All is good. r2 doesn't refresh this .rodata by default after your change but if you go to the address 0x2004, you would see your change. r2 -w modified_helloworld w Good, Bye!!!! @0x00002004 s 0x2004 ...

View answer
2 answers
3 votes
160 views
Extracting Info from Ghidra Listing Window
Accepted answer
3 votes

So, the answer was provided in the OP's ticket #1994, just transferring it here for the future seekers: from ghidra.program.model.listing import CodeUnitFormat, CodeUnitFormatOptions codeUnitFormat = ...

View answer
1
2 3 4 5