Paweł Łukasik
  • Member for 5 years, 2 months
  • Last seen this week
Are Windows Store Apps in a VM and can they be identified by PE header info?
1 votes

Windows Store Apps are .NET applications so probably better would be to open them in .NET Disassembler (like dnSpy). They are executed by .NET runtime so VM is a good way of calling what's going on ...

View answer
convert C++ code to python code
0 votes

This code can be cleaned up to be a bit more readable void __cdecl decrypt(char *dst,char *src) { byte j; uint i; i = 0; while (j = (byte)i, (char)j < 8) { dst[i] = ((dst[i] ^ src[i]) &...

View answer
Results of radare2 are not correct
Accepted answer
0 votes

It might be due to different algorithms used for analysis or different options set for those. r2 (as well as IDA and Ghidra) has multiple options that can influence how the code is analyzed and how ...

View answer
Simple angr example not working
0 votes

If you can't modify the binary but through the static analysis you get the number of bytes you need to provide as a flag, you can construct bit vector flag_chars = [claripy.BVS('flag_%d' % i, 8) for ...

View answer
radare2 memory changing in debug mode
0 votes

I've run the following on the latest r2 from git: r2 -d ./example after setting the breakpoint on main and running to it I'm getting the following disassembly: 0x004004a6 b 668b04252810. mov ...

View answer
View Array Type in dnSpy
Accepted answer
0 votes

Those are identified as raw locals. You can enable their visibility by going to Options in Debug menu. After that you will be able to see those elements in the locals window. And from there you can ...

View answer
Calculate LEA operand
Accepted answer
0 votes

You can get that value from the last 4 bytes of the opcode. 45 CE FF FF You need to reverse the order of bytes and the the value is written as 2's complement. Since the highest bit is 1 it will be ...

View answer
How does this command modify the condition?
Accepted answer
0 votes

What does the 3 columns in the radare2 visual mode represent? The first one is an address of the instruction, then opcodes followed by mnemonic. On the far left you have also some arrows indicating ...

View answer
Radare2 doesn't update current address, when single-step debugging using `ds`?
0 votes

What you can do is to use pd with the temporary seek operator @ passing rip register so that pd will work from that address. So instead of pd just use pd@rip and you should be fine with that. [...

View answer
Writing a file with radare2 `w`?
0 votes

Just to update @Megabeets answer. When you start with an empty file (created by touch), the w command will not work by default even if the r2 will be started in write mode. The missing information ...

View answer
Change value of an IF condition found in IDA
Accepted answer
0 votes

The way how those IFs are constructed in the assembly is a bit different than what you see in high-level overview in IDA code. Apart from the first one, ifs are represented with subtraction (sub &...

View answer
How do I tell OllyDbg where my source code is?
0 votes

OllDbg is a Windows tool and thus using a windows library dbghelp.dll to do the debugging work. You can tell that by listing Olly's dlls: And dbghelp.dll uses symbol files to link the binary ...

View answer
Some question about IDA
Accepted answer
0 votes

Remember that what you're passing is an address. And the address of v6 and since v6,v7 and v8 are adjacent to each other so any method that works on char * will read from one to the other until it ...

View answer
r2pipe won't prompt for user input like the binary does in r2 debugger mode
Accepted answer
0 votes

I think you're using some of the old version of r2, so my answer will not address that and show you how to do it with the latest one. The problem is with your first line, or wrong assumption that ...

View answer
how to find the strings values in a comparision using ollydbg
Accepted answer
0 votes

It's hard to answer by looking at the low-res image but it looks like that the 'X' is not present in as as string in one place. Instead there are bunch of char comparisons spread across this binary. ...

View answer
Opening Windows 10 DMP file
Accepted answer
0 votes

As stated in this RE answer OllyDbg can't be used directly to analize dumps. You should use either WinDbg(this Preview or old version) or VisualStudio. They can load .DMP files directly and allow ...

View answer
IDA Pro: Converting structure to decimal
0 votes

If I remember correctly this is the MakeData command. So it will change the data type that is used to display the values you have. If you check closely you would notice that from the bottom the ...

View answer
Why always get the message "Illegal Instruction (core dumped)"?
Accepted answer
0 votes

Just by guessing as you has the core dump and could check that for sure. Isn't your issue that the exploit was 45 bytes long and this is what you iterate in the second loop and now when you added ...

View answer
1 2 3 4
5