PhoeniX
  • Member for 8 years, 8 months
  • Last seen more than 2 years ago
How to know in which language/technology program (.exe) is written?
16 votes

.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework. C++ can be identified by looking at ...

View answer
What is the difference between static disassembly and dynamic disassembly?
Accepted answer
16 votes

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by ...

View answer
Difference between DllMain and DllEntryPoint
12 votes

DllEntryPoint - is the address from which the execution will start (but does not have to if we are speaking about malware) after the loader had finished the loading process of the PE image. This ...

View answer
Can a Windows process check if it has been injected by another process?
Accepted answer
8 votes

Injected code could represented by, but not limited to: Remotely created thread could be detected by several techniques: Periodically check if process threads were created by current process using ...

View answer
How to detect a debugger using some "time" checking strategies?
Accepted answer
8 votes

This is pretty broad subject :-) There are several examples: GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of ...

View answer
Is there any disassembler to rival IDA Pro?
8 votes

I would also add PEBrowse64 Professional With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a ...

View answer
How to unpack files packed with multiple packers?
Accepted answer
8 votes

As you saw by yourself, RE is not a easy skill to accomplish. One must find as much patience (at least) as he could to acquire it, some intelligence and knowledge will also help. If you think that ...

View answer
How to unpack(carve) files from a camera firmware .bin file?
7 votes

From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and ...

View answer
Use OllyDbg to identify what happens when a button is pressed
6 votes

If you have very little experience in binary RE I would suggest to start with preparing for a lot of unknown information that would be "thrown" on you, time and patience :-). Now to the subject. To ...

View answer
Reading Physical Memory
5 votes

I understand that when the OS is in protected mode a process can only access the virtual memory assigned to it without resulting in a segmentation fault. Correct. By design, all processes are ...

View answer
How can I change the value of a variable while debugging?
Accepted answer
5 votes

Google is your friend: For example, if your program has a variable width, you get an error if you try to set a new value with just `set width=13', because GDB has the command set width: (gdb) ...

View answer
The debugger could not attach to the selected process
5 votes

Depending on what you try to achieve, you can try to attach WinDbg in noninvasive mode: F6 -> select the process and select noninvasive mode down on left. Other suggestion is, to patch the executable ...

View answer
Totally unknown file analysis approaches
5 votes

I would start with checking the first bytes of a file after base64 decoding. Those would indicate what file format is. MZ(5A4D) - meaning this is an executable file and you can start with executing ...

View answer
Malware in virtual machines
5 votes

There were a lot of saying in replays, but I'd like to stress on some answers from the practical point of view: network connection - a while ago I would agree that simply disconnecting the vm from ...

View answer
How can DLL injection be detected?
5 votes

Patching game's executable + using loading order trick You should check the integrity of the games executable files before loading as there are way to patch it to load malicious Dll files, overlays ...

View answer
PDB v2.0 File Format documentation
4 votes

This is what I've found: Exploring Symbol Type Information with PdbXtract - from Mendiat. PdbXtract is not a pure PDB parser. It only extracts type information using Microsoft’s DebugInterface ...

View answer
Exports that redirects to other library
Accepted answer
4 votes

This is called export forwarding and you can explore it here with nice explanation: The PE file format The next 32-bit-value 'AddressOfFunctions' is a RVA to the list of exported items. It ...

View answer
Find exact dependency tree of a program
4 votes

You can use the following tools to inspect and try to recover information about PE file: PEiD it has extensive pe file editing capabilities Detect It Easy - another very useful tool for PE analysis ...

View answer
Reversing simple hello world in C++
4 votes

There are several reasons for that: Compiler itself - you will get slightly different code while using different compilers due to optimizations compiler implements, its default options. to actually ...

View answer
Runtime memory reading with injection
Accepted answer
4 votes

You can write your hooking library (DLL) which will patch the API you are targeting. This patch will just print to file/console the parameters and continue back to the original function. There will be ...

View answer
How to dump a DLL not listed using Process Explore and similar tools
Accepted answer
4 votes

I'll list some ways to do it. Obviously there are many others and most likely other fellows here will add. Start with those as they are ones of the mostly used. While debugging a malicious process, ...

View answer
C++ Anti Kernel Debugger?
3 votes

There is little you can do to prevent/detect kernel mode debugging of your application from user mode. Even if you can detect, it's because no one is interested enough to by-pass them. For example, ...

View answer
Creating a patcher for a mac app
Accepted answer
3 votes

There are several aspects for this: if the app is not protected with some sort of packaging you just need to find the place that you want to patch with the help of debugger (when the app is running) ...

View answer
x64dbg how to debug a DLL called from an application
3 votes

There are several easy steps to do it: If you have a source code, you can create a very basic endless loop at the beginning of your code and once this dll will load, hitting a break will eventually ...

View answer
How to modify a file from the process context of iexplore.exe?
3 votes

One of the ways is to load your code into that process (iexplore.exe) and hook the file creation/writing APIs. This will give you the way to alter that process IO. But why would you do that? This ...

View answer
API hooking using DLL injection with Python C-Types
3 votes

please look at the following: PyDBG - it's a python wrapper around Win Debug API and much more. The framework enables one to literally inspect every aspect of the running process by registering event ...

View answer
How can I decompile my (dot)NET .EXE file into its source code
Accepted answer
3 votes

you can get pretty decent results with: .NET Reflector 8 ILSpy - is an open source project. I had experience with it in the past and it gave very good results.

View answer
Understanding assembly loop
Accepted answer
3 votes

there are 2 loops in the code: 0x40109d mov $0x2,%ecx 0x4010a2 mov %ecx,%esi 0x4010a4 mov $0x3,%ecx 0x4010a9 mov $0x2,%ebx ... first loop ... ...

View answer
How to load a dumped process and several accompanied memory pages in IDA?
3 votes

While waiting for an answer I've also done some searching and here what I've got in case, somebody also interested in this issue. Kris Kasperski a.k.a. nzumi gave quiet a an answer to the above ...

View answer
Immunity Debugger PyPlugin
Accepted answer
2 votes

Going over ImmunityDbg presentation - page 26, v1.73 dir - dir structure ImmDbg help file - "PyHooks ... they look exactly as a python plugin, only that they are placed inside PyHooks directory." ...

View answer