manduca
  • Member for 3 years, 10 months
  • Last seen more than a month ago
Behavior of undocumented Windows features
2 votes

There is leaked source code of windows 2000. I don‘t know if it covers those utilities. Also the reactos project (an open source reimplementation of windows) is usually very faithful to the original. ...

View answer
Best Way to Identify Statically Linked Functions in Firmware
2 votes

There is a project called Sibyl based on the symbolic execution framework miasm. They basically call each unknown function with test cases until it passes all test cases for a given hypothesis. E.g. ...

View answer
Is this obfuscation?
2 votes

At first glance it does not look like code obfuscation, just like normal complexity. From the snippet I cannot tell you where the actual value is that you want to modify. Maybe the string is a key in ...

View answer
C representation of simple assembly
2 votes

Okay: JAE is synonym to JNC (jump if no carry flag). And the docs for SHR say:”Bits shifted beyond the destination are first shifted into the CF flag.” So you jump when the rightmost bit (before ...

View answer
VMProtect keygen, turn off the anti-debugging
Accepted answer
1 votes

You can use something like ScyllaHide to hide your debugger while you still don‘t know the method they use to detect you.

View answer
Intel PIN (TracerPIN): adding modification of registers
Accepted answer
1 votes

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.

View answer
De-obfuscation - Emulation-oriented vs Script-oriented
Accepted answer
1 votes

The approaches you mentioned: Scripting static analysis with IDA: Great for removing automatically inserted bloat like PUSH EBX; add EBX, ECX; pop EBX, great for automatically finding and extracting ...

View answer
How to deal with heavy control flow flattening?
1 votes

One would have to look at the code. How are the jump targets calculated? From your diagrams it could also be something as simple as: void jump_to_x_plus_5(uint x) { jmp x+5; } void jump_to_x_plus_7(...

View answer
Unicorn emulator: find out if register is undefined
1 votes

Unicorn only supports concrete values in registers. You could cheat your way around this by doing two runs with two sets of magic values. But what you really want is a symbolic execution framework ...

View answer
Getting started with RE, with eventually goal being able to make a keygen
0 votes

1) ollydbg and x64dbg are debuggers (with limited functionality to annotate knowledge).Their strength is dynamic reverse engineering. IDA and Ghidra are reverse engineering tools (IDA with some ...

View answer
Tool besides ida to get high level code
0 votes

Currently nothing beats the quality of IDA’s ARM decompiler. But if you are on a budget, BinaryNinja’s medium level IL is actually quite pleasant to read. And in my experience it’s correct (while ...

View answer
How to find out if PE executable was compiled with gcc or VisualStudio?
Accepted answer
0 votes

There‘s a tool fort that: peid. The format used by peid is also the de facto standard format for detection of compilers and runtime packers (=programs that modify compiled programs). While peid seems ...

View answer