Brendan Dolan-Gavitt
  • Member for 8 years, 10 months
  • Last seen more than a week ago
Analyzing encrypted Android apps (.asec)?
Accepted answer
18 votes

After a little bit more work and some more careful re-reading, I figured out my mistake: the files in /data/app-asec/ are the encrypted containers. They're actually dm-crypt volumes, which then get ...

View answer
Is it possible to decrypt an SSL connection (short of bruteforcing)?
15 votes

If you have access to the binary while it is running, it is entirely possible to extract the keys you need to decrypt the SSL/TLS session even with perfect forward secrecy. There is a 48-byte secret, ...

View answer
What is MSR Tracing?
Accepted answer
14 votes

MSR tracing generally refers to using the Intel Model-Specific Registers (MSRs) to obtain trace information from the CPU. Because modern (post-Pentium 4, generally) processors have hardware support ...

View answer
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
Accepted answer
13 votes

This is doable in WinDbg, but the syntax isn't the greatest. The other answers are probably better if you're just looking to get a result quickly. That said, here's how you'd do it. RegOpenKeyExW is ...

View answer
Server-side Query interception with MS SQL Server
Accepted answer
12 votes

This seemed like a fun project for a Sunday afternoon, so I had a go at it. To get straight to the point, here's the call stack for a function in SQL server that parses and then executes the query (...

View answer
Decryping TLS packets between Windows 8 apps and Azure
11 votes

One other thing that you could do, which is perhaps overkill but is useful in other scenarios, is to intercept the creation of the 48-byte TLS master secret. For many Windows applications (including ...

View answer
Using QEmu monitor interface to extract execution traces from a binary?
Accepted answer
10 votes

PANDA developer here. I think that actually most of the things you want are supported by QEMU's native gdbstub. If you start QEMU with the -s -S options, it will listen on port 1234 for incoming ...

View answer
Is there any disassembler to rival IDA Pro?
9 votes

I have been using Hopper recently, and while it is not up to the level IDA is, it's really surprisingly sophisticated, particularly considering what it costs. Its main platform is OS X, but there are ...

View answer
What is the "standard" approach to find loop in binary code?
Accepted answer
7 votes

The classic, compiler theoretic answer to this question is to build a control flow graph and then do a graph analysis to identify natural loops. I believe algorithms for this can be found in the ...

View answer
How can I use DynamoRIO or something similar in Linux kernel space?
6 votes

There is a branch in the DynamoRIO Google Code project called "DRK", and commit 1323 has the log message "DRK: DynamoRIO as a Linux kernel module". That should contain the code you're looking for, ...

View answer
Is there an easy way to detect if the SSDT has been patched from a memory dump?
6 votes

Volatility can detect such hooks based on a memory image in any of its supported formats. In particular, the threads plugin will tag any thread with SSDT hooks as HookedSSDT, and the ssdt plugin will ...

View answer
gdb shows that EBP contains a value other than some address(which is what it is supposed to contain). How is this possible?
Accepted answer
4 votes

The leave instruction is equivalent to: mov esp, ebp pop ebp The second instruction pops the value on the top of the stack and stores it in ebp. In the case of a stack-based buffer overflow, your ...

View answer
Converting hex value to lat/long
Accepted answer
4 votes

I'm not sure that this is the right place -- StackOverflow would have been a fine place to ask -- but I'll answer anyway. Essentially the issue is that %x treats the argument as an unsigned int. So ...

View answer
Find the entry point in Interrupt Vector Table ARM9
3 votes

For the ARM946E-S Technical Reference Manual, the exception vectors (including the reset vector) should be located at either 0x00000000 or 0xFFFF0000 in memory, depending on whether the Alternate ...

View answer
Getting list of opcodes from PANDA trace
Accepted answer
3 votes

At the moment PANDA doesn't provide information about the instruction size (which isn't known before translation) at the level of an individual instruction. One thing you can do, however, is get the ...

View answer
Are Reverse Debuggers Impossible on OSX?
3 votes

Honestly, the stock reversible debugging support in gdb is not all that useful. It's really slow (because it records individual instructions), so you generally have to turn it on just for a critical ...

View answer
Migrate x86 printer drivers to arm [Brother]
2 votes

This is not really related to reverse engineering and might be a better fit for another StackExchange site. That said, I would look into using the x86/x86_64 QEMU with USB passthrough in full-system ...

View answer
Identify targets of a switch table in ARM
Accepted answer
2 votes

No, you can't assume that's how most ARM compilers will implement switch statements. For example, here's gcc 5.2.1 on that same code: cosimo:~ moyix$ arm-none-eabi-gcc-5.2.1 -o3 -mthumb -c x.c -o x.o ...

View answer
How Can I Debug A Bios Better
Accepted answer
2 votes

You can try running your BIOS in QEMU. QEMU's -S option will pause boot until a debugger (gdb) is attached. IDA's debugger apparently works fine with QEMU, according to this article: https://www.hex-...

View answer
How to log every memory read/write action and the registers of the action?
2 votes

There is no way you're going to be able to do this online -- the overhead of tracking registers and memory read/writes is way too high. However, you could instead use a technique called record & ...

View answer
Detect specific algorithms running in a virtual machine via behavior analysis
Accepted answer
2 votes

As Guntram mentioned, the PANDA project is built to make this kind of thing possible. Essentially, it adds instrumentation points to QEMU so that you can build plugins that perform analysis on a whole ...

View answer
Tool for checking for in-memory code modifications of loaded DLLs
Accepted answer
2 votes

WinDbg can do this for Microsoft DLLs and executables (and generally for any code that can be obtained from the symbol server). Just attach the debugger to the process and do !chkimg <module>. ...

View answer
Alter /proc/cmdline for QEMU emulated process
1 votes

The typical way to do something like this is to write a small library that intercepts open/read and fakes out the data your program is looking for, and then arrange for that library to be loaded by ...

View answer
Very simple example log file - Recording program execution
Accepted answer
1 votes

I'm not quite sure what you're after – the minimum you need to record for a given program to have a deterministic replay isn't well defined. In general, you choose some API boundary – for example, the ...

View answer
Call function in remote (OpenOCD) target from gdb
Accepted answer
1 votes

This isn't the cleanest solution, and I still don't know how to make gdb do it properly. My solution was to simply manually "call" the function by: Save the current set of registers (info reg => log ...

View answer