0xea
  • Member for 8 years, 10 months
  • Last seen more than a month ago
Why is this string on the stack not exactly the one I entered?
4 votes

Samurai's answer is correct , but put more clearly , your mistake is that you enter the literal string 123456789abc\x7c\x84\x04\x08 where as what you probably want is something like: perl -e '...

View answer
IDA Pro List of Functions with Instruction
6 votes

Your best bet is to use IDAPython API to do this. To iterate trough all functions you could do something like from idautils import * from idaapi import * ea = BeginEA() for funcea in Functions(...

View answer
Weird binwalk output on GoPro Firmware
2 votes

There will always be false positives with binwalk, especially for lzma and the likes. What you can do is use the -M option to try and binwalk multiple layers deep and also use -r option to remove ...

View answer
How to decompile Linux .so library files from a MS-Windows OS?
6 votes

Linux shared object files are ELFs too! Any decompiler that works on "regular" ELF files will work for SO files too. That said, you can use IDA Pro to disassemble them as usual. If you have IDA Pro ...

View answer
I found the .bin firmware for my Simple.TV device. Binwalk comes up blank. Anything I can do?
2 votes

Use a current. up to date version of binwalk, it works fine $ binwalk rssflash_1035_201311211539.update00.bin DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------...

View answer
Exploit Development with python
2 votes

There is a bunch of python libraries that can aid you in exercising exploitation: Peda - Python Exploit Development Assistance for GDB Peda has this nice option for generating exploit skeletons. ...

View answer
Which condition has to be met to execute this if branch
Accepted answer
5 votes

Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about ...

View answer
Corpus Distillation
Accepted answer
3 votes

Some time ago I wrote minblox for that exact purpose. It relies on DynamoRIO. Compared to minset which uses pin tool, there isn't much of a difference. Tho I think actual set minimization part works ...

View answer
DLL - Dynamic Analysis on IDA
3 votes

IDA Pro has this mechanism called AppCall which basically allows you to set up the parameters of a function and call it directly. Briefly, Appcall is a mechanism used to call functions inside the ...

View answer
Finding end of file
2 votes

In addition to what yaspr said, i'd suggest looking for specification of those contained files. Most file formats have their size specified in the header somewhere. That would allow you to carve the ...

View answer
What are the sections of a x86 linux binary?
3 votes

Those are not sections, those are different functions in your binary. These are called in various times during process' lifetime. What you are interested in is function main. objdump -d disassembles ...

View answer
Need to extend the list of libraries that a shared (.so) library uses
1 votes

I know it's not a direct answer to your question, but would something like LD_PRELOAD mechanism allow you to achieve what you want? With LD_PRELOAD you can specify your library which is to be loaded ...

View answer
Router Decompiling
Accepted answer
3 votes

After unziping the arhive, run binwalk with binwalk -eM *.chm Flag e stands for extract automatically,and M for --matryoshka or recursively scanning and extracting. After a few recursive unpackings,...

View answer
System for reverse engineering RF signals
4 votes

As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most ...

View answer
Good Binary Vulnerability Research Resources
3 votes

You can try playing a few wargames. IO on the SmashTheStack network gives a pretty solid introduction to binary reversing and exploitation and their other wargames are pretty good too. There is also ...

View answer
Converting assembly code to c
3 votes

I'd just like to add what this code actually does, since it's rather simple. It is designed to be used as a shellcode. A relatively standard one. What it does is write something to AHMADUMinU to STDIN ...

View answer
How to interpret entries from Exports tab in ProcessHacker
Accepted answer
2 votes

Those are C++ name decorations. Name decoration usually refers to C++ naming conventions, but can apply to a number of C cases as well. By default, C++ uses the function name, parameters, and ...

View answer
Why the API GetMnem can not deal with instructions like "stosd", "movsd" in IDA Pro?
Accepted answer
7 votes

If you take a look at the specific opcodes for those instructions, they are the same. To be more precise, "stos m8" and stob have the same opcode (0xAA) as do "STOS m16" , "STOS m32", "STOSW" and "...

View answer
How exploit writers find bugs in Java Machine?
12 votes

It largely depends on what kind of vulnerability. This particular one you mentione is in SecurityManager, and you could have found it relatively easily by analyzing the Java source code. To get ...

View answer
Intercepting GSM communications with an USRP and Gnu Radio
12 votes

@domi007 recently published a series of blog posts detailing his efforts on snooping and decrypting GSM. Insted of USRP, he used rtlsdr. He also used an osmocomBB enabled phone. His efforts build upon ...

View answer
Attack on wireless interconnection
Accepted answer
3 votes

If "something like wi-fi" means it's radio but not really 802.11, you might want to take a look at Software Defined Radio projects. As the question isn't really clear, your mileage may vary. There ...

View answer
What is the most efficient way to detect and to break xor encryption?
13 votes

In case of multibyte XOR frequency analysis is the way to go. As is commonly known, most frequent character in regular English text is E (etaoinshrdlu being the top 12) but in some cases space (0x20 ...

View answer
How to debug DLL imported from an application?
Accepted answer
11 votes

In OllyDBG and ImmunityDbg, in Options->Debugging Options-> Events you have an option "Break on new module". If this option is set, whenever a new DLL is loaded, Olly/Immdbg will break and let you do ...

View answer
Is it possible to decrypt an SSL connection (short of bruteforcing)?
6 votes

Properly implemented SSL traffic has a property of forward secrecy. Which means that you can't decrypt it even if you have the whole packet dump and required private keys. As Brendan Dolan-Gavitt ...

View answer
Debugging Shellcode with Bochs and IDA Pro
Accepted answer
6 votes

For testing shellcode on windows and in general, it's good idea to wrap it in a small program that executes it. What you could do is write a small program that would read the shellcode, say , from a ...

View answer
What is this assembly code doing with the command line arguments
2 votes

This code doesn't do anything with command line arguments as far as i can see. What it does is setup the stack and align it. And calls _alloca and __main (if i had to guess, i'd say this is related ...

View answer
Why is disassembly not an exact science?
31 votes

To answer the first question. The biggest problem is that you can't really separate data from code. There are basically two approaches to dissasembly: Linear sweep Recursive traversal Dissasemblers ...

View answer
How to obtain x86-64 pseudocode in IDA Pro?
8 votes

As far as I know, IDA Hex-ray plugin supports only x86 and ARM decompiling (if you have a licence for ARM). It doesn't work on x86_64. However, if you need something that will work on x86_64 take a ...

View answer
Embedding URL call into an image / movie
5 votes

What you ask for would be very near remote code execution, which is usually a security no-no. Tho there are some formats that allow similar things. As far as i remember MOV file format allows you ...

View answer
gdb on FreeBSD and follow-fork-mode child
0 votes

I was digging a bit into this, and found this question on SO by mrduclaw (link in the original article is dead, but web archive has it). He has the exact same problem like I do, and exactly the same ...

View answer