0xea
  • Member for 8 years, 10 months
  • Last seen more than a month ago
What is PLT/GOT?
Accepted answer
112 votes

PLT stands for Procedure Linkage Table which is, put simply, used to call external procedures/functions whose address isn't known in the time of linking, and is left to be resolved by the dynamic ...

View answer
Why is disassembly not an exact science?
31 votes

To answer the first question. The biggest problem is that you can't really separate data from code. There are basically two approaches to dissasembly: Linear sweep Recursive traversal Dissasemblers ...

View answer
What is the most efficient way to detect and to break xor encryption?
13 votes

In case of multibyte XOR frequency analysis is the way to go. As is commonly known, most frequent character in regular English text is E (etaoinshrdlu being the top 12) but in some cases space (0x20 ...

View answer
How exploit writers find bugs in Java Machine?
12 votes

It largely depends on what kind of vulnerability. This particular one you mentione is in SecurityManager, and you could have found it relatively easily by analyzing the Java source code. To get ...

View answer
Intercepting GSM communications with an USRP and Gnu Radio
12 votes

@domi007 recently published a series of blog posts detailing his efforts on snooping and decrypting GSM. Insted of USRP, he used rtlsdr. He also used an osmocomBB enabled phone. His efforts build upon ...

View answer
How to find offsets in OllyDBG from IDA
Accepted answer
12 votes

If only the base is changed, but offsets are constant (as I'd guess is the case), you can just rebase the program in IDA. You can do so by edit->segments->Rebase program ... menu. Specifying the same ...

View answer
How to debug DLL imported from an application?
Accepted answer
11 votes

In OllyDBG and ImmunityDbg, in Options->Debugging Options-> Events you have an option "Break on new module". If this option is set, whenever a new DLL is loaded, Olly/Immdbg will break and let you do ...

View answer
How to reverse engineer an ATM?
Accepted answer
11 votes

Some information might be found in Barnaby Jack's BlackHat presentation: Jackpotting Automated Teller Machines (Youtube) The most prevalent attacks on Automated Teller Machines typically involve ...

View answer
How to identify function calls in IDA Pro's disassembly?
Accepted answer
10 votes

The easiest way to find out the function in question would probably be by dynamic analysis. You can easily do this by placing a breakpoint on that instruction in a debugger and examining the registers....

View answer
How to create an API for a web application without its source code?
10 votes

You could use some tools to view what gets sent from your browser to the web app and deduce how to "emulate" this behavior. A network sniffer would be the most useful here. Wireshark (especially it's ...

View answer
Tracking What Is Done With a Function's Return Value
9 votes

A more general name for that problem is Data Tainting. You mark some data as tainted, and then follow the taint propagation in the rest of the code. There is quite a lot of research going on about ...

View answer
Determine Encryption Algorithm
9 votes

For a bit more advanced way of automatic crypto identification see Felix Gröbert's work on Automatic Identification of Cryptographic Primitives in Software . He uses a pintool to dynamically ...

View answer
What happens when a DLL is added to AppInit_DLL
Accepted answer
9 votes

Basically, all DLLs listed in that reg-key are loaded when any process is started. For more info see Working with the AppInit_DLLs registry value. All the DLLs that are specified in this value are ...

View answer
Reverse engineering XKCD 1190
Accepted answer
9 votes

Somebody at XKCD fora pasted a link to this gist which contains a deobfuscated and annotated source along with some explanations: The main part of Javascript that drives xkcd's "Time" comic (http:/...

View answer
How to obtain x86-64 pseudocode in IDA Pro?
8 votes

As far as I know, IDA Hex-ray plugin supports only x86 and ARM decompiling (if you have a licence for ARM). It doesn't work on x86_64. However, if you need something that will work on x86_64 take a ...

View answer
Why the API GetMnem can not deal with instructions like "stosd", "movsd" in IDA Pro?
Accepted answer
7 votes

If you take a look at the specific opcodes for those instructions, they are the same. To be more precise, "stos m8" and stob have the same opcode (0xAA) as do "STOS m16" , "STOS m32", "STOSW" and "...

View answer
USB Dongle Traffic Monitoring
7 votes

Tho maybe not directly what you are looking for I'd just like to add one item to Peter Andersson's thorough answer. Travis Goodspeed's facedancer (some more recent info ). Its design is also open ...

View answer
IDA Pro List of Functions with Instruction
6 votes

Your best bet is to use IDAPython API to do this. To iterate trough all functions you could do something like from idautils import * from idaapi import * ea = BeginEA() for funcea in Functions(...

View answer
How to decompile Linux .so library files from a MS-Windows OS?
6 votes

Linux shared object files are ELFs too! Any decompiler that works on "regular" ELF files will work for SO files too. That said, you can use IDA Pro to disassemble them as usual. If you have IDA Pro ...

View answer
Is it possible to decrypt an SSL connection (short of bruteforcing)?
6 votes

Properly implemented SSL traffic has a property of forward secrecy. Which means that you can't decrypt it even if you have the whole packet dump and required private keys. As Brendan Dolan-Gavitt ...

View answer
Debugging Shellcode with Bochs and IDA Pro
Accepted answer
6 votes

For testing shellcode on windows and in general, it's good idea to wrap it in a small program that executes it. What you could do is write a small program that would read the shellcode, say , from a ...

View answer
Remote debugging with IDA and GDB
6 votes

I'd suggest you use IDA's linux_server for remote debugging , it's located somewhere in your installation. You copy it to the remote machine and run it. And then in IDA you go Debugger -> Select ...

View answer
Which condition has to be met to execute this if branch
Accepted answer
5 votes

Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about ...

View answer
Embedding URL call into an image / movie
5 votes

What you ask for would be very near remote code execution, which is usually a security no-no. Tho there are some formats that allow similar things. As far as i remember MOV file format allows you ...

View answer
Decode date and time in a sequence of binary data
5 votes

Apparently, OLE datetime is based on double values, where whole part is number of days since epoch, and fraction part is fraction of the day. Found some info in Time Format Conversion Made Easy in the ...

View answer
Where can someone interested in the topic learn more about Dynamic binary instrumentation?
5 votes

Jurriaan Bremer wrote at least two articles that can be quite informing regaring Pin which can serve as a nice introduction. Detecting Uninitialized Memory Read Access Bugs using Pin (a la Valgrind) ...

View answer
Linux protectors: any good one out there?
5 votes

ZVrba's Phrack article on cryptexec: Next-generation runtime binary encryption is a good read and it doesn't rely on additional kernel functionality: This article describes a method to control ...

View answer
How do I determine code coverage when fuzzing
Accepted answer
5 votes

Not sure how it fares against application with JIT compiled code, but peach has a minset utility to make a minimal set of files with highest code coverage: This tool will run each sample file ...

View answer
Why is this string on the stack not exactly the one I entered?
4 votes

Samurai's answer is correct , but put more clearly , your mistake is that you enter the literal string 123456789abc\x7c\x84\x04\x08 where as what you probably want is something like: perl -e '...

View answer
System for reverse engineering RF signals
4 votes

As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most ...

View answer