MarianD
  • Member for 7 months
  • Last seen more than a week ago
In IDA what does db and dd offset means in data section?
Accepted answer
4 votes

db means “define byte”, i.e. a reservation of 1 byte of memory, dw means “define word” (2 bytes of memory), dd means “define double-word” (4 bytes of memory). The offset prefix means to fill the ...

View answer
What is Hardware Breakpoint and when we need to use it?
Accepted answer
4 votes

The short answer: From the user point of view, software breakpoints are only for instructions, and you may set them as many as you want, while hardware breakpoints are universal, but you may use only ...

View answer
Import table vs Import Address Table
3 votes

First, beside “yours” two tables, I introduce a third one, the Import Lookup Table. Side by side with the Import Address Table, these two tables look like in this simplified picture: This picture ...

View answer
TEST instruction and ZF flag
Accepted answer
3 votes

Why the zero flag must be different from zero? It is a little confusing, but the Zero Flag is set (i.e. its value is 1), if the last result IS zero: result is 0 ⇒ ZF is not 0 result is not 0 ⇒ ZF is ...

View answer
How to run a script in x64dbg
Accepted answer
3 votes

To launch a script, it has to be first loaded into x64dbg — you will see it in the Script tab:                                               Before loading a script, the content of this tab is empty: ...

View answer
I'm having trouble understanding this specific notation in Ghidra
3 votes

LEA means "Load Effective Address", i.e. instead of loading into the EAX register the content at the address ESP+8, it loads directly the address, i.e. the content of the register ESP ...

View answer
Unpacking ASpack Malware
2 votes

Use the ASPack 2.xx.txt script from the Collection of x64dbg scripts. Alternatively, I copied the content of this script file here: ////////////////////////////////////////////////// // FileName : ...

View answer
OllyDbg - ReadFile API
1 votes

What is -> 0? In pBytesRead and Buffer the sign -> appears with 0 and 00. What does that mean? OllyDbg wants to help you, and offer you an additional info — “What is currently at a given ...

View answer
How to check for a valid PE file?
1 votes

The ultimate judge is the particular operating system (more precisely, its loader), i.e. the validity of PE header is always necessary to consider in this context (as wrote the 0xC0000022L in his ...

View answer
How to use decimal in x64dbg calculator?
Accepted answer
1 votes

Yes, it is. For decimal numbers, use the syntax with the period just before the number, e.g. .10: Particularly, in your case you will obtain exactly what you wanted (I omitted leading zeroes):

View answer
How does PIE mitigate exploits?
1 votes

The PIE abbreviation means "Position Independent Executable". Such an executable may ask or not ask the OS for the Address Space Layout Randomization (ASLR), when the OS loader loads the ...

View answer
TEST instruction and ZF flag
1 votes

Let's go into the important instructions in the reversed order. JNZ ... Jump if Not Zero. You want to jump (over the "bad boy"), i.e. you want to obtain "Not Zero" in this (...

View answer
.data segment seems to contain code?
Accepted answer
0 votes

In the .data segment are generally — as it name suggest — simply data. Data are not only ASCII strings, but other data, too. For example, integers and floating-point numbers. They are encoded as ...

View answer
uncompyle6 gives success message but output is not readable
0 votes

Something is wrong with your input .pyc file — probably it isn't a valid Python bytecode file (obtained from a valid .py source file). \xe0, \xb3, \x0b, \x90 are hexadecimal codes for bytes which ...

View answer