User perror

139 votes

2 answers

125k views

What is PLT/GOT?

asked May 3, 2013 at 8:39

86 votes

3 answers

131k views

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

asked May 4, 2013 at 6:18

63 votes

6 answers

32k views

Where to find (free) training in reverse engineering? [closed]

asked Mar 25, 2013 at 23:14

32 votes

5 answers

43k views

What is the meaning of movabs in gas/x86 AT&T syntax?

asked Aug 12, 2013 at 16:00

29 votes

1 answer

26k views

What symbol tables stay after a strip In ELF format?

asked Jul 26, 2013 at 17:24

29 votes

3 answers

20k views

What is a "control-flow flattening" obfuscation technique?

asked Jun 10, 2013 at 13:46

24 votes

3 answers

55k views

What is the most efficient way to detect and to break xor encryption?

asked May 20, 2013 at 16:44

24 votes

5 answers

12k views

What are the tools to analyze Python (obfuscated) bytecode?

asked May 3, 2013 at 17:06

24 votes

1 answer

9k views

How to use sysenter under Linux?

asked Oct 2, 2013 at 18:33

23 votes

4 answers

8k views

What is "overlapping instructions" obfuscation?

asked Apr 3, 2013 at 8:11

21 votes

3 answers

6k views

Anti-debug techniques on Unix platforms?

asked Mar 20, 2013 at 9:13

20 votes

2 answers

36k views

Managing inputs for payload injection?

asked Nov 14, 2016 at 16:13

19 votes

2 answers

15k views

How to predict address space layout differences between real and gdb-controlled executions?

asked Oct 30, 2013 at 11:15

19 votes

4 answers

12k views

What is an "opaque predicate"?

asked Apr 9, 2013 at 7:48

19 votes

8 answers

28k views

How to detect a virtualized environment?

asked Apr 9, 2013 at 22:12

17 votes

2 answers

14k views

Intercepting GSM communications with an USRP and Gnu Radio

asked Oct 27, 2013 at 7:15

16 votes

4 answers

4k views

How to recover variables from an assembly code?

asked Mar 26, 2013 at 16:31

15 votes

2 answers

12k views

What are the different types of packers?

asked Apr 15, 2013 at 11:36

14 votes

5 answers

3k views

How to capture an "in-memory" malware in MS-Windows?

asked Apr 14, 2013 at 9:41

14 votes

2 answers

5k views

Using QEmu monitor interface to extract execution traces from a binary?

asked Jun 30, 2014 at 9:21

13 votes

1 answer

30k views

Looking for exported symbols in a DLL with objdump?

asked Nov 28, 2013 at 18:47

13 votes

2 answers

34k views

How to prevent "upx -d" on an UPX packed executable?

asked Dec 30, 2013 at 11:04

13 votes

5 answers

1k views

How do you store your data about a binary while performing analysis?

asked Apr 27, 2013 at 9:29

13 votes

2 answers

8k views

What is the algorithm used in Recursive Traversal disassembly?

asked Jun 26, 2013 at 15:34

12 votes

3 answers

14k views

How to detect thumb mode in ARM disassembly?

asked Aug 15, 2014 at 22:18

11 votes

2 answers

15k views

How to display memory zones content on IDA Pro?

asked Apr 23, 2013 at 7:21

11 votes

1 answer

9k views

Could you list some useful plugins and scripts for IDA Pro? [closed]

asked Apr 17, 2013 at 10:02

11 votes

1 answer

3k views

What are the main features of radare2?

asked Apr 18, 2013 at 9:34

11 votes

3 answers

7k views

What are the available libraries to statically modify ELF executables?

asked Apr 18, 2013 at 9:43

11 votes

2 answers

6k views

How does BinDiff work?

asked Apr 2, 2013 at 9:35

Stack Exchange Network

64 Questions

What is PLT/GOT?

How are the segment registers (fs, gs, cs, ss, ds, es) used in Linux?

Where to find (free) training in reverse engineering? [closed]

What is the meaning of movabs in gas/x86 AT&T syntax?

What symbol tables stay after a strip In ELF format?

What is a "control-flow flattening" obfuscation technique?

What is the most efficient way to detect and to break xor encryption?

What are the tools to analyze Python (obfuscated) bytecode?

How to use sysenter under Linux?

What is "overlapping instructions" obfuscation?

Anti-debug techniques on Unix platforms?

Managing inputs for payload injection?

How to predict address space layout differences between real and gdb-controlled executions?

What is an "opaque predicate"?

How to detect a virtualized environment?

Intercepting GSM communications with an USRP and Gnu Radio

How to recover variables from an assembly code?

What are the different types of packers?

How to capture an "in-memory" malware in MS-Windows?

Using QEmu monitor interface to extract execution traces from a binary?

Looking for exported symbols in a DLL with objdump?

How to prevent "upx -d" on an UPX packed executable?

How do you store your data about a binary while performing analysis?

What is the algorithm used in Recursive Traversal disassembly?

How to detect thumb mode in ARM disassembly?

How to display memory zones content on IDA Pro?

Could you list some useful plugins and scripts for IDA Pro? [closed]

What are the main features of radare2?

What are the available libraries to statically modify ELF executables?

How does BinDiff work?