Peter Andersson
  • Member for 8 years, 10 months
  • Last seen more than 3 years ago
Decompiling iPhone App
47 votes

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device ...

View answer
How can I reverse optimized integer division/modulo by constant operations?
Accepted answer
40 votes

First Unfortunately we don't seem to have MathJax turned on in this stackexchange so the math parts below are pretty horribly formatted. I'm also far from a mathematician so the notation may be off ...

View answer
What kinds of steps can I take to make my C++ application harder to reverse engineer?
Accepted answer
36 votes

Compiler The choice of a compiler has minimal effects on the difficulty to reverse engineer your code. The important things to minimize are all related to information leaks from your code. You want ...

View answer
How do I acquire SoftICE?
Accepted answer
34 votes

SoftICE is pretty much dead. If you're looking for the same look and feel you can always check out Syser or BugChecker. Haven't used them myself as I think most kernel level debugging now a days is ...

View answer
How can I set a breakpoint for a button click?
Accepted answer
25 votes

It very much depends on what framework they use in order to do their windowing. It could be MFC, WPF, WinForms, WTL, QT, wxWidgets, pure Windows API. There's a lot of frameworks and they all handle ...

View answer
Purpose of OR EAX,0xFFFFFFFF
Accepted answer
22 votes

I think that in order to understand why the compiler does this, study the following disassembly: B8 FF FF FF FF mov eax, 0FFFFFFFFh 83 C8 FF ...

View answer
How are x86 CPU instructions encoded?
Accepted answer
20 votes

If you want to understand the instruction encodings in detail you need to study Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 2 (Instruction Set Reference, A-Z). Be aware that ...

View answer
USB Dongle Traffic Monitoring
Accepted answer
17 votes

It depends on what your budget is like. The best USB analyzers are hardware devices with good protocol dissectors. If you have a huge budget you can go with the various solutions from LeCroy such as ...

View answer
Determining if a variable is local or an argument passed to a function
Accepted answer
17 votes

Parameters Not only does it depend on the platform but different functions have different calling conventions. The calling convention basically tells you how you know where the arguments are. It says ...

View answer
How can DLL injection be detected?
16 votes

What you're trying to do is very hard if the attacker is an experienced game hacker and the specifics of the cheat is unknown. In general if you want to inject a DLL which is harder to detect and won'...

View answer
Are hardware dongles able to protect your software?
15 votes

Problem description Let's make a couple of assumptions. Software is divided into functional components. Licenses are for functional components within that software package. Licenses can be based on ...

View answer
What is a FLIRT signature?
15 votes

A flirt signature is a pattern used to match known function headers. As an example consider the following: push ebp mov ebp, esp sub esp, 4Ch mov [ebp+var_4], eax push ebx push ...

View answer
Understanding this Buffer Overflow exploitation
Accepted answer
13 votes

If you look at the disassembly of authorize() I'm sure you'll find that the compiler is pushing and restoring more registers than just EBP or aligning the stack. I would recommend that you always look ...

View answer
What different UPX formats exist and how do they differ?
Accepted answer
12 votes

I will ignore that there's multiple compression algorithms in UPX and that there's been multiple versions of UPX. Generally when people ask if it's plain or vanilla UPX it's because malware and ...

View answer
How should I determine the format of this audio file?
Accepted answer
11 votes

As for the automated approach, the file command is the classic recommendation. It's a tool which tries to guess the file type from the data contained in the file. It implements many of the well known ...

View answer
Which calling convention to use for EAX/EDX in IDA
10 votes

If you run into a calling convention which is not covered by any of the standard calling conventions you can use the __usercall or __userpurge calling convention which allows you to specify which ...

View answer
Could you list some useful plugins and scripts for IDA Pro?
Accepted answer
10 votes

By Architecture Generic helpers for reverse engineering of a specific architecture. ia32 amd64 ARM By Operating System Generic helpers for reverse engineering of a specific operating system. Windows ...

View answer
mathematical background behind exploit development and vulnerabilities
Accepted answer
10 votes

I would read up on static program analysis Static program analysis is the analysis of computer software that is performed without actually executing programs (analysis performed on executing ...

View answer
Decryping TLS packets between Windows 8 apps and Azure
Accepted answer
10 votes

If the data is being passed as HTTPS you could try the classic Fiddler man-in-the-middle approach. I'm not sure whether the Windows store respects the proxy settings or whether it has a pinned ...

View answer
Viewing MSSQL transactions between closed-source application and server
Accepted answer
10 votes

Most databases are very friendly to tracing and profiling while the database is running. You need to do very little actual reverse engineering. There's a program called SQL Server Profiler which I ...

View answer
Why IDA Pro generated a "j_printf" function call?
Accepted answer
9 votes

It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single ...

View answer
Do disassemblers detect standard functions?
9 votes

One thing that's important to realize is that standard runtimes are commonly treated as any other code or library. How compiled code is linked and loaded depends a lot on the platform. .net is very ...

View answer
Stronger than Themida?
Accepted answer
8 votes

You might want to review an answer I provided before over here. Themida and CodeVirtualizer are fine. If you want something stronger you should keep your code on a server or run it on a dedicated ...

View answer
How can I analyze a program that uses a JIT compiled code?
Accepted answer
8 votes

For .net there's SOS.dll and WinDbg. You can find versions, for each version of installed .NET frameworks, in sub-folders in %SYSTEMROOT%\Microsoft.NET\Framework\. You can load it into WinDbg by ...

View answer
How to produce binaries with "instruction camouflage" obfuscation?
Accepted answer
8 votes

In general what you do is that you make a new segment in the executable, change the entry point to your new segment. Your new segment has the decryption code for the original code and the changed ...

View answer
Break on returning to a specific module
Accepted answer
7 votes

Go to the memory window in Ollydbg. Find the code section (usually .text) of the module you want to break on return to. Right click the memory section and set break-on-access or hit F2. You'll break ...

View answer
Defeat rsa hash verification
Accepted answer
6 votes

Your hunches are correct. Appending all the numbers in the signature fields you get the number s = ...

View answer
How can I prevent Immunity Debugger / OllyDbg from breaking on attach?
6 votes

I don't think this is possible without doing something extremely invasive. Either patching OllyDbg to use an alternative ZwXX/NtXX function which accepts some flags or patching the kernel. The initial ...

View answer
Canonical method to circumvent the ZwSetInformationThread antidebugging technique
Accepted answer
6 votes

SetWindowsHookEx isn't really used for this sort of hooking as far as I'm aware. You could hook NtSetInformationThread in the import of the binary you want to analyze and make it always return ...

View answer
When is applying reverse engineering techniques acceptable?
6 votes

If you have a legal issue you consult with a lawyer. Even a lawyer will never ensure you of anything. They will provide legal advice based on precedent. If you want to explore the matter in depth you ...

View answer