Remko
  • Member for 8 years, 10 months
  • Last seen this week
How to debug / analyze a Themida protected binary
Accepted answer
1 votes

I found the cause of the crash which is... Themida 🤦‍♂️ What happens is that from build 1607 and higher some exports have a double redirection using api sets. The app imports a couple of functions ...

View answer
Permanently load a DLL to an executable
5 votes

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or ...

View answer
How can I enumerate and hook into a Windows 10 RPC interface?
3 votes

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates ...

View answer
Recommended way to modify assembler instructions in IDA
Accepted answer
3 votes

This is quite easy with IDA Pro: With the cursor at the first instruction you want to modify go to Edit | Patch Program | Assemble Change the instruction(s) as required until you are done, then ...

View answer
capturing the sub processes's PID of a process
1 votes

If commandline is required you can subscribe to WMI Win32_ProcessStartTrace events, here's an example in PowerShell: Register-WMIEvent -query "SELECT * FROM Win32_ProcessStartTrace" -SourceIdentifier ...

View answer
How to run part of exe file that is being reversed
2 votes

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a ...

View answer
Load .IDL / TypeLib into Ida Pro
Accepted answer
5 votes

I was able to generate a header file using the midl compiler by exporting the idl file with the OLE/COM Viewer tool (oleview.exe) from the SDK. From oleview select File -> View TypeLib and then save ...

View answer
Remove a mutex on windows (with debugger/disassembler)
2 votes

There are 2 methods to do do this: Use an API hook to intercept the call to CreateMutex and change the mutex name (e.g. randomize it). Make a copy of the executable or dll that calls CreateMutex and ...

View answer
School project - Cracking a school emulator
2 votes

As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then ...

View answer
How to find CLSID from CoCreateInstance in IDA?
Accepted answer
5 votes

CLSID is a GUID and although a GUID can be represented as a string, it's really a struct that looks like this: typedef struct _GUID { DWORD Data1; WORD Data2; WORD Data3; BYTE Data4[8]; } ...

View answer
How to reverse engineer a Windows 10 UWP app?
5 votes

I searched in the System32 folder inside every file named SystemSettting*.* for the word Shutdown. I used Total Commander as it can search with multiple encodings such as ASCII and Unicode: Then ...

View answer
Debug a .dll file within powershell
Accepted answer
2 votes

The file decrypter.dll is a .NET dll which (if it's not obfuscated) means you can decompile it to full readable source code with tools like Reflector, dotPeek or JustDecompile. Here are a couple of ...

View answer
Dumping SQLITE database out of memory and viewing without original DB
1 votes

A Hex Editor that supports binary templates to parse and view data is probably the best tool to view where a sqlite database starts and ends. Then you can copy these hex bytes out to a seperate file ...

View answer
Edit codes in .Net Reflector with Reflexil (Compile Window)
3 votes

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. ...

View answer
64 bit Pseudocode decompiler
2 votes

Meanwhile Hex Rays does have an x64 Decompiler (adding this answer for people reading now, at the time of Jason's answer the decompiler was not yet available), see the news page: 2014/06/04 The ...

View answer
The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?
2 votes

Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)

View answer
Locate address of function in DLL
0 votes

If you target known versions you can hardcode the addresses as found it Ida. If you don't know for different versions than best approach is fetch pdb via api and find address that way. This might ...

View answer
Winapi ReadFile monitor
3 votes

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...

View answer
Patching jmp instructions on amd64 with IDA
Accepted answer
2 votes

Patched Code Idea - I can't find much suitable place to insert code - so was thinking of shortening some non-essential strings in .rdata section to insert this code - Is there any issue with this? ...

View answer
Special Properties of Delphi (Object Pascal) Executables
1 votes

When reverse engineering a Delphi/C++ builder target I always use the IDR tool. A very helpful feature is that IDR can generate a map file for Ida Pro. IDR (Interactive Delphi Reconstructor) – a ...

View answer
What is "overlapping instructions" obfuscation?
Accepted answer
28 votes

The paper Static Analysis of x86 Executables explains overlapping instructions quite well. The following example is taken from it (page 28): 0000: B8 00 03 C1 BB mov eax, 0xBBC10300 0005: B9 00 00 ...

View answer
Patching a .Net 4.0 Binary in Olly or CFF Explorer
7 votes

There is a plugin called Reflexil for Reflector which makes it very easy to patch a .NET binary. Reflexil is an assembly editor and runs as a plug-in for Red Gate's Reflector and Telerik's ...

View answer
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
2 votes

Although it doesn't support breakpoints, Process Monitor is an excellent tool to monitor registry access. Using Filters you can easily choose which keys you want to include, exclude, highlight etc. It ...

View answer
What hints in machine code can point me to the compiler which was used to generate it?
7 votes

Does knowing the compiler used to generate an application help me to more effectively reverse engineer back from the generated object to what the source code might have been, and if it does help, ...

View answer
What are the essential IDA Plugins or IDA Python scripts that you use?
6 votes

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates ...

View answer
How to detect a virtualized environment?
5 votes

I wrote a test program a while go (in Delphi). The following two functions detect VMware and HyperV // VMware detection as described by Elias Bachaalany function IsInsideVMware: Boolean; begin ...

View answer
What's the easiest way to determine the OS contained in a firmware binary?
1 votes

Most operating Systems have some kind of string in it that identifies the os and version. So by looking at the file with a hex editor you can often identify the os. Else you'll need to search for ...

View answer
In what industries is [code] reverse engineering used?
8 votes

Probably a niche but my RE skills often help to get (CR)Applications to work in virtual environments such as Citrix XenApp/XenDesktop. I write a lot about these experiences on my blog. self promo ...

View answer
Is it legal to sell clean room engineered products?
2 votes

Even though you may not be breaking copyright, you may still be breaking software patents. In fact I think you may even break a software patent without having looked at the other party's software...

View answer
What techniques are used in reverse engineering a serial protocol?
7 votes

According to J1708 a message is composed like this: byte 0 byte 1 byte 2 byte 3 to N byte N + 1 (N not to exceed 20) MID PID Data Addit. Pids & ...

View answer