Remko
  • Member for 8 years, 10 months
  • Last seen this week
What is "overlapping instructions" obfuscation?
Accepted answer
28 votes

The paper Static Analysis of x86 Executables explains overlapping instructions quite well. The following example is taken from it (page 28): 0000: B8 00 03 C1 BB mov eax, 0xBBC10300 0005: B9 00 00 ...

View answer
Is reverse engineering and using parts of a closed source application legal?
23 votes

Article 6 of the 1991 EU Computer Programs Directive allows reverse engineering for the purposes of interoperability, but prohibits it for the purposes of creating a competing product, and also ...

View answer
Checking if an .exe is actually a .jar wrapped in an .exe
Accepted answer
23 votes

I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (...

View answer
How to prevent use of Resource editors
15 votes

An elegant and simple solution would be to sign your executable and verify the signature on startup (any change will invalidate the signature). Even if someone patches your signature check, the ...

View answer
How do you reverse engineer an EXE "compiled" with PyInstaller
10 votes

PyInstaller publishes it's source so you see exactly how it packs the python code in the executable... A more general approach would be to use a tool like binwalk on the exe as a first step.

View answer
In what industries is [code] reverse engineering used?
8 votes

Probably a niche but my RE skills often help to get (CR)Applications to work in virtual environments such as Citrix XenApp/XenDesktop. I write a lot about these experiences on my blog. self promo ...

View answer
What happens when a DLL is added to AppInit_DLL
8 votes

The implementation of AppInit DLL in windows 7 is as follows: In user32.dll!ClientThreadSetup the LoadAppInitDlls export from kernel32.dll is being called for any process except the LogonProcess. ...

View answer
Patching a .Net 4.0 Binary in Olly or CFF Explorer
7 votes

There is a plugin called Reflexil for Reflector which makes it very easy to patch a .NET binary. Reflexil is an assembly editor and runs as a plug-in for Red Gate's Reflector and Telerik's ...

View answer
What hints in machine code can point me to the compiler which was used to generate it?
7 votes

Does knowing the compiler used to generate an application help me to more effectively reverse engineer back from the generated object to what the source code might have been, and if it does help, ...

View answer
What techniques are used in reverse engineering a serial protocol?
7 votes

According to J1708 a message is composed like this: byte 0 byte 1 byte 2 byte 3 to N byte N + 1 (N not to exceed 20) MID PID Data Addit. Pids & ...

View answer
What are the essential IDA Plugins or IDA Python scripts that you use?
6 votes

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates ...

View answer
Permanently load a DLL to an executable
5 votes

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or ...

View answer
Load .IDL / TypeLib into Ida Pro
Accepted answer
5 votes

I was able to generate a header file using the midl compiler by exporting the idl file with the OLE/COM Viewer tool (oleview.exe) from the SDK. From oleview select File -> View TypeLib and then save ...

View answer
How to find CLSID from CoCreateInstance in IDA?
Accepted answer
5 votes

CLSID is a GUID and although a GUID can be represented as a string, it's really a struct that looks like this: typedef struct _GUID { DWORD Data1; WORD Data2; WORD Data3; BYTE Data4[8]; } ...

View answer
How to reverse engineer a Windows 10 UWP app?
5 votes

I searched in the System32 folder inside every file named SystemSettting*.* for the word Shutdown. I used Total Commander as it can search with multiple encodings such as ASCII and Unicode: Then ...

View answer
How to detect a virtualized environment?
5 votes

I wrote a test program a while go (in Delphi). The following two functions detect VMware and HyperV // VMware detection as described by Elias Bachaalany function IsInsideVMware: Boolean; begin ...

View answer
How can I enumerate and hook into a Windows 10 RPC interface?
3 votes

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates ...

View answer
Recommended way to modify assembler instructions in IDA
Accepted answer
3 votes

This is quite easy with IDA Pro: With the cursor at the first instruction you want to modify go to Edit | Patch Program | Assemble Change the instruction(s) as required until you are done, then ...

View answer
Edit codes in .Net Reflector with Reflexil (Compile Window)
3 votes

This blog that I wrote a a few years ago describes all the steps to modify a .net binary with Reflector and Reflexil. Not sure which steps you're missing but I recommended to read&compare. ...

View answer
Winapi ReadFile monitor
3 votes

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...

View answer
How to run part of exe file that is being reversed
2 votes

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a ...

View answer
Remove a mutex on windows (with debugger/disassembler)
2 votes

There are 2 methods to do do this: Use an API hook to intercept the call to CreateMutex and change the mutex name (e.g. randomize it). Make a copy of the executable or dll that calls CreateMutex and ...

View answer
School project - Cracking a school emulator
2 votes

As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then ...

View answer
Debug a .dll file within powershell
Accepted answer
2 votes

The file decrypter.dll is a .NET dll which (if it's not obfuscated) means you can decompile it to full readable source code with tools like Reflector, dotPeek or JustDecompile. Here are a couple of ...

View answer
64 bit Pseudocode decompiler
2 votes

Meanwhile Hex Rays does have an x64 Decompiler (adding this answer for people reading now, at the time of Jason's answer the decompiler was not yet available), see the news page: 2014/06/04 The ...

View answer
The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?
2 votes

Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)

View answer
Patching jmp instructions on amd64 with IDA
Accepted answer
2 votes

Patched Code Idea - I can't find much suitable place to insert code - so was thinking of shortening some non-essential strings in .rdata section to insert this code - Is there any issue with this? ...

View answer
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
2 votes

Although it doesn't support breakpoints, Process Monitor is an excellent tool to monitor registry access. Using Filters you can easily choose which keys you want to include, exclude, highlight etc. It ...

View answer
Is it legal to sell clean room engineered products?
2 votes

Even though you may not be breaking copyright, you may still be breaking software patents. In fact I think you may even break a software patent without having looked at the other party's software...

View answer
How do you deobfuscate Java classes?
Accepted answer
2 votes

I am not exactly a Java expert but a while ago I researched the firmware of a car navigation system. For the java bits of it I used the “Java Decompiler project” and it seemed to work well for ...

View answer