Remko
  • Member for 8 years, 10 months
  • Last seen this week
Is it possible to hide the details of which compiler was used?
2 votes

Short answer: no. I don't know of any compiler that has a "stealth mode" switch and if it would have the end result would IMO just be another signature for the same compiler. As @omghai2u suggest you ...

View answer
How to debug / analyze a Themida protected binary
Accepted answer
1 votes

I found the cause of the crash which is... Themida 🤦‍♂️ What happens is that from build 1607 and higher some exports have a double redirection using api sets. The app imports a couple of functions ...

View answer
capturing the sub processes's PID of a process
1 votes

If commandline is required you can subscribe to WMI Win32_ProcessStartTrace events, here's an example in PowerShell: Register-WMIEvent -query "SELECT * FROM Win32_ProcessStartTrace" -SourceIdentifier ...

View answer
Dumping SQLITE database out of memory and viewing without original DB
1 votes

A Hex Editor that supports binary templates to parse and view data is probably the best tool to view where a sqlite database starts and ends. Then you can copy these hex bytes out to a seperate file ...

View answer
Special Properties of Delphi (Object Pascal) Executables
1 votes

When reverse engineering a Delphi/C++ builder target I always use the IDR tool. A very helpful feature is that IDR can generate a map file for Ida Pro. IDR (Interactive Delphi Reconstructor) – a ...

View answer
What's the easiest way to determine the OS contained in a firmware binary?
1 votes

Most operating Systems have some kind of string in it that identifies the os and version. So by looking at the file with a hex editor you can often identify the os. Else you'll need to search for ...

View answer
Locate address of function in DLL
0 votes

If you target known versions you can hardcode the addresses as found it Ida. If you don't know for different versions than best approach is fetch pdb via api and find address that way. This might ...

View answer
1
2